oidc_web_core 1.0.0

dart web package for oidc protocol

1.0.0

Note: This release has breaking changes.

• FIX(oidc_web_core): stop the samePage end-session test from navigating the suite away (#382). (d1cd114e)
• FIX: resolve all four library bugs; drive honest unit coverage to ~95% (#368). (c86bee17)
• FIX(oidc_web_core): secureTokens silently persisted as plaintext on Firefox (#360). (656025d8)
• FIX(oidc_core): close 7 P0 spec-audit findings (#324). (60907e96)
• FIX(oidc_web_core): avoid COOP closed-window false positives. (5b24209b)
• FIX(oidc_web_core): detect closed auth window (#303). (36f7a340)
• FEAT(oidc_web_core): encrypt secureTokens at rest (AES-GCM via WebCrypto) (#324 item 15). (cf504300)
• BREAKING REFACTOR: remove rxdart; adopt bdaya_shared_value ^5.0.0. (0d65d7fd)

0.5.0

• FEAT: encrypt the secureTokens namespace (access/refresh/id tokens, the OIDC nonce) at rest in OidcWebStore. AES-GCM via WebCrypto, with a non-extractable 256-bit key persisted (as a structured-clone CryptoKey object, never its raw bytes) in IndexedDB and a fresh random IV per write. Values are stored as a versioned oidcenc.v1.<iv>.<ciphertext> envelope. This is defense-in-depth against disk/backup scraping and casual inspection -- it is NOT protection against XSS: same-origin script can still call crypto.subtle.decrypt or simply read decrypted tokens back out through the OidcStore API. Harden against XSS itself (CSP, trusted types, dependency hygiene) and prefer a BFF for high-value applications. (audit #324 item 15)
  • No new required settings: const OidcWebStore() still works, and encryption is on by default (OidcWebStoreEncryption.preferred).
  • Values written before this feature (or written by the preferred fallback) are read through transparently and re-encrypted on next write -- no forced re-login. This migration is forward-only: downgrading to a version predating this feature will see encrypted values as opaque strings.
  • If WebCrypto/IndexedDB are unavailable (a non-secure-context origin, or IndexedDB disabled/ephemeral in some private-browsing modes), the default preferred mode falls back to the previous plaintext behavior with a one-shot warning; pass encryption: OidcWebStoreEncryption.required to throw an OidcException instead of ever writing plaintext.
  • No new dependencies: WebCrypto and IndexedDB are both already exposed by package:web.

0.4.0+3

• DOCS: remove logo branding from screenshots. (2acf65d3)

0.4.0+2

• Update a dependency to the latest release.

0.4.0+1

• FIX(oidc_web_core): use isA() for JS interop checks. (724c9a2a)

0.4.0

Note: This release has breaking changes.

• BREAKING FEAT: Support WASM (#253). (8b2931ef)

0.3.1+3

• DOCS: Add openid certification mark (#240). (89313199)

0.3.1+2

• Update a dependency to the latest release.

0.3.1+1

• Update a dependency to the latest release.

0.3.1

• FEAT: Enhance OIDC store with manager ID support. (56f42f2d)

0.3.0+5

• Update a dependency to the latest release.

0.3.0+4

• REFACTOR: minor lints and refactors. (5ab9af70)

0.3.0+3

• Update a dependency to the latest release.

0.3.0+2

• Update a dependency to the latest release.

0.3.0+1

• Update a dependency to the latest release.

0.3.0

Note: This release has breaking changes.

• REVERT: local version. (e948477a)
• FIX: #68. (1b30c879)
• FIX: update oidc_web_core version. (2717b23c)
• DOCS: update oidc_web_core readme. (7a2a3f12)
• BREAKING FIX: Opening in new tab not working reliably in Safari for iOS #31. (2e30028b)

0.2.0

Note: This release has breaking changes.

• FIX: #68. (1b30c879)
• FIX: update oidc_web_core version. (2717b23c)
• DOCS: update oidc_web_core readme. (7a2a3f12)
• BREAKING FIX: Opening in new tab not working reliably in Safari for iOS #31. (2e30028b)

0.1.0+1

• feat: initial release