node-openid-client

Documentation

• update link to passport example (110575b)

Fixes

• correct supportsPKCE bool return (f1aa9db), closes #710

Features

• add a server metadata helper for checking PKCE support (ca34a91)
• add JWKS Cache management for use in non-persistent runtimes (cda4b53)

⚠ BREAKING CHANGES

• openid-client v6.x is a complete rewrite of the openid-client module, this is the first time since 0.1.0 (8 years ago) that the API has drastically changed. The new module structure and API focuses on three core principles:

• runtime compatibility (adding support for Deno, Cloudflare Workers, Bun, and other Web API interoperable runtimes)
• tree-shakeability (bundles should not contain features that don't end up being used)
• less options (removing support for processing deprecated response types, cutting down on the number of combinations that need to handled)

To that end openid-client@6 no longer supports the full cartesian matrix of response types and response modes, it no longer supports issuing encrypted assertions, decrypting assertions is limited to only a few algorithms, it no longer supports Dynamic Client Registration or Management, and Self-Issued OpenID Provider responses are also not supported.

The new API makes basic setups simple while allowing some degree of complexity where needed.

openid-client@6 is an ESM module using ES2022 syntax and it depends on WebCryptoAPI and Fetch API globals being available in the JS runtime.

openid-client@6 is written in TypeScript and its exported types come with comment annotations.

(Node.js) Versions 20.x and newer have all the necessary globals.

(Node.js) CJS style let client = require('openid-client') is possible in versions where process.features.require_module is true. This is a new Node.js feature slated to be released without a CLI flag in 23.x and 22.x

⚠ BREAKING CHANGES

openid-client v6.x is a complete rewrite of the openid-client module, this is the first time since 0.1.0 (8 years ago) that the API has drastically changed. The new module structure and API focuses on three core principles:

• runtime compatibility (adding support for Deno, Cloudflare Workers, Bun, and other Web API interoperable runtimes)
• tree-shakeability (bundles should not contain features that don't end up being used)
• less options (removing support for processing deprecated response types, cutting down on the number of combinations that need to handled)

To that end openid-client@6 no longer supports the full cartesian matrix of response types and response modes, it no longer supports issuing encrypted assertions, decrypting assertions is limited to only a few algorithms, it no longer supports Dynamic Client Registration or Management, and Self-Issued OpenID Provider responses are also not supported.

The new API makes basic setups simple while allowing some degree of complexity where needed.

openid-client@6 is an ESM module using ES2022 syntax and it depends on WebCryptoAPI and Fetch API globals being available in the JS runtime.

openid-client@6 is written in TypeScript and its exported types come with comment annotations.

(Node.js) Versions 20.x and newer have all the necessary globals. v18.x is being tested in CI as well with the --experimental-global-webcrypto CLI flag.

(Node.js) CJS style let client = require('openid-client') is possible in versions where process.features.require_module is true. This is a new Node.js feature slated to be released without a CLI flag in 23.x and 22.x

Link to docs and examples

Features

• add FAPI 2.0 support (55b8a33)

Fixes

• include DPoP Proof "htm" in requestResource if GET is defaulted to (23f7b49)

Refactor

• avoid use of prototype attributes in keystore queries (#660) (47a549c)

Revert "fix: encode client_secret_basic - _ . ! ~ * ' ( ) characters"

This reverts commit 5a2ea80ef5e59ec0c03dbd97d82f551e24a9d348, even though it is the correct implementation some of the most widely used identity providers don't follow the specification.

Fixes

• encode client_secret_basic - _ . ! ~ * ' ( ) characters (5a2ea80)

Refactor

• issuer discovery (#637) (c228877)

Fixes

• add explicit Accept-Encoding header to http requests (abcb564), closes #648

Fixes

• consistent space encoding in authorizationUrl (#627) (ad68223), closes #626

Features

• experimental Bun support (a9d3a87), closes #622 #623

Features

• DPoP: remove experimental warning, DPoP is now RFC9449 (133a022)

Fixes

• handle empty client_secret with basic and post client auth (#610) (402c711), closes #609

Fixes

• bump oidc-token-hash (20607e9)

This release contains only code refactoring, dependency, or documentation updates. The release process now also uses provenance statements.

Features

• allow third party initiated login requests to trigger strategy (568709a), closes #510 #564

Refactor

• remove use of Node.js v8 builtin (f1881bc), closes #442 #475 #555

Fixes

• regression introduced in v5.3.3 (4f6e847)

Fixes

• passport: ignore static state and nonce passed to Strategy() (#556) (43daff3)

Fixes

• typescript: requestResource returns a Promise (#546) (8bc9519), closes #488

Features

• JARM is now a stable feature (10e3a37)