v2.0.4

Refactor

• weak maps instead of symbols (e551edc)

v2.0.3

Fixes

• omit zealous response cloning() to reduce edge compute memory bills (a785223), closes #37

v2.0.1

Fixes

• claims parameter encoding in issued request objects (3eb165a)

Performance

• cache public DPoP CryptoKey's JWK representation for re-use (2858d06)

v2.0.0

⚠ BREAKING CHANGES

• Use the TLS server validation in processAuthorizationCodeOpenIDResponse to validate the issuer instead of checking the ID Token's signature. The function's options argument was removed.
• Use the TLS server validation in processDeviceCodeResponse to validate the issuer instead of checking the optional ID Token's signature. The function's options argument was removed.
• Use the TLS server validation in processIntrospectionResponse to validate the issuer instead of checking the optional JWT Introspection Response signature. The function's options argument was removed.
• Use the TLS server validation in processRefreshTokenResponse to validate the issuer instead of checking the optional ID Token's signature. The function's options argument was removed.
• Use the TLS server validation in processUserInfoResponse to validate the issuer instead of checking the optional JWT UserInfo Response signature. The function's options argument was removed.
• PAR w/ DPoP no longer automatically adds dpop_jkt to the authorization request.
• Removed calculateJwkThumbprint function export.
• Removed jwksRequest function export.
• Removed processJwksResponse function export.

Refactor

• remove ignored and unused exports (4a545df)
• use TLS server validation instead of jwt signature validations (f728110)

v1.4.1

Refactor

• deno: add mod.ts to deno.land/x (0778278)
• use RsaHashedKeyAlgorithm in checkRsaKeyAlgorithm (94aa31c)

v1.4.0

Features

• add bun as a supported runtime (707efd1)

v1.3.0

Features

• allow to skip JWT signature validation on select responses (44d9114)

v1.2.2

Refactor

• add a type check on AbortSignal (b013fef)
• align argument and function names in assert functions (8ea65f6)
• update "as" error messages (3e894f5)

v1.2.1

This release

• moves the package on npm from @panva/oauth4webapi to just oauth4webapi
• moves the package on deno.land/x from doauth to oauth4webapi

Otherwise this release contains only code refactoring and documentation updates.

---

NB: @panva/oauth4webapi had last npm version released and it now simply re-exports oauth4webapi to allow existing consumers to obtain updates within the ^1.2.1 semver range.

v1.2.0

Features

• add experimental EdDSA (Ed25519) JWS algorithm support (f70d4d5)