Release 14.0.2

• Disable id_token time validation
  • PR

Release 14.0.1

• Fix regression in the check session service
  • PR

Release 14.0.0

In this version the APP_INITIALIZER was removed. (See PR).
The library will not do anything until the application interact with it. There is no pre-loading of anything and it does not affect your application's bootstrapping process at all.
You can however explicitly preload the secure token server well-known endpoints with a new method called preloadAuthWellKnownDocument(). As a side effect because the config has to be loaded first, a lot of APIs become reactive and return an Observable now.

See the migration guide.

• refresh token rotation is now optional and can be activated using allowUnsafeReuseRefreshToken
  • PR
• Fixed getUrlParameter's handling of fragment response
  • PR
• isLoading observable in OidcSecurityService
  • PR
• Add redirectUrl customization (via AuthOptions)
  • PR
• Fix: implicit flow in popup window error (fixes #1385)
  • PR
• Enhancement: Improved abstract services
  • PR
• Remove double quotes in info messages
  • PR
• Enhancement: Added auth result
  • PR

Release 13.1.0

• Using window.crypto for jwt signature validation
• Removed jsrsasign dependency
  • PR

Release 13.0.0

Support for Angular 13

Release 12.0.3

• docs(guards): use UrlTree for redirect, clean up
  • PR
• fixing storage mechanism
  • PR
• Additional logging when a nonce is created and validated
  • PR

Release 12.0.2

• Added fix overwriting prompt param
  • PR
• Unclear error message when providing improper config to module
  • PR
• added multiple configs documentation
  • PR
• Expose PopupService and PopupOptions as public
  • PR
• Support end session for Auth0 (non conform OIDC endpoint)
  • PR

Release 12.0.1

Fix #1168 userInfoEndpoint Typo

Release 12.0.0

• Configuration via forRoot(...) method #747 | PR #1041
• Remove the "AuthorizedState" enum in Version 12 #755 | PR #1062
• Use a different key than redirect to store redirect route when using auto-login #1060 | PR #1067
• Return value of loginWithPopup and login should be the same #1048 | PR #1066
• How to provide client id during logoff #932 | PR #1069
• urlHandler callback function parameter in LogoffRevocationService.logoff does nothing #966 | PR #1069
• Convert all instances of "Authorized" to "Authenticated" #1088 | PR #1085
• Support for multiple APIs with unique scopes #885 | PR #1085
• Multiple access tokens for the same client_id but different scopes #620 | PR #1085
• Is there a silent renew event？#1011 | PR #1085
• Angular 12 Support #1096 | PR: #1112
• Testing & Coverage
• Improve documentation
• Add configuration to disable or enable id_token expired check #1113
• Support for Azure B2C multiple policies #802 | PR #1085
• Improve AutoLoginSample #1138
• Accessing AuthResult response object #536
• Improved Auto guards
• renamed stsServer configuration to authority
• Only one returntype (object) when subscribing to isAuthenticated and userdata to avoid confusion. #1164

Release 11.6.11

• Silent renew does not always start
  • PR