v0.19.2

openid: Resolves timing issues by setting now to the future (#270)

v0.19.1

openid: Improves validation errors and uses UTC everywhere (#269)

v0.19.0: openid: Improves prompt, max_age and id_token_hint validation (#268)

This patch improves the OIDC prompt, max_age, and id_token_hint
validation.

v0.18.1: openid: Adds a validator used to validate OIDC parameters (#266)

The validator, for now, validates the prompt parameter of OIDC requests.

v0.18.0: oauth2: Introspection should return token type (#265)

Closes #264

This patch allows the introspection handler to return the token type (e.g. `access_token`, `refresh_token`) of the
introspected token. To achieve that, some breaking API changes have been introduced:

* `OAuth2.IntrospectToken(ctx context.Context, token string, tokenType TokenType, session Session, scope ...string) (AccessRequester, error)` is now `OAuth2.IntrospectToken(ctx context.Context, token string, tokenType TokenType, session Session, scope ...string) (TokenType, AccessRequester, error)`.
* `TokenIntrospector.IntrospectToken(ctx context.Context, token string, tokenType TokenType, accessRequest AccessRequester, scopes []string) (error)` is now `TokenIntrospector.IntrospectToken(ctx context.Context, token string, tokenType TokenType, accessRequest AccessRequester, scopes []string) (TokenType, error)`.

This patch also resolves a misconfigured json key in the `IntrospectionResponse` struct. `AccessRequester AccessRequester json:",extra"` is now properly declared as `AccessRequester AccessRequester json:"extra"`.

0.17.2

core: Regression fix for request ID in refresh token flow (#262)

Signed-off-by: Beorn Facchini <[email protected]>

0.17.1

core: Adds ExactScopeStrategy (#260)

The ExactScopeStrategy performs a simple string match (case sensitive)
of scopes.

v0.17.0

core: Sanitizes request body before sending it to the storage adapter…

0.16.5

v0.16.5

introspection: Improves debug messages (#254)

0.16.4

handler: Adds PKCE implementation for none and S256 (#246)

This patch adds support for PKCE (https://tools.ietf.org/html/rfc7636) which is used by native apps (mobile) and prevents eavesdropping attacks against authorization codes.

PKCE is enabled by default but not enforced. Challenge method plain is disabled by default. Both settings can be changed using `compose.Config.EnforcePKCE` and `compose.config.EnablePKCEPlainChallengeMethod`.

Closes #213