v5.0.0

[panva]

⚠ BREAKING CHANGES

• The 'query' way of passing access token to userinfo was removed.
• Access Token is now asserted to be present for userinfo and requestResource calls.
• The registry export was removed.
• FAPIClient is renamed to FAPI1Client
• FAPI1Client has default algorithms set to PS256 rather than RS256
• FAPI1Client has default tls_client_certificate_bound_access_tokens set to true
• FAPI1Client has default response_types set to id_token code and grant_types accordingly
• FAPI1Client has no token_endpoint_auth_method set, one must be set explicitly
• Client methods unpackAggregatedClaims and fetchDistributedClaims were removed with no replacement.
• DPoP option inputs must be a private crypto.KeyObject or a valid crypto.createPrivateKey input.
• Issuer.prototype.keystore is now private API
• HTTP(S) request customization now only recognizes the following options 'agent', 'ca', 'cert', 'crl', 'headers', 'key', 'lookup', 'passphrase', 'pfx', and 'timeout'. These are standard node http/https module request options, got-library specific options such as 'followRedirect', 'retry', or 'throwHttpErrors' are no longer recognized.
• The arguments inside individual HTTP request customization changed, first argument is now an instance of URL, the http request options object is passed in as a second argument.
• The response property attached to some RPError or OPError instances is now an instance of http.IncomingMessage. Its body is available on its body property as either JSON if it could be parsed, or a Buffer if it failed to pass as JSON.
• Drop support for Node.js v10.x
• Only Node.js LTS releases Codename Erbium (^12.19.0) and newer are supported. Currently this means ^12.19.0 (Erbium), ^14.15.0 (Fermium), and ^16.13.0 (Gallium).
• Issuer.discover will no longer attempt to load /.well-known/oauth-authorization-server. To load such discovery documents pass full well-known URL to Issuer.discover.

Refactor

• DPoP input must be a private KeyObject or valid crypto.createPrivateKey input (d69af6f)
• FAPIClient is renamed to FAPI1Client (59a4e73)
• Issuer.prototype.keystore is now private API (0c23248)
• only use the native http(s) client (83376ac)
• remove automatic lookup of /.well-known/oauth-authorization-server (fc87d2b)
• remove client.unpackAggregatedClaims and client.fetchDistributedClaims (b7f261f)
• remove Registry public API export (6b91d58)
• remove the 'query' option for userinfo, assert access token (eb9d139)
• update Node.js semver support matrix (8b3044e)

---

This discussion was created from the release v5.0.0.

[SchroederSteffen]

Hi,
Why has the Issuer.prototype.keystore API been turned private? We're using it to retrieve the correct key for JWT validation.
Cheers,
Steffen

[panva]

Because it returned a construct specific to a dependency, in order to be able to update dependencies freely I chose to remove everything which would tie the public API to a dependency module.

[panva]

To verify JWT Tokens on a Resource Server you don't need (and should not) use the openid-client package in the first place. The following snippet does the same for you without depending on openid-client for jwks_uri resolution.

import { createRemoteJWKSet, jwtVerify } from 'jose'

const JWKS = createRemoteJWKSet(new URL('https://www.googleapis.com/oauth2/v3/certs'))

const { payload, protectedHeader } = await jwtVerify(jwt, JWKS, {
  issuer: 'urn:example:issuer',
  audience: 'urn:example:audience'
})

[SchroederSteffen]

Thanks for the quick response and suggestion @panva! 👍

[SchroederSteffen]

We used the openid-client for that, because it conveniently reads the openid-configuration for us to be prepared for changes of the jwks_uri. We will look for an alternative approach and use jose directly.

[SchroederSteffen]

Update: We ended up using jwks-rsa, because we didn't manage to just retrieve the JWK with jose as required. (We use passport-jwt that validates the JWT for us and just need to fetch the JWT in our case.)

[madaster97]

Hi there,

Do you have any advice for logging HTTP requests made with this library? Before v5, I was using Got hooks to debug any requests made, but it sounds like you removed them since that was a dependency specific construct.

Thanks,
Adam

[madaster97]

Just in case @panva - no rush just making sure you saw this.

[panva]

I have no advice on logging HTTP requests.