v6.4.2

Bug Fixes

• make structured token's end-user "sub" pairwise if configured (24a08c2)
• use correct postLogoutRedirectUri for resume's logout when mounted (a72b27d)

v6.4.1

Bug Fixes

• bring paseto token claims inline with jwt-ietf (265e400)

v6.4.0

Bug Fixes

• paseto formatted access token audience is a single string (1fd45f5)
• properly check if resourceIndicators is enabled (bbcdca2)

Features

• added a helper for validating provided resource indicator values (a97ffdc), closes #487
• allow audiences helper to return a single string audience (4c7a3a8)
• draft implementation of IETF JWT Access Token profile (e690462)

v6.3.0

Features

• new option for resolving JWT Access Token signing algorithm (28e85ef)

v6.2.2

Bug Fixes

• do not assign the defaulted to response_mode to params (18867ad)
• dynamic format gets a ctx as a first argument as documented (f62eb4b)

v6.2.1

Bug Fixes

• revert missing mTLS cert errors to invalid_grant (afac459)

Chores

• bump dependencies and compatible draft versions

v6.2.0

Features

• mTLS stable release candidate (a999452)

Notes

Mutual TLS related draft features and configuration was refactored to enable mTLS with various other deployment setups.

1. the SAN based tls_client_auth_* client properties are now supported
2. features.certificateBoundAccessTokens is now enabled via features.mTLS
3. self_signed_tls_client_auth is now enabled via features.mTLS but still whitelisted via *EndpointAuthMethods
4. tls_client_auth is now enabled via features.mTLS but still whitelisted via *EndpointAuthMethods
5. three helper methods now must be configured in the features.mTLS namespace - getCertificate to get the PEM certificate value, certificateAuthorized to determine if the client certificate is verified and comes from a trusted CA and certificateSubjectMatches for matching a registered client value with whats in the certificate.

v6.1.2

Bug Fixes

• acknowledging tls client auth draft fixed (02df82a)

v6.1.1

Bug Fixes

• bump acknowledgable draft versions that don't need code changes (55b4770)
• lodash dependency updated

v6.1.0

Bug Fixes

• authorization header scheme is checked case-insensitive (773ec52)
• block static client registration read action (edgiest of cases) (18db430)
• update dependencies, plug reported lodash vulnerability (a2cdfd0)

Features

• add experimental support for DPoP (61edb8c)