v0.21.0

What's Changed

• Website, documentation improvement: Updated Pocket ID repository URL by @rowdynl in #276
• feat: support loading secret values from a file via ${file:/path} by @dima-bzz in #280
• feat: add AuthorizationParams to pass extra query params to the IDP by @dima-bzz in #279
• feat!: split UnauthorizedBehavior into UnauthenticatedBehavior (401) and UnauthorizedBehavior (403) by @dima-bzz in #282
• feat: encrypt the callback state by @sevensolutions in #284
• docs: fix inconsistent PascalCase keys in Kubernetes middleware example by @sevensolutions with @Copilot in #285
• feat!: improve redirect uri wildcard support by @dima-bzz in #286

Breaking Changes

Please not that this release contains two major breaking changes.
Read the documentation for more details and migration path.

• The single UnauthorizedBehavior option that previously controlled the response for both unauthenticated requests (no/invalid session, HTTP 401) and unauthorized requests (valid session, but failing the Authorization rules, HTTP 403) has been split into two separate options.

• Wildcard matching in ValidPostLoginRedirectUris/ValidPostLogoutRedirectUris (including a bare *) now requires explicitly setting the TOA_ENABLE_REDIRECT_URI_WILDCARDS environment variable.

New Contributors

• @rowdynl made their first contribution in #276
• @dima-bzz made their first contribution in #280

Full Changelog: v0.20.1...v0.21.0