- New: Official support for 1 new providers:
authentik
- New: Official support for Openstreetmap OAuth 2.0 apps:
openstreetmap2
quirks
- New: Official support for 2 new providers:
osu
,workos
- Change: Updated 2 providers:
autodesk
,withings
- Change: Removed 2 discontinued providers:
flattr
,flowdock
- New: Official support for 2 new providers:
authing
,tiktok
- New: Official support for Twitter OAuth 1.0a
x_auth_access_type
custom scope parameter: quirks
- New: Official support for Twitter OAuth 2.0 apps:
twitter2
quirks - Change: Updated 1 provider:
google
id_tokeniss: accounts.google.com -> https://accounts.google.com
- New: Official support for 1 new provider:
surveysparrow
- Fix: Vercel handler cookie handling
- New: Official support for 2 new providers:
crossid
,untappd
- New: Official support for 2 new providers:
trustpilot
,unbounce
- Change: Updated 1 provider:
yandex
- New: Official support for 2 new providers:
adobe
,procore
- Change: Updated 1 provider:
linkedin
- New: Official support for 2 new providers:
notion
,sellsy
- Change: Return user profile for
apple
- Change: Updated 1 provider:
withings
- Fix: Type definitions for TypeScript
- Fix: Type definitions for TypeScript
- Fix: Better support for JavaScript bundlers
- Change: Updated 1 provider:
wechat
- New: Official support for 3 new providers:
huddle
,netlify
,snowflake
- Change: Removed 1 discontinued provider:
mixer
- Change: Renamed provider
surveygizmo
toalchemer
- Change: Updated 4 providers:
discord
,ibm
,okta
,twitch
- Fix: Error on missing
state
andnonce
- Fix: Type definitions for TypeScript
- Fix: Type definitions for TypeScript
- Fix: Type definitions for TypeScript
- New: Type definitions for TypeScript
- New: Official support for 1 new provider:
keycloak
- Fix: Allow for more clock skew for the
iat
andnbf
claims when usingprivate_key_jwt
authentication for the token endpoint - New: HTTP Framework handler for Curveball
- New: Official support for 2 new providers:
figma
,mendeley
- New: Support for
response_mode: form_post
- Fix: Path matching for
gcloud
handler - docs
- Fix: Path matching for
aws
handler - docs
- Fix: Improved path mathching for
aws
handler + support for event format v2 - New: Official support for 2 new providers:
autodesk
,storyblok
- Change: Renamed provider
zeit
tovercel
- New: HTTP Framework handler for Fastify
- New: Serverless handlers for AWS Lambda, Azure Function, Google Cloud Function and Vercel
- New: RSA-SHA1 signature method support for OAuth1.0a
- Fix: OAuth2 support for
intuit
- Fix: Profile endpoints for
qq
andweibo
- New: Support for request options
- New: Official support for 2 new providers:
apple
,garmin
- Fix: The upcoming Grant constructor
- New: Support for
private_key_jwt
client authentication - New:
grant-profile
was deprecated as standalone module and is now embedded into Grant - New: Increase the random
state
andnonce
size - New: Official support for 4 new providers:
cas
,cognito
,fusionauth
,logingov
- Fix: Fixed the path matching regexp for Express and Koa
- Breaking: Drop support for Node v4 and v6
- Breaking: Return
id_token
as string by default - Breaking: Change in the
response
configuration - New:
origin
andprefix
configuration - Deprecate: Koa v1 and Hapi <= v16
- Deprecate:
protocol
,host
, andpath
configuration - Migration Guide: from v4 to v5
- New: PKCE support
- New: input state overrides
- New: output state transport
- New: user-agent header is set on all internal requests
- Fix: Regression about race condition for slow session stores in Express middleware
- New: Official support for 2 new providers:
livechat
andzeit
- Fix: Support for
instagram
Graph API
- New: Official support for 2 new providers:
line
andnaver
- Fix: Updated 4 providers:
clio
,concur
,familysearch
andfitbit
- New: Official support for 3 new providers:
atlassian
,aweber
,phantauth
- Change: Removed 6 discontinued providers:
dailymile
,everyplay
,fluidsurveys
,moves
,mydigipass
,producteev
- Change: Renamed
letsfreckle
tonokotime
- New: Official support for 3 new providers:
mailxpert
,snapchat
andzoom
- Fix: Support for
cookie-session
in Express middleware
- Fix: Race condition for slow session stores in Express middleware
- New:
koa-mount
no longer required for the Koa middleware
- Fix: Support for @hapi/hapi namespace
- Fix: Support for Hapi >= 18
- New: Added
token_endpoint_auth_method
option - New: Official support for 1 new provider:
wechat
- Fix: Accept array of
aud
claims when validating anid_token
- New: Official support for 1 new provider:
qq
- New: Added
response
option for limiting the response data
- Fix: Nested static overrides filtering
- New: Explicit
overrides
option for defining static overrides - New: Official support for 2 new providers:
ibm
,mention
- New: Official support for 2 new providers:
freelancer
,hootsuite
- Change: Removed 1 discontinued provider:
jawbone
- Fix: Regression regarding missing session in the callback route
- New: OpenID Connect
id_token
andnonce
support - New: The
server
configuration option is now calleddefaults
(server
is still allowed) - New: Explicit
dynamic
option to control the Dynamic Override feature - Change: The Dynamic Override is now disabled by default! In case you rely on it you have to enable it explicitly. Use the more granular configuration or the proxy one
- New: Official support for 2 new providers:
mastodon
,onelogin
- Change: Updated 4 providers:
bitbucket
,strava
,twitch
,yahoo
- New: Official support for 4 new providers:
arcgis
,nest
,okta
,typeform
- Change: Updated 2 providers:
dropbox
,withings
- New: Official support for 6 new providers:
auth0
,bettlenet
,mixer
,nylas
,timelyapp
,viadeo
- Change: Removed 5 discontinued providers:
appnet
,codeplex
,elance
,odesk
,rdio
- New: Support for Hapi >= 17
- Fix: Minor fix in
request-compose
- Change: Officially Node >= 4.0.0 required!
- Change: Dropped the
request
dependency in favor ofrequest-compose
- Change: Return errors more consistently based on the
transport
used (see below) - Change: The internal session variable
step1
was renamed torequest
- Change: The internal
_config
property is no longer exposed
app.use(new Grant({server: {transport: 'session'}}))
app.get('/final_callback', (req, res) => {
if (req.query.error) {} // v3.x
if (req.session.grant.response.error) {} // v4.x
})
- Change: Migrate all OAuth endpoints to HTTPS
- New: Official support for 2 new providers:
authentiq
andpatreon
- Change: Hapi is now using the internal
config
object directly through the middleware instance - Fix: Dynamic overrides support for Hapi >= 12.x
- New: Hapi middleware configuration can be passed in the constructor
- New: First class support for Koa >= 2.x using
async
/await
Node >= 8.0.0 required!- Koa 1.x and 0.x are still supported for Node 4, 6 and 8
- Change: Removed 2 discontinued providers:
beatsmusic
andcopy
- New: Official support for 5 new providers:
ebay
,genius
,jamendo
,pinterest
andunsplash
- New: Official support for 2 new providers:
discord
andmedium
- Change: Dropped node
0.10
and0.12
as built targets in TravisCI - Change: Added the advisory engines key in package.json for node
>=4.0.0
- New: Official support for 6 new providers:
baidu
,docusign
,iconfinder
,idme
,mydigipass
,venmo
- Fix: Added the required
user-agent
header fordiscogs
- New: Official support for 1 new provider:
homeaway
- New: Support for Koa 2.x
- Fix: Expect oauth version to be string when passed as querystring
- New: Official support for 1 new provider:
lyft
- New: Added
scope_data
custom parameter foramazon
- New: Official support for 2 new providers:
idonthis
,smugmug
- New: Path Prefix configuration option
- New: Official support for 2 new providers:
microsoft
,visualstudio
- Fix: Fix for
[email protected]
- New: Official support for 2 new providers:
gitbook
,optimizely
- New: Official support for 11 new providers
- New: Official support for 8 new providers
- New: OAuth2 support for
fitbit2
- New: Official support for 6 new providers
- New: Docs about the Alternative Require
- New: Official support for 6 new providers
- Change: Improved OAuth2 random state string
- New: Ability to override the redirect_uri
- New: Ability to configure Grant without having a
server
configuration key - New: Generic error handler for missing or misconfigured provider
- New: Introduced
custom_params
option for safer way to configure Custom Authorization Parameters - New: Improved documentation about all configuration Quirks
- New: Official support for 5 new providers
- Change: Improved configuration initialization
- Change: Migrated
rdio
to OAuth2 - Change: Updated
trakt
OAuth URLs - New: Added
device_id
anddevice_name
custom authorization parameters foryandex
- New: Docs about the Programmatic Access
- New: Official support for 3 new providers
- New: Official support for 9 new providers
- New: Official support for 2 new providers
- New: Official support for 10 new providers
- Change: The Express middleware is no longer using the express-session middleware internally
- Change: The Express and Koa middlewares are no longer using their body-parser middleware internally
- Change: Express is set as
peerDependency
ingrant-express
- Change: Koa is set as
peerDependency
ingrant-koa
- Change: Yar is no longer set as
peerDependency
ingrant-hapi
, though using session is still required
- Change: Any of the reserved keys can be overriden for a provider
- Change: Allow Custom Provider configuration
- New:
transport
option that allows the response data to be returned in the final callback either as querystring or in the session - New:
state: true
option that enables auto generated random state string on each authorization attempt (OAuth2 only)
- Change: Allow any session store to be used with the Koa middleware
- Change: Using
koa-route
instead ofkoa-router
internally in the Koa middleware - Change:
grant-hapi
now usespeerDependencies
- Fix: Removed default Express require left over in index.js
- Fix: Examples
- Change: Each consumer middleware now have its own module:
grant-express
,grant-koa
andgrant-hapi
- New: Hapi middleware
- New: Docs about Dynamic Overrides via
GET
request - New: A bunch of Examples
- Change: Complete rewrite of the module using request
- New: Koa middleware
- Change: The Response Data now contains a
raw
key in it - Change: Custom Authorization Parameters regarding token expiration are no longer part of the scope array
- Version
1.x
is no longer supported, though most of the configuration data structure remains intact, so migration should be easy
- Initial Release