v5.0.0

Version 5.0 is a major release with security fixes. It binds the authorization code flow to the browser which started it, uses PKCE, stores an authorization only when its flow finishes, and requires PHP 8.3 or later with Flow 8.3 (8.3.13 or later), Flow 8.4 or Flow 9.

Several changes are breaking. Before upgrading, read the migration guide. Among other things, it explains the new database migration, the browser binding and authorization handle, the new abstract method getClientSecret(), and why the scope is now sent with client credentials.

Security

This release fixes the following vulnerabilities:

• GHSA-7wcp-2c5m-34pp: Client secret of one service can be sent to the token endpoint of another service
• GHSA-v5hx-px8w-vqhh: Authorization code flow is not bound to the browser which started it

What's Changed

• Require Flow 9 and PHP 8.3, upgrade to PHPUnit 12 by @robertlemke in #40
• Allow additional parameters for the authorization request by @robertlemke in #41
• Cover authorization flows and encryption with tests by @robertlemke in #42
• Clean up the package for 5.0 by @robertlemke in #43
• Rework expiry and garbage collection of authorizations by @robertlemke in #44
• Handle refused and unknown authorizations in the callback by @robertlemke in #45
• Store an authorization only when its flow finishes by @robertlemke in #46
• Support Flow 8.3 and 8.4 by @robertlemke in #47
• Send the scope with client credentials and keep tokens until replaced by @robertlemke in #48

Full Changelog: v4.1.2...v5.0.0

v4.1.2

What's Changed

• Raise dependencies & code cleanup by @kdambekalns in #38

Full Changelog: v4.1.1...v4.1.2

v4.1.1

Full Changelog: v4.1.0...v4.1.1

v4.1.0

What's Changed

• Declare compatibility with Flow 9 by @robertlemke in #34
• Raise PHP requirement by @robertlemke in #36
• chore: add postgres migrations by @dfeyer in #35
• Raise dependencies by @kdambekalns in #37

New Contributors

• @dfeyer made their first contribution in #35

Full Changelog: v4.0.3...v4.1.0

v4.1.0-beta.2

What's Changed

• Raise PHP requirement by @robertlemke in #36
• chore: add postgres migrations by @dfeyer in #35

New Contributors

• @dfeyer made their first contribution in #35

Full Changelog: v4.1.0-beta.1...v4.1.0-beta.2

v4.1.0-beta.1

What's Changed

• Declare compatibility with Flow 9 by @robertlemke in #34

Full Changelog: v4.0.3...v4.1.0-beta.1

v4.0.3

What's Changed

• BUGFIX: Prevent state cache from flooding the filesystem by @bwaidelich in #32

Full Changelog: v4.0.2...v4.0.3

v4.0.2

Full Changelog: v4.0.1...v4.0.2

v4.0.1

What's Changed

• Hotfix: generate random authorization id for authorization code flows by @robertlemke in #14
• Make actually compatible with Flow < 6 by @kdambekalns in #26
• Allow guzzle 7 by @booooza in #30

New Contributors

• @booooza made their first contribution in #30

Full Changelog: v4.0.0...v4.0.1

v4.0.0

This release makes OAuthController::getServiceType() a static public function and therefore requires implementations which subclass OAuthController to be adjusted accordingly. It is changed in order to allow PHP 8 based applications detect service types properly in OAuthController without having to instantiate all client implementations.

Full Changelog: v3.4.0...v4.0.0