OpenID v2.4.4 Release Notes
Release Date: 2020-09-01 // over 3 years ago-
Security
- prevent XSS and open redirect on OIDC session management OP iframe with generic
OIDCRedirectURLsAllowedprimitive; thanks Andrew Brady - ➕ add
OIDCStateCookiePrefixprimitive for the state cookie prefix to anonymise the state cookie name
🛠 Bugfixes
- 🛠 fix double
Set-Cookiebehaviour when usingclient-cookie, calling the session info hook and writing out a session update (twice); thanks @deisser - reverse order of creating HTML response and adding session cookie in info hook; thanks @deisser
- ✂ delete state cookie when it cannot be decoded/decrypted
- don't send
access_tokenin user info request when method is set to POST; OIDC conformance - 👍 allow
Content-Typecheck on backchannel logout to have postfixes (utf-8 etc) - terminate backchannel logout with DONE instead of OK to avoid authz error 500
- 🛠 fixes for various compiler warnings/issues (older and newer versions of GCC)
🔋 Features
- add conditional expression to
OIDCUnAuthAction; see #479; thanks @raro42 and @marcstern - ➕ add
grant_typesto dynamic client registration request - add recommended cache headers on backchannel logout response https://openid.net/specs/openid-connect-backchannel-1_0.html#rfc.section.2.8
Packaging
- 🚀 the libcjose >= 0.5.1 binaries that this module depends on are available from the "Assets" section in release 2.4.0
- 📦 Ubuntu Xenial packages can also be used on Ubuntu Yakkety, Zesty and Artful
- 🐧 packages for various other platforms such as Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Power PC (ppc64, ppc64le), Oracle Linux 6, older Debian distro's, SUSE LInux Enterprise Server, IBM HTTP Server 8.5.5, Mac OS X and Microsoft Windows 64bit are available under a commercial agreement via [email protected]
- prevent XSS and open redirect on OIDC session management OP iframe with generic