2.0.0

Promote 2.0.0-beta.3 to 2.0.0.

3.0.0-alpha.3

• Remove PartialEq derivations on secret types (unsafe, non-constant-time comparisons vulnerable to timing attacks)
• Remove some unnecessary trait bounds
• Derive Clone for StandardTokenReponse
• Add request_async API for non-code flows
• Derive Eq and Hash for String new types
• Have StandardTokenResponse::set_expires_in take Duration for consistency
• Add example for a non-spec-compliant provider

2.0.0-beta.3

• Derive Eq, Hash for String new types

3.0.0-alpha.2

Security patch

The 3.0.0-alpha.1 release included a new HTTP client that utilizes the reqwest crate. By default, reqwest follows HTTP redirects. This allows a malicious OAuth2 authorization server to redirect token endpoint requests to arbitrary URLs, including internal addresses reachable from the client. Such a redirect can be used to mount an SSRF attack.

Versions prior to 3.0.0-alpha.1 are not affected. Users of 3.0.0-alpha.1 are encouraged to upgrade to 3.0.0-alpha.2 or a newer release and are discouraged from using any alpha release in a production environment.

Thanks to @d0nutptr for helping to discover this issue!

3.0.0-alpha.1

Experimental new API with support for asynchronous requests and arbitrary HTTP clients.

This release features significant breaking changes from the 2.x release branch:

• Authorization and token exchange requests now use the builder pattern.
• curl and reqwest are included as HTTP clients; users may implement their own (passed to request or request_async for each token exchange).
• The insecure module has been removed.

2.0.0-beta.2

• Move rand pin to 0.6
• Add public methods for instantiating TokenResponse and ErrorResponse.

2.0.0-beta.1

The 2.x API is now stable! No further breaking changes are expected until a future 3.x release.

This release is a promotion of 2.0.0-alpha.5 to being API stable. It contains no additional changes.

2.0.0-alpha.5

• Derive Clone for TokenResponse and ErrorResponse
• Have CsrfToken::new_random use URL-safe base64 encoding
• Convert TokenResponse to a trait
• Add exchange_refresh_token_extension for wider refresh token support

2.0.0-alpha.4

• Make CsrfToken and AuthorizationCode (de)serializable.

2.0.0-alpha.3

• Add PKCE support
• Avoid serializing None fields
• Add scopes to password grant