- Fix: Type definitions for TypeScript
- Fix: Better support for JavaScript bundlers
- Change: Updated 1 provider:
wechat
- New: Official support for 3 new providers:
huddle,netlify,snowflake - Change: Removed 1 discontinued provider:
mixer - Change: Renamed provider
surveygizmotoalchemer - Change: Updated 4 providers:
discord,ibm,okta,twitch - Fix: Error on missing
stateandnonce
- Fix: Type definitions for TypeScript
- Fix: Type definitions for TypeScript
- Fix: Type definitions for TypeScript
- New: Type definitions for TypeScript
- New: Official support for 1 new provider:
keycloak
- Fix: Allow for more clock skew for the
iatandnbfclaims when usingprivate_key_jwtauthentication for the token endpoint - New: HTTP Framework handler for Curveball
- New: Official support for 2 new providers:
figma,mendeley
- New: Support for
response_mode: form_post
- Fix: Path matching for
gcloudhandler - docs
- Fix: Path matching for
awshandler - docs
- Fix: Improved path mathching for
awshandler + support for event format v2 - New: Official support for 2 new providers:
autodesk,storyblok - Change: Renamed provider
zeittovercel
- New: HTTP Framework handler for Fastify
- New: Serverless handlers for AWS Lambda, Azure Function, Google Cloud Function and Vercel
- New: RSA-SHA1 signature method support for OAuth1.0a
- Fix: OAuth2 support for
intuit - Fix: Profile endpoints for
qqandweibo
- New: Support for request options
- New: Official support for 2 new providers:
apple,garmin
- Fix: The upcoming Grant constructor
- New: Support for
private_key_jwtclient authentication - New:
grant-profilewas deprecated as standalone module and is now embedded into Grant - New: Increase the random
stateandnoncesize - New: Official support for 4 new providers:
cas,cognito,fusionauth,logingov
- Fix: Fixed the path matching regexp for Express and Koa
- Breaking: Drop support for Node v4 and v6
- Breaking: Return
id_tokenas string by default - Breaking: Change in the
responseconfiguration - New:
originandprefixconfiguration - Deprecate: Koa v1 and Hapi <= v16
- Deprecate:
protocol,host, andpathconfiguration - Migration Guide: from v4 to v5
- New: PKCE support
- New: input state overrides
- New: output state transport
- New: user-agent header is set on all internal requests
- Fix: Regression about race condition for slow session stores in Express middleware
- New: Official support for 2 new providers:
livechatandzeit
- Fix: Support for
instagramGraph API
- New: Official support for 2 new providers:
lineandnaver - Fix: Updated 4 providers:
clio,concur,familysearchandfitbit
- New: Official support for 3 new providers:
atlassian,aweber,phantauth - Change: Removed 6 discontinued providers:
dailymile,everyplay,fluidsurveys,moves,mydigipass,producteev - Change: Renamed
letsfreckletonokotime
- New: Official support for 3 new providers:
mailxpert,snapchatandzoom
- Fix: Support for
cookie-sessionin Express middleware
- Fix: Race condition for slow session stores in Express middleware
- New:
koa-mountno longer required for the Koa middleware
- Fix: Support for @hapi/hapi namespace
- Fix: Support for Hapi >= 18
- New: Added
token_endpoint_auth_methodoption - New: Official support for 1 new provider:
wechat
- Fix: Accept array of
audclaims when validating anid_token - New: Official support for 1 new provider:
qq
- New: Added
responseoption for limiting the response data
- Fix: Nested static overrides filtering
- New: Explicit
overridesoption for defining static overrides - New: Official support for 2 new providers:
ibm,mention
- New: Official support for 2 new providers:
freelancer,hootsuite - Change: Removed 1 discontinued provider:
jawbone
- Fix: Regression regarding missing session in the callback route
- New: OpenID Connect
id_tokenandnoncesupport - New: The
serverconfiguration option is now calleddefaults(serveris still allowed) - New: Explicit
dynamicoption to control the Dynamic Override feature - Change: The Dynamic Override is now disabled by default! In case you rely on it you have to enable it explicitly. Use the more granular configuration or the proxy one
- New: Official support for 2 new providers:
mastodon,onelogin - Change: Updated 4 providers:
bitbucket,strava,twitch,yahoo
- New: Official support for 4 new providers:
arcgis,nest,okta,typeform - Change: Updated 2 providers:
dropbox,withings
- New: Official support for 6 new providers:
auth0,bettlenet,mixer,nylas,timelyapp,viadeo - Change: Removed 5 discontinued providers:
appnet,codeplex,elance,odesk,rdio
- New: Support for Hapi >= 17
- Fix: Minor fix in
request-compose
- Change: Officially Node >= 4.0.0 required!
- Change: Dropped the
requestdependency in favor ofrequest-compose - Change: Return errors more consistently based on the
transportused (see below) - Change: The internal session variable
step1was renamed torequest - Change: The internal
_configproperty is no longer exposed
app.use(new Grant({server: {transport: 'session'}}))
app.get('/final_callback', (req, res) => {
if (req.query.error) {} // v3.x
if (req.session.grant.response.error) {} // v4.x
})- Change: Migrate all OAuth endpoints to HTTPS
- New: Official support for 2 new providers:
authentiqandpatreon
- Change: Hapi is now using the internal
configobject directly through the middleware instance - Fix: Dynamic overrides support for Hapi >= 12.x
- New: Hapi middleware configuration can be passed in the constructor
- New: First class support for Koa >= 2.x using
async/awaitNode >= 8.0.0 required!- Koa 1.x and 0.x are still supported for Node 4, 6 and 8
- Change: Removed 2 discontinued providers:
beatsmusicandcopy - New: Official support for 5 new providers:
ebay,genius,jamendo,pinterestandunsplash
- New: Official support for 2 new providers:
discordandmedium
- Change: Dropped node
0.10and0.12as built targets in TravisCI - Change: Added the advisory engines key in package.json for node
>=4.0.0 - New: Official support for 6 new providers:
baidu,docusign,iconfinder,idme,mydigipass,venmo
- Fix: Added the required
user-agentheader fordiscogs - New: Official support for 1 new provider:
homeaway
- New: Support for Koa 2.x
- Fix: Expect oauth version to be string when passed as querystring
- New: Official support for 1 new provider:
lyft
- New: Added
scope_datacustom parameter foramazon
- New: Official support for 2 new providers:
idonthis,smugmug
- New: Path Prefix configuration option
- New: Official support for 2 new providers:
microsoft,visualstudio
- Fix: Fix for
yar@6.0.0 - New: Official support for 2 new providers:
gitbook,optimizely
- New: Official support for 11 new providers
- New: Official support for 8 new providers
- New: OAuth2 support for
fitbit2 - New: Official support for 6 new providers
- New: Docs about the Alternative Require
- New: Official support for 6 new providers
- Change: Improved OAuth2 random state string
- New: Ability to override the redirect_uri
- New: Ability to configure Grant without having a
serverconfiguration key - New: Generic error handler for missing or misconfigured provider
- New: Introduced
custom_paramsoption for safer way to configure Custom Authorization Parameters - New: Improved documentation about all configuration Quirks
- New: Official support for 5 new providers
- Change: Improved configuration initialization
- Change: Migrated
rdioto OAuth2 - Change: Updated
traktOAuth URLs - New: Added
device_idanddevice_namecustom authorization parameters foryandex - New: Docs about the Programmatic Access
- New: Official support for 3 new providers
- New: Official support for 9 new providers
- New: Official support for 2 new providers
- New: Official support for 10 new providers
- Change: The Express middleware is no longer using the express-session middleware internally
- Change: The Express and Koa middlewares are no longer using their body-parser middleware internally
- Change: Express is set as
peerDependencyingrant-express - Change: Koa is set as
peerDependencyingrant-koa - Change: Yar is no longer set as
peerDependencyingrant-hapi, though using session is still required
- Change: Any of the reserved keys can be overriden for a provider
- Change: Allow Custom Provider configuration
- New:
transportoption that allows the response data to be returned in the final callback either as querystring or in the session - New:
state: trueoption that enables auto generated random state string on each authorization attempt (OAuth2 only)
- Change: Allow any session store to be used with the Koa middleware
- Change: Using
koa-routeinstead ofkoa-routerinternally in the Koa middleware - Change:
grant-hapinow usespeerDependencies
- Fix: Removed default Express require left over in index.js
- Fix: Examples
- Change: Each consumer middleware now have its own module:
grant-express,grant-koaandgrant-hapi
- New: Hapi middleware
- New: Docs about Dynamic Overrides via
GETrequest - New: A bunch of Examples
- Change: Complete rewrite of the module using request
- New: Koa middleware
- Change: The Response Data now contains a
rawkey in it - Change: Custom Authorization Parameters regarding token expiration are no longer part of the scope array
- Version
1.xis no longer supported, though most of the configuration data structure remains intact, so migration should be easy
- Initial Release