• Removed future issued-at claim check stevehobbsdev - https://github.com/auth0/auth0-spa-js/pull/329

Added

• Ability to use either an in-memory cache (the default) or localstorage to store tokens - stevehobbsdev - https://github.com/auth0/auth0-spa-js/pull/303
• Added support for rotating refresh tokens - stevehobbsdev - https://github.com/auth0/auth0-spa-js/pull/315

New cache location options

By default, auth0-spa-js will store tokens in memory. We have now added a second option, allowing you to store tokens in local storage. This has the benefit of being able to persist tokens across page refreshes.

The storage strategy can be configured using the option cacheLocation when invoking createAuth0Client:

const auth0 = await createAuth0Client({
    domain: '<your Auth0 domain>',
    client_id: '<your Auth0 client ID>',
    cacheLocation: 'localstorage'
});

The cacheLocation option can be set to one of two values: memory, or localstorage.

Note: Please be aware that configuring the SDK to store tokens in local storage could leave your tokens vulnerable in the event of an XSS attack.

• Included core-js polyfill for String.includes to fix an issue with browser-tabs-lock in IE11 stevehobbsdev - https://github.com/auth0/auth0-spa-js/pull/325

• Added import definition to Getting Started section in the Readme for clarity thundermiracle - https://github.com/auth0/auth0-spa-js/pull/294

Added
Added buildAuthorizeUrl and url parameter to handleRedirectCallback - austin43 - https://github.com/auth0/auth0-spa-js/pull/280

Fixed
Released browser lock on getTokenSilently error - https://github.com/auth0/auth0-spa-js/pull/276
Updates browser-tabs-lock to fix issue of long acquired lock - super-tokens - https://github.com/auth0/auth0-spa-js/commit/3413e30bdb5955c818989cdc050079fa6efb6050

Added
Add a new property 'fragment' to be appended to the authorize URL on redirect - https://github.com/auth0/auth0-spa-js/pull/249

Fixed
Update typescript definition for max_age param - https://github.com/auth0/auth0-spa-js/pull/260
Fix for typings files in packaged SDK - https://github.com/auth0/auth0-spa-js/pull/263

Added
Add 'lock' to prevent getTokenSilently to be invoked in parallel https://github.com/auth0/auth0-spa-js/pull/238
Improved OIDC compliance https://github.com/auth0/auth0-spa-js/pull/248

Fixed
Fix for race condition when using sha256 on IE11 https://github.com/auth0/auth0-spa-js/pull/252
Fixed the codeowners file with the correct group https://github.com/auth0/auth0-spa-js/pull/253
Document leeway default value https://github.com/auth0/auth0-spa-js/pull/256
Clear transaction data on error https://github.com/auth0/auth0-spa-js/pull/254

parseQueryString now removes hash fragment on query before parsing #246

Fixed
Fix IE msCrypto.subtle usage https://github.com/auth0/auth0-spa-js/pull/242

Fixed
Add missing char for nonce/state generation https://github.com/auth0/auth0-spa-js/pull/230
Fix query parsing when using hash routing https://github.com/auth0/auth0-spa-js/pull/231
Fix safari10 initialization error https://github.com/auth0/auth0-spa-js/pull/232

Changed
Add early expiration of Access Token in cache https://github.com/auth0/auth0-spa-js/pull/233

Fixed

Fix empty PKCE code challenge https://github.com/auth0/auth0-spa-js/pull/221

Fixed

Fix incorrect state extraction from query string https://github.com/auth0/auth0-spa-js/pull/197

Fixed

Replace promise polyfill for a pure one. This fixes using this library with zone.js. https://github.com/auth0/auth0-spa-js/pull/180

Fixed

• Expose raw id_token in the getIdTokenClaims method https://github.com/auth0/auth0-spa-js/pull/175
• Fix bug where oauth/token call ignores options.audience https://github.com/auth0/auth0-spa-js/pull/134

Added

• Add IE11 polyfills https://github.com/auth0/auth0-spa-js/pull/154
• Add popup timeout config https://github.com/auth0/auth0-spa-js/pull/133
• Add ?federated logout param https://github.com/auth0/auth0-spa-js/pull/129

Changed

• Allow redirect_uri override in loginWithRedirect - https://github.com/auth0/auth0-spa-js/pull/66
• Make options argument for popup and redirect optional - https://github.com/auth0/auth0-spa-js/pull/61
• Mark redirect_uri optional in RedirectLoginOptions - https://github.com/auth0/auth0-spa-js/pull/53

Changed

• Reduce transaction cookie size - https://github.com/auth0/auth0-spa-js/pull/32

Initial Release

Changelog

Typescript fix https://github.com/auth0/auth0-spa-js/pull/21