v5.8.8

Change:

• <oauth2Resource2>: In case of 'CSRF token mismatch.', log both tokens being compared to aid in analysis of root cause
• <oauth2Resource2>: Log if stored token gets overwritten after successful login

v5.5.14

Change:

• <oauth2Resource2>: In case of 'CSRF token mismatch.', log both tokens being compared to aid in analysis of root cause
• <oauth2Resource2>: Log if stored token gets overwritten after successful login

v5.8.6

Change:

• <oauth2Resource2>: Split 'CSRF token mismatch.' into 3 separate error cases. Enable usage of afterErrorUrl also for these 3 error cases.

v5.5.13

Change:

• <oauth2Resource2>: Split 'CSRF token mismatch.' into 3 separate error cases. Enable usage of afterErrorUrl also for these 3 error cases.

v6.0.5

Fixes:

• ACME: fixed fileStorage lock management
• Remove headers wanting to upgrade HTTP/1.1 to HTTP/2 (RFC7540), as they have been removed in the superseeding RFC9113. This allows medium aged HTTP clients (like the Java built in one) to work.

---

A few breaking changes were introduced starting with version 6.0.0; please refer to the Migration Guide for required updates.

Please let us know, if you have any suggestions for improvement.

v5.8.5

Fixes:

• ACME: fixed fileStorage lock management

v5.8.4

Fixes:

• upgrade json-smart library to avoid CVE-2024-57699, a Denial of Service affecting everyone using JSONPath (see #1725 for details) (@precoder)

Improvements:

• ACME: more DEBUG logging (@rrayst)

v5.8.3

Fixes:

• backport of workaround for "finalizing ACME orders returns 'already finalized'", even on first finalization call

v6.0.4

Fixes:

• SPeL support for ${body}
• upgraded dependencies
• <log body="true"/>: also log non-text/non-JSON/non-XML body
• improved error message on <oauth2Resource2> misconfiguration

Features:

• <adminApi/>

---

A few breaking changes were introduced in version 6.0.0; please refer to the Migration Guide for required updates.

v6.0.3

Fixes

• reenabled full body logging of internal OAuth2 communication (when logging for com.predic8.membrane.core.interceptor.oauth2client.rf.LogHelper is set to DEBUG)

---

A few breaking changes were introduced in version 6.0.0; please refer to the Migration Guide for required updates.