Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

v0.6.0 (2026-07-17)

BREAKING: replaced hackney with a minimal Mint-based HTTP client (Ueberauth.Strategy.Cognito.HttpClient). The library no longer depends on hackney, so it can't conflict with whatever HTTP client your app uses; if you relied on this library pulling hackney in transitively, add it to your own deps.
BREAKING: the minimum supported Elixir version is now 1.15 (required by Mint).
If you inject a custom http_client for testing, note that request/2,4 must now return the response body directly as {:ok, status, headers, body}; body/1 is no longer called. The contract is defined as a behaviour on Ueberauth.Strategy.Cognito.HttpClient.
The bundled client enforces an overall request deadline (30 seconds by default, configurable with config :ueberauth_cognito, request_timeout: ms).
Failed token/JWKS requests now report the cause (HTTP status, transport error, or invalid JSON) in the Ueberauth error message instead of a generic "Non-200 error code from AWS".

This is the first release from wkirschbaum/ueberauth_cognito, which is now the maintained home of this package (previously mbta/ueberauth_cognito).

Added per provider configuration, which allows multiple Cognito providers to be set for different user pools.
Added support for passing login_hint and identity_provider request params through to the Cognito authorize URL.
Improved error handling: OAuth error callbacks from Cognito (error/error_description params) are now surfaced as Ueberauth errors instead of a generic missing-code error; callbacks without the optional error_description param are reported under their error code instead of no_code.
Fixed the id token expiry check treating a missing exp claim as valid.
The JWT verifier now only accepts tokens with token_use: "id", since it only ever verifies id tokens.
Fixed a crash when AWS responds with HTTP 200 but a non-JSON body; this is now reported as an aws_response error.
Missing required configuration (auth_domain, client_id, etc.) now raises a helpful ArgumentError instead of failing later with a confusing error.
Atom configuration values (e.g. uid_field: :sub) are now accepted and converted to strings; other unsupported value types raise a helpful error that names the key without logging the value.
Fixed a Mix.Config deprecation warning.
CI now tests against all supported Elixir/OTP versions.

BREAKING: remove option to handle refresh tokens by passing as an argument to the callback URL. This approach involved transmitting the refresh token to the browser and as such was in violation of the OAuth 2.0 RFC.

BREAKING: minimum Elixir version is now 1.7
Added per app configuration based on the otp_app
Support some optional parameters for Cognito /authorize
Modified to return info/1 with the information of User in Ueberauth.Auth.Info

Thank you to @mdillavou and @yagince for their contributions to this release!