View Source Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning according to OAuth / OpenID connect specifications, changes may break in order to comply with those.
2-2-1-2022-10-16
[2.2.1] - 2022-10-16
security
Security
- remove symetric keys from openid jwks
2-2-0-2022-09-13
[2.2.0] - 2022-09-13
- Note that you must run the
boruta.gen.migration
task to keep your database schema up to date while upgrading to this version. - Upgrade to this version need you to invalidate the cache by running
Boruta.Config.cache_backend().delete_all()
added
Added
- confidential client management as stated in OAuth 2.0 RFC, documented here. It defaults to false (already existing clients will not be confidential)
- token as the created
Boruta.Oauth.Token
attribute inBoruta.Oauth.TokenResponse
changed
Changed
- client credentials does not check client secret by default anymore, the client has to be set as confidential to do so
security-1
Security
- Enable refresh token rotation, revoke previous refresh token on successful refresh token requests
- fix redirect_uri injection in implicit, hybrid and code grants
2-1-5-2022-06-15
[2.1.5] - 2022-06-15
added-1
Added
- id tokens include
kid
header with the corresponding client id Boruta.Oauth.ResourceOwner
extra_claims
attribute that defines claims to be included in id tokens
security-2
Security
- do not not issue an access token in authorization code and hybrid grants if code was issued to an other client
fixed
Fixed
- id token
at_hash
andc_hash
binary sizes for SHA256 and SHA384 signature hash algorithms
2-1-4-2022-06-07
[2.1.4] - 2022-06-07
Note that you must run the boruta.gen.migration
task to keep your database schema up to date while upgrading to this version.
added-2
Added
- handle
response_mode
in hybrid requests - client id_token validation for ecto adapter
- per client id token signature algorithm configuration (introduce a database schema change)
changed-1
Changed
- prefer
invalid_grant
toinvalid_code
andinvalid_refresh_token
- error messages have been improved
2-1-3-2022-05-17
[2.1.3] - 2022-05-17
added-3
Added
- handle
response_mode
in hybrid requests errors
fixed-1
Fixed
- respond to authorize requests with
token_type
only when an access token is returned - generated migrations can be rollbacked
- clients pkey constraint do not crash on admin create
2-1-2-2022-05-02
[2.1.2] - 2022-05-02
fixed-2
Fixed
- hybrid requests shall return all errors as fragment
2-1-1-2022-04-30
[2.1.1] - 2022-04-30
fixed-3
Fixed
- dialyzer warning on
Boruta.Oauth.Error
struct type
2-1-0-2022-04-29
[2.1.0] - 2022-04-29
added-4
Added
- OpenID Connect jwks endpoint domain and application layer generation
- OpenID Connect userinfo endpoint domain and application layer generation
fixed-4
Fixed
- OpenID Connect prompt=none login_required errors in domain
2-0-1-2022-04-12
[2.0.1] - 2022-04-12
added-5
Added
- expose
Boruta.Oauth.Client.grant_types/0
- expose
Boruta.Oauth.IdToken.signature_alg/0
andBoruta.Oauth.IdToken.hash_alg/0
changed-2
Changed
Admin.delete_inactive_tokens/0,1
does not return deleted tokens
fixed-5
Fixed
- generated openid authorize controller prompt=none error params type
2-0-0-2022-01-26
[2.0.0] - 2022-01-26
added-6
Added
Boruta.Ecto.Admin.get_scopes_by_names/1
Boruta.Ecto.Admin.regenerate_client_secret/1,2
Boruta.Ecto.Admin.delete_inactive_tokens/0,1
Boruta.Ecto.Client.grant_types/0
- ability to insert/update clients with given id/secret
- inserting/updating a client inserts non existing authorized_scopes
oauth_module
injection inboruta.gen.controllers
generated controllers defalut toBoruta.Oauth
changed-3
Changed
- store previous token while refreshing access tokens (need to run
boruta.gen.migration
mix task to be up to date) Boruta.Ecto.Admin.list_active_tokens/0,1
returns query result instead of anEcto.Query
Boruta.Oauth.ResourceOwners.claims/2
callback takes aBoruta.Oauth.ResourceOwner
struct instead ofsub
as parameter
2-0-0-rc-1-2021-11-17
[2.0.0-rc.1] - 2021-11-17
fixed-6
Fixed
- better Ecto errors management
- remove padding from pkce code challenge checks
- reduce resource_owners adapter calls
added-7
Added
- domain wildcard for client redirect_uris
removed
Removed
- Ecto
ClientsAdapter.get_by(id: id, secret: secret)
is removed in preference ofClientsAdapter.get_client(id)
andOauth.Client.check_secret(client, secret)
. - Ecto
ClientsAdapter.get_by(id: id, redirect_uri: redirect_uri)
is removed in preference ofClientsAdapter.get_client(id)
andOauth.Client.check_redirect_uri(client, redirect_uri)
.
2-0-0-rc-0-2021-10-12
[2.0.0-rc.0] 2021-10-12
added-8
Added
- OpenID Connect core 1.0 integration
- hybrid flow
- authorization code and implicit grants with OpenID Connect compatibility
public_revoke
per client configuration allowing to revoke tokens without providing client secret.introspect
andrevoke
supported grant types per client configuration.
changed-4
Changed
Boruta.Oauth.AuthorizeResponse
andBoruta.Oauth.TokenResponse
do not provide token value invalue
field but prefer giving value by token typecode
,access_token
orid_token
.
becomes%AuthorizeResponse{ type: "code", value: value, expires_in: 60 }
%AuthorizeResponse{ type: :code, code: value, expires_in: 60 }
- add nonce column to tokens
- default column values migrations
- migration management
boruta.gen.migrations
does incremental changes
security-3
Security
- codes are revoked after first usage
fixed-7
Fixed
boruta.gen.controllers
generated paths in umbrella apps
1-2-1-2021-10-10
[1.2.1] - 2021-10-10
security-4
Security
- remove redirect_uris regex pattern check
1-2-0-2021-09-15
[1.2.0] - 2021-09-15
added-9
Added
public_refresh_token
per client configuration allowing to refresh tokens without providing client secret.refresh_token_ttl
per client configuration setting refresh tokens duration (along withrefresh_tokne_max_ttl
:boruta mix configuration).issuer
:boruta mix configuration.
fixed-8
Fixed
boruta.gen.controllers
generated paths in umbrella apps.- Refreshed tokens has associated access_token scope as default.
- Requests with no client secret won't raise an error.
changed-5
Changed
invalid_client
do not return neither format, nor redirect_uri inBoruta.Oauth.Error
.
1-1-0-2021-08-16
[1.1.0] - 2021-08-16
added-10
Added
AuthorizeApplication
,IntrospectApplication
,RevokeApplication
, andTokenApplication
behaviours allowing to implement separatly different OAuth use cases.list_active_tokens
Ecto admin functionBoruta.AccessTokensAdapter
,Boruta.CodesAdapter
,Boruta.ClientsAdapter
, andBoruta.ScopesAdapter
encapsulating adapters that are set in configuration.Boruta.Oauth.AuthorizeResponse.redirect_to_url/1
functionBoruta.Oauth.Error.redirect_to_url/1
functionboruta.gen.controllers
mix taskBoruta.Ecto
schemas documentation
security-5
Security
- do not issue access_tokens from other clients refresh tokens
fixed-9
Fixed
- Internal server errors when no client_id provided to token and refresh_token grants
1-0-3-2021-07-29
[1.0.3] - 2021-07-29
security-6
Security
- Refresh token revocation
1-0-2-2021-06-29
[1.0.2] - 2021-06-29
added-11
Added
- Differents OAuth flows integration guides
1-0-1-2021-03-10
[1.0.1] - 2021-03-10
fixed-10
Fixed
- Migration fix generated by
mix boruta.gen.migration
task
added-12
Added
- Documentation