You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: CHANGELOG.md
+11-11
Original file line number
Diff line number
Diff line change
@@ -12,14 +12,14 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
12
12
13
13
### Fixed
14
14
- In the Auth Code grant, when requesting an access token with an invalid auth code, we now respond with an invalid_grant error instead of invalid_request (PR #1433)
15
-
- Fixed spec compliance issue where device access token request was mistakenly expecting to receive scopes in the request (PR #1412)
15
+
- Fixed spec compliance issue where device access token request was mistakenly expecting to receive scopes in the request (PR #1412)
16
16
- Refresh tokens pre version 9 might have had user IDs set as ints which meant they were incorrectly rejected. We now cast these values to strings to allow old refresh tokens (PR #1436)
17
17
18
18
## [9.0.1] - released 2024-10-14
19
19
### Fixed
20
20
- Auto-generated event emitter is now persisted. Previously, a new emitter was generated every time (PR #1428)
21
21
- Fixed bug where you could not omit a redirect uri even if one had not been specified during the auth request (PR #1428)
22
-
- Fixed bug where "state" parameter wasn't present on `invalid_scope` error response and wasn't on fragment part of `access_denied` redirect URI on Implicit grant (PR #1298)
22
+
- Fixed bug where "state" parameter wasn't present on `invalid_scope` error response and wasn't on fragment part of `access_denied` redirect URI on Implicit grant (PR #1298)
23
23
- Fixed bug where disabling refresh token revocation via `revokeRefreshTokens(false)` unintentionally disables issuing new refresh token (PR #1449)
24
24
25
25
## [9.0.0] - released 2024-05-13
@@ -71,13 +71,13 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
71
71
72
72
## [8.5.3] - released 2023-07-06
73
73
### Security
74
-
- If a key string is provided to the CryptKey constructor with an invalid
75
-
passphrase, the LogicException message generated will expose the given key.
74
+
- If a key string is provided to the CryptKey constructor with an invalid
75
+
passphrase, the LogicException message generated will expose the given key.
76
76
The key is no longer leaked via this exception (PR #1353)
77
77
78
78
## [8.5.2] - released 2023-06-16
79
79
### Changed
80
-
- Bumped the versions for laminas/diactoros and psr/http-message to support
80
+
- Bumped the versions for laminas/diactoros and psr/http-message to support
81
81
PSR-7 v2.0 (PR #1339)
82
82
83
83
## [8.5.1] - released 2023-04-04
@@ -169,13 +169,13 @@ a PKCE downgrade attack (PR #1326)
169
169
- Removed support for PHP 7.2 (PR #1146)
170
170
171
171
### Fixed
172
-
- Fix typo in parameter hint. `code_challenged` changed to `code_challenge`. Thrown by Auth Code Grant when the code challenge does not match the regex. (PR #1130)
172
+
- Fix typo in parameter hint. `code_challenged` changed to `code_challenge`. Thrown by Auth Code Grant when the code challenge does not match the regex. (PR #1130)
173
173
- Undefined offset was returned when no client redirect URI was set. Now throw an invalidClient exception if no redirect URI is set against a client (PR #1140)
174
174
175
175
## [8.1.1] - released 2020-07-01
176
176
177
177
### Fixed
178
-
- If you provide a valid redirect_uri with the auth code grant and an invalid scope, the server will use the given
178
+
- If you provide a valid redirect_uri with the auth code grant and an invalid scope, the server will use the given
179
179
redirect_uri instead of the default client redirect uri (PR #1126)
180
180
181
181
## [8.1.0] - released 2020-04-29
@@ -195,9 +195,9 @@ redirect_uri instead of the default client redirect uri (PR #1126)
195
195
### Fixed
196
196
- Clients are now explicitly prevented from using the Client Credentials grant unless they are confidential to conform
197
197
with the OAuth2 spec (PR #1035)
198
-
- Abstract method `getIdentifier()` added to AccessTokenTrait. The trait cannot be used without the `getIdentifier()`
198
+
- Abstract method `getIdentifier()` added to AccessTokenTrait. The trait cannot be used without the `getIdentifier()`
199
199
method being defined (PR #1051)
200
-
- An exception is now thrown if a refresh token is accidentally sent in place of an authorization code when using the
200
+
- An exception is now thrown if a refresh token is accidentally sent in place of an authorization code when using the
201
201
Auth Code Grant (PR #1057)
202
202
- Can now send access token request without being forced to specify a redirect URI (PR #1096)
203
203
- In the BearerTokenValidator, if an implementation is using PDO, there is a possibility that a RuntimeException will be thrown when checking if an access token is revoked. This scenario no longer incorrectly issues an exception with a hint mentioning an issue with JSON decoding. (PR #1107)
@@ -251,7 +251,7 @@ Auth Code Grant (PR #1057)
251
251
## [7.3.0] - released 2018-11-13
252
252
253
253
### Changed
254
-
- Moved the `finalizeScopes()` call from `validateAuthorizationRequest` method to the `completeAuthorizationRequest` method so it is called just before the access token is issued (PR #923)
254
+
- Moved the `finalizeScopes()` call from `validateAuthorizationRequest` method to the `completeAuthorizationRequest` method so it is called just before the access token is issued (PR #923)
255
255
256
256
### Added
257
257
- Added a ScopeTrait to provide an implementation for jsonSerialize (PR #952)
@@ -353,7 +353,7 @@ To address feedback from the security release the following change has been made
353
353
## [5.1.4] - 2017-07-01
354
354
355
355
- Fixed multiple security vulnerabilities as a result of a security audit paid for by the [Mozilla Secure Open Source Fund](https://wiki.mozilla.org/MOSS/Secure_Open_Source). All users of this library are encouraged to update as soon as possible to this version or version 6.0 or greater.
356
-
- It is recommended on each `AuthorizationServer` instance you set the `setEncryptionKey()`. This will result in stronger encryption being used. If this method is not set messages will be sent to the defined error handling routines (using `error_log`). Please see the examples and documentation for examples.
356
+
- It is recommended on each `AuthorizationServer` instance you set the `setEncryptionKey()`. This will result in stronger encryption being used. If this method is not set messages will be sent to the defined error handling routines (using `error_log`). Please see the examples and documentation for examples.
357
357
- TravisCI now tests PHP 7.1 (Issue #671)
358
358
- Fix middleware example fatal error (Issue #682)
359
359
- Fix typo in the first README sentence (Issue #690)
0 commit comments