v9.4.2

Fixes

• check for native logout redirect allowed same way as during auth (419f286), closes #1351

v9.4.1

Documentation

• add an getAttestationSignaturePublicKey example (3a7730c)

Refactor

• avoid code generation from strings by pre-compiling eta views (f997073)
• drop the default implementation of pairwiseIdentifier (6a2338a)
• remove oidc-token-hash dependency (b607491)

v9.4.0

Features

• Experimental support for Attestation-Based Client Authentication (d655ebd)

Refactor

• consistently lowercase header names and use req/res aliases (1748a54)
• cors: update default client-based cors helper (77e06eb)
• reconcile dpop and attestation challenge implementations (e31f639)

Documentation

• updated documentation for configuration options (5710d61)

v9.3.0

Features

• revocation: add an allowed token revocation policy helper (a7e47e4)

Documentation

• update README.md (857c34d)

Fixes

• introspection: use unsupported_token_type to indicate structured jwt tokens cannot be introspected (c9001be)
• revocation: use unsupported_token_type to indicate structured jwt tokens cannot be revoked (b45b00c)

Refactor

• pull structured token rejection to a shared middleware (30367af)

v9.2.0

Features

• expose RFC8414 Authorization Server Metadata route (c5bd90f)

v9.1.3

Fixes

• ensure an account's accountId and claims().sub is the same (9b89153), closes #1336

v9.1.2

Fixes

• ignore allowOmittingSingleRegisteredRedirectUri when FAPI 2.0 is used (e2de529)

v9.1.1

Refactor

• oidc-provider now uses koa@3 (3a83d32)

v9.1.0

Features

• experimental support for OIDC RP Metadata Choices (f3550da)

Fixes

• only include DPoP-Nonce in Access-Control-Expose-Headers when DPoP is enabled (e769aa8)

Refactor

• avoid assignment operators in conditional expressions (b7ed877)
• improve static find performance (106f94a)
• update some default helpers for readability (0818c36)

Documentation

• more clarity for features.dPoP.allowReplay (779a141)

v9.0.1

Documentation

• mark experimental features more distinctly (986adc5)
• update references and styling of spec links (a4787b8)

Fixes

• DCR endpoints only include www-authenticate for non-registration related errors (9a864d6)

Refactor

• client schema defaults and static props (843943d)
• handle frame-ancestors in wmrm without a regexp (4f85585)
• push multiple elements to the recognized array in client_schema (d478a8b)
• simpler DCR validate registration access token (5f01eda)