node-openid-client

Fixes

• typescript: add client_id and logout_hint to EndSessionParameters (b7b5438)

Features

• add client_id to endSessionUrl query strings (6fd9350)

Fixes

• allow endSessionUrl defaults to be overriden (7cc2402)

Refactor

• engines: remove package.json engines restriction (9aefba3)

Fixes

• safeguard TokenSet prototype methods (7468674), closes #511

Fixes

• ignore non-conform "unrecognized" id_token in oauthCallback() (3425110), closes #503

Fixes

• improve support of electron BrowserWindow with nodeIntegration (9e5ea0f)

Fixes

• typescript: add types export for nodenext module resolution (92fd33d)

Fixes

• interoperable audience array value for JWT Client auth assertions (again) (96b367d)
• typescript: add error constructors (#483) (9505cba)

Fixes

• dpop: htu without querystring (f6fa149)

Fixes

• add application/jwk-set+json to accept header for JWKS calls (#467) (f94d42b), closes #466

Fixes

• passing null as checks.nonce should not disable it (5120a07)

Fixes

• allow setting timeout to 0 to disable it (32b28b5), closes #443

Features

• support OAuth 2.0 Authorization Server Issuer Identification (fb6a141)
• support server-provided DPoP nonces (update DPoP to draft-04) (a84950a)

Fixes

• reject oauthCallback when id_token is detected (92ffee5)
• typescript: ts-ignore missing AbortSignal global (d975c11), closes #433

Bug Fixes

• explicitly set content-length again (956c34b), closes #420

Bug Fixes

• explicitly set accept: application/json again (89cdbe2)

⚠ BREAKING CHANGES

• The 'query' way of passing access token to userinfo was removed.
• Access Token is now asserted to be present for userinfo and requestResource calls.
• The registry export was removed.
• FAPIClient is renamed to FAPI1Client
• FAPI1Client has default algorithms set to PS256 rather than RS256
• FAPI1Client has default tls_client_certificate_bound_access_tokens set to true
• FAPI1Client has default response_types set to id_token code and grant_types accordingly
• FAPI1Client has no token_endpoint_auth_method set, one must be set explicitly
• Client methods unpackAggregatedClaims and fetchDistributedClaims were removed with no replacement.
• DPoP option inputs must be a private crypto.KeyObject or a valid crypto.createPrivateKey input.
• Issuer.prototype.keystore is now private API
• HTTP(S) request customization now only recognizes the following options 'agent', 'ca', 'cert', 'crl', 'headers', 'key', 'lookup', 'passphrase', 'pfx', and 'timeout'. These are standard node http/https module request options, got-library specific options such as 'followRedirect', 'retry', or 'throwHttpErrors' are no longer recognized.
• The arguments inside individual HTTP request customization changed, first argument is now an instance of URL, the http request options object is passed in as a second argument.
• The response property attached to some RPError or OPError instances is now an instance of http.IncomingMessage. Its body is available on its body property as either JSON if it could be parsed, or a Buffer if it failed to pass as JSON.
• Drop support for Node.js v10.x
• Only Node.js LTS releases Codename Erbium (^12.19.0) and newer are supported. Currently this means ^12.19.0 (Erbium), ^14.15.0 (Fermium), and ^16.13.0 (Gallium).
• Issuer.discover will no longer attempt to load /.well-known/oauth-authorization-server. To load such discovery documents pass full well-known URL to Issuer.discover.

Refactor

• DPoP input must be a private KeyObject or valid crypto.createPrivateKey input (d69af6f)
• FAPIClient is renamed to FAPI1Client (59a4e73)
• Issuer.prototype.keystore is now private API (0c23248)
• only use the native http(s) client (83376ac)
• remove automatic lookup of /.well-known/oauth-authorization-server (fc87d2b)
• remove client.unpackAggregatedClaims and client.fetchDistributedClaims (b7f261f)
• remove Registry public API export (6b91d58)
• remove the 'query' option for userinfo, assert access token (eb9d139)
• update Node.js semver support matrix (8b3044e)

Bug Fixes

• do not implicitly calculate key ids for Client instances (46e44e7), closes #379

Features

• update DPoP support to draft-03 (#407) (5565ee1), closes #406

Features

• OAuth 2.0 Pushed Authorization Requests (PAR) is now a stable feature (327f366)

Bug Fixes

• typescript: add remaining properties from RFC7662 (#398) (166e89b)