Filip Skokan
53927452eb
BREAKING CHANGE: openid-client v6.x is a complete rewrite of the openid-client module, this is the first time since 0.1.0 (8 years ago) that the API has drastically changed. The new module structure and API focuses on three core principles:
- runtime compatibility (adding support for Deno, Cloudflare Workers, Bun, and other Web API interoperable runtimes)
- tree-shakeability (bundles should not contain features that don't end up being used)
- less options (removing support for processing deprecated response types, cutting down on the number of combinations that need to handled)
To that end openid-client@6 no longer supports the full cartesian matrix of response types and response modes, it no longer supports issuing encrypted assertions, decrypting assertions is limited to only a few algorithms, it no longer supports Dynamic Client Registration or Management, and Self-Issued OpenID Provider responses are also not supported.
The new API makes basic setups simple while allowing some degree of complexity where needed.
openid-client@6 is an ESM module using ES2022 syntax and it depends on WebCryptoAPI and Fetch API globals being available in the JS runtime.
openid-client@6 is written in TypeScript and its exported types come with comment annotations.
(Node.js) Versions 20.x and newer have all the necessary globals.
(Node.js) CJS style `let client = require('openid-client')` is possible in versions where `process.features.require_module` is `true`. This is a new Node.js feature slated to be released without a CLI flag in 23.x and 22.x
1.1 KiB
Variable: skipStateCheck
Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by becoming a sponsor.
• const skipStateCheck: typeof oauth.skipStateCheck = oauth.skipStateCheck
DANGER ZONE - This option has security implications that must be understood, assessed for applicability, and accepted before use.
Use this as a value for state check state parameter options to skip the
state value check. This should only be done if the state parameter value
used is integrity protected (and its integrity and expiration is checked) and
bound to the browsing session. One such mechanism to do so is described in an
I-D
draft-bradley-oauth-jwt-encoded-state-09.
Deprecated
Marked as deprecated only to make it stand out as something you shouldn't use unless you've assessed the implications.