oidc_core 2.1.0 copy "oidc_core: ^2.1.0" to clipboard
oidc_core: ^2.1.0 copied to clipboard

Published 2 days ago • verified publisherbdaya-dev.com
SDKDartFlutter
PlatformAndroidiOSLinuxmacOSwebWindows
→

Metadata

A dart package containing models and helpers for OpenId Connect spec.

More...

2.1.0 #

2.0.0 #

Note: This release has breaking changes.

  • FIX(oidc_core): protect the PKCE code_verifier at rest (#324 item 20) (#402). (32f4cbb3)
  • FIX(oidc_core): route deleteClientConfiguration through typed error parsing (#400). (bd250ff5)
  • FIX(oidc_core): honor expectedIssuer in validateUser (Entra multi-tenant) (#389). (4abc4e74)
  • FIX(oidc_core): send dpop_jkt on the direct authorization request (#324) (#391). (c5e7420a)
  • FEAT(oidc_core): mTLS RFC 8705 phase 1 core surface (#386) (#412). (f9b1446b)
  • FEAT(oidc_core): DCR integration helpers (#385) (#413). (c07e881a)
  • FEAT(oidc_core): react to a UserInfo 401 during session resume (#302) (#403). (933e0ed7)
  • FEAT(oidc_darwin): add macOS loopback system-browser navigation mode (#124) (#398). (a8d758f7)
  • FEAT(oidc_core): emit OidcTokenRefreshFailedEvent on refresh failures; clamp the expiring-refire loop (#392). (0b581dff)
  • BREAKING FEAT(oidc_core): cache-first init as the new default, discovery TTL cache, loaded-token validity controls (#399). (de3e2287)

1.0.0 #

Note: This release has breaking changes.

  • FIX(oidc_core): also ungate AUTO refresh-on-expiry from grant_types_supported (#324). (7e543b98)
  • FIX: update packages/oidc_core/lib/src/managers/user_manager_base.dart. (d62828c0)
  • FIX(oidc_core): kid-miss refetch on the cacheStore-less verification path. (8eecbe28)
  • FIX(oidc_core): refetch JWKS on unknown kid with per-issuer cooldown. (badeba7b)
  • FIX(oidc_core): single-location client auth on token exchange and introspection (RFC 6749 §2.3). (36f67e39)
  • FIX(oidc_core): validate RFC 9207 iss on authorization error responses. (5916b65e)
  • FIX(oidc_core): always send id_token_hint on RP-initiated logout. (434af9ab)
  • FIX(oidc_core): reject UserInfo responses missing sub (OIDC Core §5.3.2). (f133c5b2)
  • FIX(oidc_core): send client auth in exactly one location on refresh (RFC 6749 §2.3). (f6bf79a8)
  • FIX(oidc_core): percent-encode client_secret_basic credentials (RFC 6749 §2.3.1). (94964778)
  • FIX(oidc_darwin): implement flowTimeoutSeconds for the Apple ASWebAuthenticationSession flow. (482f0186)
  • FIX: handle whitespace-only payloads. (2751b841)
  • FIX(oidc_core): strip terminating slash when building well-known URL (#324). (975d446f)
  • FIX: resolve all four library bugs; drive honest unit coverage to ~95% (#368). (c86bee17)
  • FIX(oidc_core): close 7 P0 spec-audit findings (#324). (60907e96)
  • FIX: handle refresh responses without id_token. (4af363be)
  • FIX(oidc_core): restore web/WASM compatibility for offline error handling. (0c2e894a)
  • FIX(core): harden DPoP thumbprint + JARM verification (adversarial-review fixes). (69ac51aa)
  • FIX(core): DPoP — pad short EC coordinates (RFC 7638 jkt correctness). (bd5568e7)
  • FIX(core): update device-code flow test for the fail-closed JWT default. (fa333f89)
  • FIX: handle empty response. (03179667)
  • FIX(oidc_core): harden ID-token/UserInfo validation (P0 spec-compliance). (1e7cfee9)
  • FIX: pre-v1 correctness — certification claim, license, Android queries, honest native option docs. (3b8ef447)
  • FEAT(oidc_core): deferred audit best-practice hardening (alg-pin, signed-userinfo, issuer, back-channel logout). (7259290d)
  • FEAT(android): apply typed Custom Tabs options natively (Phase 1). (10e903eb)
  • FEAT(oidc_core): enforce RFC 9207 iss require-when-advertised + error-path (#324). (3f324712)
  • FEAT(core): JAR signed request objects + JARM signed responses (RFC 9101 / JARM). (19480489)
  • FEAT(core): validate the Hybrid-flow front-channel id_token (OIDC Core §3.3.2). (8dbc582b)
  • FEAT(core): Pushed Authorization Requests (PAR, RFC 9126) — endpoint + model. (6eb09f8a)
  • FEAT(core): Token Introspection (RFC 7662) + step-up challenge parsing (RFC 9470). (ab0cdff0)
  • FEAT(core): Resource Indicators (RFC 8707) + Token Exchange (RFC 8693). (43d8d664)
  • FEAT(core): DPoP resource-endpoint nonce retry (RFC 9449 §9). (1d733790)
  • FEAT(core): validate c_hash + auth_time/max_age (OIDC Core §3.3.2.11 / §3.1.2.1). (93c81845)
  • FEAT(core): DPoP phase 3 — dpop_jkt auth-code binding + UserInfo DPoP scheme. (d28b736f)
  • FEAT(core): DPoP phase 2 — use_dpop_nonce retry (centralized in the token endpoint). (bc059b27)
  • FEAT(core): mint private_key_jwt / client_secret_jwt client assertions. (c7043fcc)
  • FEAT(storage): harden token storage at rest (RFC 9700 §4.9.3). (76111b4a)
  • FEAT(core): DPoP phase 1b — attach proofs to token-endpoint requests. (c0207476)
  • FEAT(oidc): batch-2 audit hardening (loopback timeout, auth_time/max_age, resilient discovery parse, unverified-userinfo guard). (d7f5965a)
  • FEAT(core): DPoP (RFC 9449) crypto core — proof builder + key/thumbprint + manager. (43f566d5)
  • FEAT(oidc_core): batch-3 audit hardening (signed_metadata verify, JWKS cache TTL, implicit/hybrid nonce assert). (27a7f34d)
  • FEAT(oidc_core): typed logout capability flags on provider metadata. (74a6613a)
  • FEAT(core): Dynamic Client Registration + management (RFC 7591 / RFC 7592). (55226655)
  • FEAT(observability): native browser events via the existing OidcEvent stream (Phase 3). (91d1f5bd)
  • BREAKING REFACTOR: remove rxdart; adopt bdaya_shared_value ^5.0.0. (0d65d7fd)
  • BREAKING FIX(core): always send PKCE (default S256), never downgrade (OAuth 2.1 / RFC 9700). (99d1284a)
  • BREAKING FIX(core): fail-closed id_token verification + stricter validation (security). (b4d92eaf)
  • BREAKING FEAT(core): wire PAR (RFC 9126) into the authorization-code login flow. (d2b44c32)
  • BREAKING FEAT(core): id_token aud-strictness + at_hash validation (security). (747d8a72)
  • BREAKING FEAT(options): redesign native options API (v1 clean break, no AppAuth framing). (a78954fe)
  • BREAKING FEAT: consolidate jose_plus, crypto_keys_plus, x509_plus into the workspace. (3fffc6cd)
  • BREAKING FEAT(core): revoke tokens on logout by default (RFC 7009). (90a8cebd)
  • BREAKING FEAT(oidc_android): add flowTimeoutSeconds to fix headless CI hang. (01c844f5)
  • BREAKING FEAT(oidc_core): remove the strictJwtVerification fail-open opt-out. (ee2146f9)
  • BREAKING CHORE: v1 dependency upgrade + drop the pigeon global-tool wrapper. (45b62a3e)

0.16.1+1 #

  • DOCS: remove logo branding from screenshots. (2acf65d3)

0.16.1 #

  • FEAT(oidc_core): add extraTokenHeaders parameter to loginPassword. (e00c753b)

0.16.0 #

Note: This release has breaking changes.

  • REFACTOR: remove unnecessary @protected annotations from offline mode tracking variables. (56da9bab)
  • FEAT: update copy_with_extension and copy_with_extension_gen dependencies to support version range. (3569919e)
  • FEAT: update dependencies and adjust test configurations for improved compatibility. (18fef073)
  • FEAT: update dependencies and enhance offline mode test handling. (a57d6490)
  • FEAT: enhance offline mode handling in tests and user manager. (e0cae79a)
  • BREAKING FEAT: Add offline mode events and error handling. (7479fd15)

0.15.0 #

Note: This release has breaking changes.

  • FIX: refactor oidcExecuteHook to handle request and response modifications. (806c6411)
  • BREAKING FIX: hasInit is set to true too early in init() of OidcUserManagerBase (#275). (d704aa5f)
  • BREAKING FEAT: Support WASM (#253). (8b2931ef)

0.14.2+1 #

0.14.2 #

  • REFACTOR: remove unnecessary library declaration and test annotation from device_authorization_test.dart. (a8886cfe)
  • FEAT: add token revocation methods to OidcUserManager. (4850788f)
  • FEAT: add token revocation support with request and response models. (a6b635f0)

0.14.1 #

  • FEAT: update changelogs to reflect breaking changes and new features for multiple OIDC platforms. (4caca121)

0.14.0 #

  • BREAKING FEAT: Added launchUrl parameter to OidcPlatformSpecificOptions_Native, to simplify modifying the url launching logic without overriding the manager.
  • BREAKING FEAT: Added support for multiple managers by adding the id property to OidcUserManagerBase.
    • Added the managerId parameter to:
      • Multiple methods in OidcStore.
      • OidcState
    • See #206 for motivation.
  • FIX: Added some missing fields in json serialization.

0.13.0 #

Note: This release has breaking changes.

0.12.0 #

Note: This release has breaking changes.

  • REFACTOR: minor lints and refactors. (5ab9af70)
  • BREAKING CHORE(deps): upgrade flutter_appauth to v9.0.0 (#199). (f027af34)

0.11.0 #

Note: This release has breaking changes.

  • FIX: set idTokenHint null if no postLogoutRedirectUri set (#192). (bcf47cbd)
  • BREAKING CHORE: regenerate files with new json serializer. (35523a61)

0.10.0 #

Note: This release has breaking changes.

  • BREAKING FEAT: minimal implement nonce hashing (#172). (d4daf387)

0.9.1 #

  • FEAT: Added OidcTokenExpiredEvent and OidcTokenExpiringEvent (#91). (85ba41ce)

0.9.0 #

Note: This release has breaking changes.

  • FIX: expand successful status range to include 300-399 status code to allow for 304 , see. (717d5330)
  • FIX: improve OidcEndpoints error handling. (5f15c774)
  • FIX: update oidc_web_core version. (2717b23c)
  • FEAT: support offline auth. (cced6013)
  • FEAT: add keepUnverifiedTokens and keepExpiredTokens to user manager settings. (117931bd)
  • FEAT: add getIdToken to OidcUserManagerSettings. (dceabc89)
  • FEAT: updated oidc_core example. (676657b1)
  • DOCS: update changelogs. (b0ffeb43)
  • BREAKING FIX: Opening in new tab not working reliably in Safari for iOS #31. (2e30028b)

0.7.0 #

Note: This release has breaking changes.

  • BREAKING DEPS: update min dart version to 3.4.0
  • FEAT: added OidcUserManagerBase.
  • FIX: improve OidcEndpoints error handling.
  • DOCS: updated the docs website with new entries to the added features.

0.6.3 #

  • DEPS: Use jose_plus: ^0.4.4 which uses package:clock JWT validation to simplify testing.
  • FEAT: Added OidcDateTime extension which contains secondsSinceEpoch and fromSecondsSinceEpoch helper methods

0.6.2 #

  • FIX: Serialize query parameters.
  • FIX: Removed false positive warnings that came from url_launcher

0.6.1 #

  • FEAT: Support overriding the discovery document.

0.6.0+1 #

  • DOCS: fixed docs link.

0.6.0 #

Note: This release has breaking changes.

  • FEAT: added claimNames and claimSources to OidcUserInfoResponse.
  • BREAKING CHANGE: changed nonce to get stored in secureTokens namespace.

0.5.1 #

  • FEAT: added device authorization endpoint.

0.5.0+1 #

  • FIX: added userInfo to fromIdToken.
  • DOCS: added oidc_core docs and updated example.

0.5.0 #

0.4.1 #

  • FEAT: add response form userInfo endpoint to the user object.
  • FEAT: use package:clock for better testing.

0.4.0+1 #

  • FIX: token date calculations.

0.4.0 #

Note: This release has breaking changes.

  • BREAKING CHANGE: all packages.

0.3.2 #

  • FEAT: support logout.

0.3.1 #

  • FEAT: initial version.

0.3.0 #

  • Working authorization code flow, without refresh_token support.

0.2.0 #

  • FEAT: added more helpers.

0.1.0+1 #

  • Added topics.

0.1.0 #

  • Initial version.

← Metadata

3
likes
145
points
5.41k
downloads

Documentation

API reference

Publisher

verified publisherbdaya-dev.com

Weekly Downloads

Metadata

A dart package containing models and helpers for OpenId Connect spec.

Homepage
Repository (GitHub)
View/report issues

Topics

#oidc #openidconnect #oauth #authentication

License

MIT (license)

Dependencies

async, clock, copy_with_extension, crypto, http, jose_plus, json_annotation, logging, meta, nonce, uuid

More

Packages that depend on oidc_core

Back