v4.0.1

Security fixes

Thanks to Christoph Braun, Karlsruhe Institute of Technology (KIT), Institute AIFB, Web Science (@uvdsl) for reporting the issue.

Prefer upgrading to v5.0.2 if possible.

browser

• The DPoP key is no longer extractable in the browser context, which prevents its exploitation via XSS
  or other browser-based clients vulnerabilities. This restricts an attacker session's length (in the case
  of a successful token extraction) to the lifespan of the Access Token, very short by design.

node

• The browser DPoP key fix mentioned above creates a potentially breaking change for the NodeJS client:
  make sure the node library is updated at the same time as the core library to prevent regressions.

What's Changed

Full Changelog: v4.0.0...v4.0.1