version 3.0.0

[aarongranick-okta]

Breaking Changes

• #308 - Removed jquery and reqwest httpRequesters

• #309 - Removed Q library, now using standard Promise. IE11 will require a polyfill for the Promise object. Use of Promise.prototype.finally requires Node > 10.3 for server-side use.

• #310

  • postLogoutRedirectUri will default to window.location.origin
  • signOut will revoke access token and perform redirect by default. Fallback to XHR (closeSession) if no idToken.
  • New method closeSession for XHR signout without redirect or reload.
  • New method revokeAccessToken

• #311 - parseFromUrl now returns tokens in an object hash (instead of array). The state parameter (passed to authorize request) is also returned.

• #313 - New option secureCookies, which is true by default. An HTTPS origin will be enforced unless secureCookies is set to false.

• #316 - Option issuer is required. Option url has been deprecated and is no longer used.

• #317 - pkce option is now true by default. grantType option is removed.

• #320 - getWithRedirect, getWithPopup, and getWithoutPrompt previously took 2 sets of option objects as parameters, a set of "oauthOptions" and additional options. These methods now take a single options object which can hold all available options. Passing a second options object will cause an exception to be thrown.

• #321

  • Default responseType when using implicit flow is now ['token', 'id_token'].
  • When both access token and id token are returned, the id token's at_hash claim will be validated against the access token

• #325 - Previously, the default responseMode for PKCE was "fragment". It is now "query". Unless explicitly specified using the responseMode option, the response_mode parameter is no longer passed by token.getWithRedirect to the /authorize endpoint. The response_mode will be set by the backend according to the OpenID specification. Implicit flow will use "fragment" and PKCE will use "query". If previous behavior is desired, PKCE can set the responseMode option to "fragment".

Other

• #306 - Now using babel for ES5 compatibility. All polyfills have been removed.

• #312 - Added an E2E test for server-side authentication (node module, not webpack).

[robertjd]

This review is about the changelog only. A few nits and one suggestion, lgtm otherwise 👍