BREAKING CHANGE: openid-client v6.x is a complete rewrite of the openid-client module, this is the first time since 0.1.0 (8 years ago) that the API has drastically changed. The new module structure and API focuses on three core principles:
- runtime compatibility (adding support for Deno, Cloudflare Workers, Bun, and other Web API interoperable runtimes)
- tree-shakeability (bundles should not contain features that don't end up being used)
- less options (removing support for processing deprecated response types, cutting down on the number of combinations that need to handled)
To that end openid-client@6 no longer supports the full cartesian matrix of response types and response modes, it no longer supports issuing encrypted assertions, decrypting assertions is limited to only a few algorithms, it no longer supports Dynamic Client Registration or Management, and Self-Issued OpenID Provider responses are also not supported.
The new API makes basic setups simple while allowing some degree of complexity where needed.
openid-client@6 is an ESM module using ES2022 syntax and it depends on WebCryptoAPI and Fetch API globals being available in the JS runtime.
openid-client@6 is written in TypeScript and its exported types come with comment annotations.
(Node.js) Versions 20.x and newer have all the necessary globals.
(Node.js) CJS style `let client = require('openid-client')` is possible in versions where `process.features.require_module` is `true`. This is a new Node.js feature slated to be released without a CLI flag in 23.x and 22.x
This reverts commit 478cb2bc65, even
though it is the correct implementation some of the most widely used
identity providers don't follow the specification.
Because encodeURIComponent() encodes everything except alphanumericals
and `- _ . ! ~ * ' ( )` these need to be encoded explicitly similar to
how the resulting `%20' is replaced with '+'
This is as per RFC6749 Section 2.3.1 and Appendix B
This attempts to work around:
- missing Node.js APIs in Bun
- Bun's bugs in url.parse(..., true)
- Bun loading `jose`'s bun target instead of the require one
It is not possible to run openid-client's test suite due to other Bun
Node.js compatibility bugs which is why this is "experimental"
Refs #622
Refs #623
- token endpoint is a SHOULD in all definitions
- issuer identifier is the defacto identifier that should be accepted too
- specific endpoint location is not defined anywhere
BREAKING CHANGE: The 'query' way of passing access token to userinfo
was removed.
BREAKING CHANGE: Access Token is now asserted to be present for the
userinfo call.
BREAKING CHANGE: FAPIClient is renamed to FAPI1Client
BREAKING CHANGE: FAPI1Client has default algorithms set to PS256 rather
than RS256
BREAKING CHANGE: FAPI1Client has default tls_client_certificate_bound_access_tokens
set to true
BREAKING CHANGE: FAPI1Client has default response_types set to
`id_token code` and grant_types accordingly
BREAKING CHANGE: FAPI1Client has no token_endpoint_auth_method set,
one must be set explicitly
BREAKING CHANGE: HTTP(S) request customization now only recognizes the
following options 'agent', 'ca', 'cert', 'crl', 'headers', 'key',
'lookup', 'passphrase', 'pfx', and 'timeout'. These are standard node
http/https module request options, got-library specific options such
as 'followRedirect', 'retry', or 'throwHttpErrors' are no longer
recognized.
BREAKING CHANGE: The arguments inside individual HTTP request
customization changed, first argument is now an instance of
[URL](https://nodejs.org/api/url.html#class-url), the http request options object is passed in as a second
argument.
BREAKING CHANGE: The `response` property attached to some RPError or
OPError instances is now an instance of [http.IncomingMessage](https://nodejs.org/api/http.html#class-httpincomingmessage). Its
body is available on its `body` property as either JSON if it could be
parsed, or a Buffer if it failed to pass as JSON.
BREAKING CHANGE: Issuer.discover will no longer attempt to load
`/.well-known/oauth-authorization-server`. To load such discovery
documents pass full well-known URL to Issuer.discover.
Filip Skokan