v4.0.0

Breaking changes

oidc-browser

Note that these changes are unlikely to impact a client application.

• Replaced @inrupt/oidc-client dependency with oidc-client-ts (^3.5.0), the actively maintained TypeScript successor.
• Removed re-exports: Version, CordovaPopupNavigator, CordovaIFrameNavigator (no longer available upstream).
• Changed SigninRequest and OidcClientSettings to type-only exports.

node

• A new signature was introduced for getSessionFromStorage in release 2.3.0. The legacy signature is
  deprecated, and will be removed with the 4.0.0 major release. Using the more recent API to manage Sessions
  based on the associated tokens should be preferred, as it allows to not rely on in-memory scale, making it
  easier to scale horizontally. Prefer using session.events.on(EVENTS.NEW_TOKENS, ...) to get the tokens, and
  Session.fromTokens to build the Session object.

// Deprecated signature
const session = await getSessionFromStorage(
  sessionId,
  storage,
  onNewRefreshToken,
  refresh,
);
// Replacement signature
const session = await getSessionFromStorage(sessionId, {
  storage,
  onNewRefreshToken,
  refresh,
});

• The event EVENTS.NEW_REFRESH_TOKEN is being replaced by EVENTS.NEW_TOKENS which returns all the tokens a client
  can store for refreshing a session.

Bugfix

core

• Fix issue using the library with Bun by adding missing extractable flag to the DPoP keys so that they can be serialized on the
  appropriate events. Thanks to @NoelDeMartin for fixing this issue.

node

• Sessions built from Session.fromTokens now have a correct expiration time triggering refresh in the fetch. Thanks to @NoelDeMartin for fixing this issue.

browser

• Fixed an issue where handleIncomingRedirect({ restorePreviousSession: true }) would redirect to the OAuth provider with expired client credentials, causing users to be stuck on an error page. The library now validates client expiration before attempting silent authentication and gracefully falls back to a logged-out state when the client has expired. Thanks to @timgent for the contribution.

What's Changed

Full Changelog: v3.1.1...v4.0.0

v3.1.1

Bugfix

node

• The refreshTokens function no longer overrides the token type to default to DPoP, and keeps the token type consistent:
  the resulting SessionTokenSet will be DPoP-bound or not depending on the input SessionTokenSet

Full Changelog: v3.1.0...v3.1.1

v3.1.0

New feature

browser and node

• Session::login now supports an additional customScopes: string[] option.
  It allows developers to specify custom scopes to be added to the authorization request,
  which will be presented to the user by their OpenID Provider on the consent
  prompt. If they consent, the issued ID Token may include additional claims based
  on the requested scopes.

Full Changelog: v3.0.0...v3.1.0

v3.0.0

Breaking Changes

• Support for Node.js v18.x has been dropped as that version has reached end-of-life.

Bugfix

browser and node

• Fixes #3927: Fixed the usage of client information from previous dynamic registration that have no expiration date.

New Contributors

• @koca2000 made their first contribution in #3974

Full Changelog: v2.5.0...v3.0.0

v2.5.0

Feature

node

• Added a logout function in the token management API that enables RP-initiated logout for multi-user server-side applications. This complements the refreshTokens function introduced in 2.4.0, allowing applications that manage tokens in external storage to both refresh tokens and perform identity provider logout without requiring a Session object. Applications can now implement complete user authentication lifecycle management using token sets stored in their own database.
• Added a EVENTS.AUTHORIZATION_REQUEST (authorizationRequest) event that emits authentication state during login to support clustered deployments.
• Added a static Session.fromAuthorizationRequestState() method that creates a new session from previously stored authentication state.

Full Changelog: v2.4.1...v2.5.0

v2.4.1

Bugfix

node

• refreshTokens had a bug causing an unexpected refresh token rotation if the ID token expired,
  resulting in the stored token being stale.

Full Changelog: v2.4.0...v2.4.1

v2.4.0

New Features

node

• Added a EVENTS.NEW_TOKENS (newTokens) event to be emitted by the Session when it receives new tokens when a session is initially
  logged in or refreshed. This event is more useful than EVENTS.NEW_REFRESH_TOKEN which is being deprecated.
• Added a static Session.fromTokens(tokens, sessionId) method that creates a new authenticated session directly from a token set, without requiring a full login flow.
• Added a new function refreshTokens to refresh tokens obtained via the newTokens event after the Access Token expired.

Bugfix

browser and node

• Fix the Session error listener typing by adding Error to the errorDescription type so that it reflects the actual behavior.
  Thanks to @NoelDeMartin for fixing this issue.
• Previously, an application could end up in a bad state when using a dynamically registered
  client identity beyond its expiration date. A user would be redirected to the OpenID Provider,
  and end up on an error page unrelated to the application they were trying to log into. Now,
  expired dynamic clients go through registration again: the user will need to authorize the client
  after expiration, but will not experience further inconveniences.

What's Changed

Full Changelog: v2.3.0...v2.4.0

v2.3.0

Deprecation notice

• A new signature is introduced for getSessionFromStorage in this release. The legacy signature is
  deprecated, and could be removed with the next major release.

// Deprecated signature
const session = await getSessionFromStorage(
  sessionId,
  storage,
  onNewRefreshToken,
  refresh,
);
// Replacement signature
const session = await getSessionFromStorage(sessionId, {
  storage,
  onNewRefreshToken,
  refresh,
});

Bugfix

node

• The session expiration date (session.info.expirationDate) is now correct when loading a Session from storage.

Feature

node

• It is now possible to build a Session using getSessionFromStorage and not log it in
  using its refresh token. To do so, a new refresh optional flag has been introduced.
  It defaults to true, which makes this a non-breaking change. In addition, a new signature
  is introduced to make it easier to provide the optional arguments:

// Legacy signature only specifying one optional argument
const session = await getSessionFromStorage(
  sessionId,
  undefined,
  undefined,
  false,
);

// New signature
const session = await getSessionFromStorage(sessionId, { refresh: false });

Full Changelog: v2.2.7...v2.3.0

v2.2.7

Bugfix

node

• The IdP logout no longer fails in Node if the session was restored from
  storage (using getSessionFromStorage), which is the typical way server-side
  sessions are retrieved.

Full Changelog: v2.2.6...v2.2.7

v2.2.6

node and browser

• Repository URL in package.json updated to set the repository.type property to git. This intends at
  restoring the previous behavior of npm view @inrupt/solid-client-authn repository.url, expected to return
  git+https://github.com/inrupt/solid-client-authn-js.git.

Full Changelog: v2.2.5...v2.2.6