update ChangeLog

Signed-off-by: Hans Zandbelt <[email protected]>
OpenIDC · Oct 31, 2023 · cf4b650 · cf4b650
1 parent c5a72a6
commit cf4b650
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -4,8 +4,8 @@
 - remove obsolete support for Token Binding https://www.rfc-editor.org/rfc/rfc8471.html (id_token, access_token, session cookie)
 - use only the User-Agent header as input for the state browser fingerprinting by default (no X-Forwarded-For)
   as cloud environments increasingly use dynamic proxy IPs in front
-- use PKCE S256 by default
-  
+- use PKCE S256 by default; disable by configuring "OIDCPKCEMethod none"
+
 10/30/2023
 - do not apply logout_on_error and authenticate_on_error when a parallel refresh token request is detected
   see https://github.com/OpenIDC/mod_auth_openidc/discussions/1132; thanks @esunke