Skip to content

Releases: ramosbugs/oauth2-rs

2.0.0-alpha.2

07 Aug 02:49
Compare
Choose a tag to compare
2.0.0-alpha.2 Pre-release
Pre-release

Minor fixes:

  • Make BasicAuth URL-encode client ID and secret (#41)
  • Fix Display + Fail derivation for RequestTokenError<T>
  • Run rustfmt +nightly

2.0.0-alpha.1

01 Jun 02:45
Compare
Choose a tag to compare
2.0.0-alpha.1 Pre-release
Pre-release

Unstable release following major rewrite: this release includes breaking changes!

  • Adds extensibility to support arbitrary OAuth 2.0 extensions in the
    future without having to break backward compatibility again. This is
    primarily accomplished through traits and generics (Resolves #27).
  • Improves adherence to the OAuth 2.0 spec (RFC 6749):
    • Requires access token responses to be JSON-encoded, dropping support
      for form-encoded responses. Also adds the HTTP request header
      "Accept: application/json" to ensure that loosely compliant OAuth2
      implementations such as GitHub's return a JSON response (Resolves #33).
    • Fixes the access token error response types enum to follow Section
      5.2 of the spec instead of 4.2.2.1, which is for the Implicit Grant
      flow only. The Implicit Grant errors are only seen by the browser,
      and not by client applications that would be using this library.
    • Fixes parsing of the "scope" token response field, which is a
      space-delimited string instead of a JSON array of strings.
    • Removes the "state" field from the token error response, which is not
      defined in Section 5.2 of the spec. This field is only returned by
      earlier steps in the OAuth2 flows.
    • Only parses the access token response as an error if the client
      receives a non-200 HTTP response code. Section 5.2 of the spec defines
      the expected response code as 400 Bad Request.
    • Uses HTTP Basic Auth for client authentication by default, rather
      than including the client_id and client_secret in the request body.
      This matches the recommendation in Section 2.3.1 of the spec.
  • Slightly improves the usability of the library
    • Renames the main struct from Config to Client.
    • Makes the "state" parameter mandatory unless the "insecure" module is
      used (Fixes #28). This is critical to protect clients against CSRF.
    • Improves the documentation to more closely refer to the spec.
    • Improves the examples to include CSRF protection.
  • Adds stronger typing using the NewType pattern

1.3.0

10 Mar 20:18
0282bb6
Compare
Choose a tag to compare

1.2.1

31 Jan 22:09
Compare
Choose a tag to compare
  • Added the Serialize trait on Token, TokenError and friends, in case you want to serialize it in your app.

1.2.0

31 Jan 22:03
Compare
Choose a tag to compare
  • Allow using basic auth to pass client_id and client_secret. Thanks @euank
  • Pass the scope for the client credentials grant type. Thansk @euank
  • Parse errors even for non-200 status codes. Thanks @andor44

1.1.2

10 Aug 13:50
Compare
Choose a tag to compare
  • Allow passing authorization URLs with query parameters (without resetting the query parameters beforehand).

Thanks to @KeenS

1.1.1

09 Aug 17:48
Compare
Choose a tag to compare
  • Implemented the std::error::Error trait for TokenError. The description of the error is the display value of ErrorType (e.g. invalid_request, unauthorized_client etc.)

Thanks to @KeenS

1.0.1

21 Jul 19:07
Compare
Choose a tag to compare
  • Fixed a bug when setting multiple scopes: the separator should be a single whitespace, not a comma.

1.0.0

21 Jul 19:06
Compare
Choose a tag to compare
  • A big rewrite: see the docs for more details.