Skip to content

Commit 860aa53

Browse files
kishore7snehilkishore7snehil
authored
Release 7.20.0 (#482)
* Release 7.20.0
1 parent fe07006 commit 860aa53

File tree

5 files changed

+65
-40
lines changed

5 files changed

+65
-40
lines changed

‎.version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
7.19.0
1+
7.20.0

‎CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
# Change Log
22

3+
## [7.20.0](https://github.com/auth0/laravel-auth0/tree/7.20.0) (2025-12-16)
4+
[Full Changelog](https://github.com/auth0/laravel-auth0/compare/7.19.0...7.20.0)
5+
6+
**Fixed**
7+
8+
- Security fix: Resolve CVE-2025-68129
9+
310
## [7.19.0](https://github.com/auth0/laravel-auth0/tree/7.19.0) (2025-10-01)
411

512
[Full Changelog](https://github.com/auth0/laravel-auth0/compare/7.18.0...7.19.0)

‎src/ServiceAbstract.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ abstract class ServiceAbstract extends InstanceEntityAbstract
2222
*
2323
* @var string
2424
*/
25-
public const VERSION = '7.19.0';
25+
public const VERSION = '7.20.0';
2626

2727
/**
2828
* Decode a PSR-7 HTTP Response Message containing a JSON content body to a PHP array. Returns null if the response was not successful, or the response body was not JSON.

‎tests/Unit/Middleware/AuthorizeMiddlewareTest.php‎

Lines changed: 28 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,28 @@
1313

1414
beforeEach(function (): void {
1515
$this->secret = uniqid();
16+
$this->domain = uniqid() . '.auth0.com';
17+
$this->clientId = uniqid();
18+
$this->audience = [uniqid()];
19+
$this->cookieSecret = uniqid();
1620

1721
config([
1822
'auth0.AUTH0_CONFIG_VERSION' => 2,
1923
'auth0.guards.default.strategy' => SdkConfiguration::STRATEGY_API,
20-
'auth0.guards.default.domain' => uniqid() . '.auth0.com',
21-
'auth0.guards.default.clientId' => uniqid(),
22-
'auth0.guards.default.audience' => [uniqid()],
24+
'auth0.guards.default.domain' => $this->domain,
25+
'auth0.guards.default.clientId' => $this->clientId,
26+
'auth0.guards.default.audience' => $this->audience,
2327
'auth0.guards.default.clientSecret' => $this->secret,
24-
'auth0.guards.default.cookieSecret' => uniqid(),
28+
'auth0.guards.default.cookieSecret' => $this->cookieSecret,
2529
'auth0.guards.default.tokenAlgorithm' => Token::ALGO_HS256,
30+
// Also configure 'web' since legacyGuard uses configuration => 'web'
31+
'auth0.guards.web.strategy' => SdkConfiguration::STRATEGY_API,
32+
'auth0.guards.web.domain' => $this->domain,
33+
'auth0.guards.web.clientId' => $this->clientId,
34+
'auth0.guards.web.audience' => $this->audience,
35+
'auth0.guards.web.clientSecret' => $this->secret,
36+
'auth0.guards.web.cookieSecret' => $this->cookieSecret,
37+
'auth0.guards.web.tokenAlgorithm' => Token::ALGO_HS256,
2638
]);
2739

2840
$this->laravel = app('auth0');
@@ -74,11 +86,10 @@
7486
$token = Generator::create($this->secret, Token::ALGO_HS256, [
7587
"iss" => 'https://' . config('auth0.guards.default.domain') . '/',
7688
"sub" => "auth0|123456",
77-
"aud" => [
78-
"https://example.com/health-api",
79-
"https://my-domain.auth0.com/userinfo",
80-
config('auth0.guards.default.clientId')
81-
],
89+
"aud" => array_merge(
90+
$this->audience,
91+
[config('auth0.guards.default.clientId')]
92+
),
8293
"azp" => config('auth0.guards.default.clientId'),
8394
"exp" => time() + 60,
8495
"iat" => time(),
@@ -103,11 +114,10 @@
103114
$token = Generator::create($this->secret, Token::ALGO_HS256, [
104115
"iss" => 'https://' . config('auth0.guards.default.domain') . '/',
105116
"sub" => "auth0|123456",
106-
"aud" => [
107-
"https://example.com/health-api",
108-
"https://my-domain.auth0.com/userinfo",
109-
config('auth0.guards.default.clientId')
110-
],
117+
"aud" => array_merge(
118+
$this->audience,
119+
[config('auth0.guards.default.clientId')]
120+
),
111121
"azp" => config('auth0.guards.default.clientId'),
112122
"exp" => time() + 60,
113123
"iat" => time(),
@@ -132,11 +142,10 @@
132142
$token = Generator::create($this->secret, Token::ALGO_HS256, [
133143
"iss" => 'https://' . config('auth0.guards.default.domain') . '/',
134144
"sub" => "auth0|123456",
135-
"aud" => [
136-
"https://example.com/health-api",
137-
"https://my-domain.auth0.com/userinfo",
138-
config('auth0.guards.default.clientId')
139-
],
145+
"aud" => array_merge(
146+
$this->audience,
147+
[config('auth0.guards.default.clientId')]
148+
),
140149
"azp" => config('auth0.guards.default.clientId'),
141150
"exp" => time() + 60,
142151
"iat" => time(),

‎tests/Unit/Middleware/AuthorizeOptionalMiddlewareTest.php‎

Lines changed: 28 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,28 @@
1313

1414
beforeEach(function (): void {
1515
$this->secret = uniqid();
16+
$this->domain = uniqid() . '.auth0.com';
17+
$this->clientId = uniqid();
18+
$this->audience = [uniqid()];
19+
$this->cookieSecret = uniqid();
1620

1721
config([
1822
'auth0.AUTH0_CONFIG_VERSION' => 2,
1923
'auth0.guards.default.strategy' => SdkConfiguration::STRATEGY_API,
20-
'auth0.guards.default.domain' => uniqid() . '.auth0.com',
21-
'auth0.guards.default.clientId' => uniqid(),
22-
'auth0.guards.default.audience' => [uniqid()],
24+
'auth0.guards.default.domain' => $this->domain,
25+
'auth0.guards.default.clientId' => $this->clientId,
26+
'auth0.guards.default.audience' => $this->audience,
2327
'auth0.guards.default.clientSecret' => $this->secret,
24-
'auth0.guards.default.cookieSecret' => uniqid(),
28+
'auth0.guards.default.cookieSecret' => $this->cookieSecret,
2529
'auth0.guards.default.tokenAlgorithm' => Token::ALGO_HS256,
30+
// Also configure 'web' since legacyGuard uses configuration => 'web'
31+
'auth0.guards.web.strategy' => SdkConfiguration::STRATEGY_API,
32+
'auth0.guards.web.domain' => $this->domain,
33+
'auth0.guards.web.clientId' => $this->clientId,
34+
'auth0.guards.web.audience' => $this->audience,
35+
'auth0.guards.web.clientSecret' => $this->secret,
36+
'auth0.guards.web.cookieSecret' => $this->cookieSecret,
37+
'auth0.guards.web.tokenAlgorithm' => Token::ALGO_HS256,
2638
]);
2739

2840
$this->laravel = app('auth0');
@@ -55,11 +67,10 @@
5567
$token = Generator::create($this->secret, Token::ALGO_HS256, [
5668
"iss" => 'https://' . config('auth0.guards.default.domain') . '/',
5769
"sub" => "auth0|123456",
58-
"aud" => [
59-
"https://example.com/health-api",
60-
"https://my-domain.auth0.com/userinfo",
61-
config('auth0.guards.default.clientId')
62-
],
70+
"aud" => array_merge(
71+
$this->audience,
72+
[config('auth0.guards.default.clientId')]
73+
),
6374
"azp" => config('auth0.guards.default.clientId'),
6475
"exp" => time() + 60,
6576
"iat" => time(),
@@ -84,11 +95,10 @@
8495
$token = Generator::create($this->secret, Token::ALGO_HS256, [
8596
"iss" => 'https://' . config('auth0.guards.default.domain') . '/',
8697
"sub" => "auth0|123456",
87-
"aud" => [
88-
"https://example.com/health-api",
89-
"https://my-domain.auth0.com/userinfo",
90-
config('auth0.guards.default.clientId')
91-
],
98+
"aud" => array_merge(
99+
$this->audience,
100+
[config('auth0.guards.default.clientId')]
101+
),
92102
"azp" => config('auth0.guards.default.clientId'),
93103
"exp" => time() + 60,
94104
"iat" => time(),
@@ -113,11 +123,10 @@
113123
$token = Generator::create($this->secret, Token::ALGO_HS256, [
114124
"iss" => 'https://' . config('auth0.guards.default.domain') . '/',
115125
"sub" => "auth0|123456",
116-
"aud" => [
117-
"https://example.com/health-api",
118-
"https://my-domain.auth0.com/userinfo",
119-
config('auth0.guards.default.clientId')
120-
],
126+
"aud" => array_merge(
127+
$this->audience,
128+
[config('auth0.guards.default.clientId')]
129+
),
121130
"azp" => config('auth0.guards.default.clientId'),
122131
"exp" => time() + 60,
123132
"iat" => time(),

0 commit comments

Comments
 (0)