Bugfix

node

• The refreshTokens function no longer overrides the token type to default to DPoP, and keeps the token type consistent:
  the resulting SessionTokenSet will be DPoP-bound or not depending on the input SessionTokenSet

Full Changelog: v3.1.0...v3.1.1

New feature

browser and node

• Session::login now supports an additional customScopes: string[] option.
  It allows developers to specify custom scopes to be added to the authorization request,
  which will be presented to the user by their OpenID Provider on the consent
  prompt. If they consent, the issued ID Token may include additional claims based
  on the requested scopes.

Full Changelog: v3.0.0...v3.1.0

Breaking Changes

• Support for Node.js v18.x has been dropped as that version has reached end-of-life.

Bugfix

browser and node

• Fixes #3927: Fixed the usage of client information from previous dynamic registration that have no expiration date.

New Contributors

• @koca2000 made their first contribution in #3974

Full Changelog: v2.5.0...v3.0.0

Feature

node

• Added a logout function in the token management API that enables RP-initiated logout for multi-user server-side applications. This complements the refreshTokens function introduced in 2.4.0, allowing applications that manage tokens in external storage to both refresh tokens and perform identity provider logout without requiring a Session object. Applications can now implement complete user authentication lifecycle management using token sets stored in their own database.
• Added a EVENTS.AUTHORIZATION_REQUEST (authorizationRequest) event that emits authentication state during login to support clustered deployments.
• Added a static Session.fromAuthorizationRequestState() method that creates a new session from previously stored authentication state.

Full Changelog: v2.4.1...v2.5.0

Bugfix

node

• refreshTokens had a bug causing an unexpected refresh token rotation if the ID token expired,
  resulting in the stored token being stale.

Full Changelog: v2.4.0...v2.4.1

New Features

node

• Added a EVENTS.NEW_TOKENS (newTokens) event to be emitted by the Session when it receives new tokens when a session is initially
  logged in or refreshed. This event is more useful than EVENTS.NEW_REFRESH_TOKEN which is being deprecated.
• Added a static Session.fromTokens(tokens, sessionId) method that creates a new authenticated session directly from a token set, without requiring a full login flow.
• Added a new function refreshTokens to refresh tokens obtained via the newTokens event after the Access Token expired.

Bugfix

browser and node

• Fix the Session error listener typing by adding Error to the errorDescription type so that it reflects the actual behavior.
  Thanks to @NoelDeMartin for fixing this issue.
• Previously, an application could end up in a bad state when using a dynamically registered
  client identity beyond its expiration date. A user would be redirected to the OpenID Provider,
  and end up on an error page unrelated to the application they were trying to log into. Now,
  expired dynamic clients go through registration again: the user will need to authorize the client
  after expiration, but will not experience further inconveniences.

What's Changed

Full Changelog: v2.3.0...v2.4.0

Deprecation notice

• A new signature is introduced for getSessionFromStorage in this release. The legacy signature is
  deprecated, and could be removed with the next major release.

// Deprecated signature
const session = await getSessionFromStorage(
  sessionId,
  storage,
  onNewRefreshToken,
  refresh,
);
// Replacement signature
const session = await getSessionFromStorage(sessionId, {
  storage,
  onNewRefreshToken,
  refresh,
});

Bugfix

node

• The session expiration date (session.info.expirationDate) is now correct when loading a Session from storage.

Feature

node

• It is now possible to build a Session using getSessionFromStorage and not log it in
  using its refresh token. To do so, a new refresh optional flag has been introduced.
  It defaults to true, which makes this a non-breaking change. In addition, a new signature
  is introduced to make it easier to provide the optional arguments:

// Legacy signature only specifying one optional argument
const session = await getSessionFromStorage(
  sessionId,
  undefined,
  undefined,
  false,
);

// New signature
const session = await getSessionFromStorage(sessionId, { refresh: false });

Full Changelog: v2.2.7...v2.3.0

Bugfix

node

• The IdP logout no longer fails in Node if the session was restored from
  storage (using getSessionFromStorage), which is the typical way server-side
  sessions are retrieved.

Full Changelog: v2.2.6...v2.2.7

node and browser

• Repository URL in package.json updated to set the repository.type property to git. This intends at
  restoring the previous behavior of npm view @inrupt/solid-client-authn repository.url, expected to return
  git+https://github.com/inrupt/solid-client-authn-js.git.

Full Changelog: v2.2.5...v2.2.6

New Features

• Node 22 is now supported

Full Changelog: v2.2.4...v2.2.5