v0.4.2 — Verify ID token with explicit endpoints

Fix: ID token signature and issuer not verified with explicit endpoints

Upgrade recommended for every app on 0.4.0 / 0.4.1.

If your Config sets the OIDC endpoints explicitly (authorization_endpoint, token_endpoint, userinfo_endpoint) together with well_known_openid_url, EasyOIDC never loaded the discovery document at startup. jwks_uri and issuer stayed empty, so validate_id_token() only checked aud, exp and nonce — the signature and the issuer were not verified.

0.4.2 reads issuer / jwks_uri from discovery on the first login when they are missing (once per process). Explicit values still win.

uv add "easyoidc>=0.4.2"

No code changes needed. If you configure endpoints without well_known_openid_url, set issuer and jwks_uri explicitly; otherwise EasyOIDC logs a warning and does not verify the signature.

Also

• End-to-end test of the NiceGUI integration (login, client roles, 403, logout, IdP error); the CI now installs the nicegui extra.

Found while upgrading three internal apps that all use the explicit-endpoints pattern. PR #8 · CHANGELOG