fix: update dependency jwks-rsa to v3 #21

With version 2 we have added full JWK/JWS support. With this we have bumped the node version to minimum 10. We have also removed Axios and exposed a fetcher option to allow user's to completely override how the request to the jwksUri endpoint is made.

Breaking Changes

Drops support for Node < 10
No more callbacks, using async/await(promises)
Removed Axios and changed the API to JwksClient

Changes

Added

Full JWK/JWS Support #205 (panva)

Changed

Simplify request wrapper #218 (davidpatrick)
Pins to Node Version 10,12,14 #212 (davidpatrick)
Migrate from callbacks to async/await #222 (davidpatrick)

Migration Guide from v1 to v2

Proxies

The proxy option has been removed from the JwksClient. Support for it was a little spotty through Axios, and we wanted to allow users to have more control over the flow. Now you can specify your proxy by overriding the requestAgent used with an agent with built-in proxy support, or by completely overriding the request library with the fetcher option.

// OLD
const oldClient = jwksClient({
  jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',
  proxy: 'https://username:pass@address:port'
});

// NEW
const HttpsProxyAgent = require('https-proxy-agent');
const newClient = jwksClient({
  jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',
  requestAgent: new HttpsProxyAgent('https://username:pass@address:port')
});

Request Agent Options

The library no longer gates what http(s) Agent is used, so we have removed requestAgentOptions and now expose the requestAgent option when creating a jwksClient.

// OLD
const oldClient = jwksClient({
  jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',
  requestAgentOptions: {
    ca: fs.readFileSync(caFile)
  }
});

// NEW
const newClient = jwksClient({
  jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',
  requestAgent: new https.Agent({
    ca: fs.readFileSync(caFile)
  })
});

Migrated Callbacks to Async/Await

The library no longer supports callbacks. We have migrated to async/await(promises).

// OLD
client.getSigningKey(kid, (err, key) => {
  const signingKey = key.getPublicKey();
});

// NEW
const key = await client.getSigningKey(kid);
const signingKey = key.getPublicKey();

`v1.12.3`

Compare Source

Added

Add alg to SigningKey types #220 (okko)

Fixed

Fix npmjs resolves #221 (adamjmcgrath)
Fix Import default Axios instance #216 (dsebastien)

`v1.12.2`

Compare Source

Fixed

Added coverage folders to .npmignore

`v1.12.1`

Compare Source

Security

Bump Axios to ^0.21.1 #208 (72636c)

`v1.12.0`

Compare Source

Added

Provide an alternative source for supplying keysets #202 (davidpatrick)

Deprecation
We are deprecating passing in a jwksObject to the client for reasons laid out in #202. In order to load keys from anything other than the jwksUri, please use the getKeysInterceptor.

  const client = new JwksClient({ 
    jwksUri: 'https://my-enterprise-id-provider/.well-known/jwks.json',
    getKeysInterceptor: (cb) => {
      const file = fs.readFileSync(jwksFile);
      return cb(null, file.keys);
    }
  });