All pull requests

Pull requests

• Add option to ignore JWK from JWT header

  #508·Minei3oat opened Jul 15, 2026·1 task done·

  ·

• Add support for EdDSA (#1)

  #506·alecsammon opened May 9, 2026·1 task done·

  ·

• Prevent Okta complaint: If we have a client secret and we're doing client_secret_basic, keep credentials ONLY in the Authorization header. #164

  #504·rodpayne opened Apr 6, 2026·1 task done·

  ·
  1

• Added reverse proxy support

  #503·TechnoCarte opened Apr 1, 2026·1 task·

  ·

• The code_challenge_methods_supported field is optional

  #499·EvertJanVantLand opened Jan 9, 2026·

  ·
  1

• support optional GET parameters for end_session_endpoint

  #496·bmauser opened Nov 6, 2025·

  ·

• Example 10 implementation code added

  #494·Trynomial-Solutions opened Oct 20, 2025·1 task done·

  ·

• fix: make response content type check less strict

  #493·sabadriwan opened Sep 23, 2025·1 task·

  ·

• fix: only add scope parameter if set on refreshToken (#489)

  #490·humbapa opened Jul 29, 2025·1 task done·

  ·
  1

• Refactor jwt handling

  #488·samuelwei opened Jun 24, 2025Contributor·1 task done·

  ·
  2

  2

• Fix: code style

  #487·samuelwei opened Jun 18, 2025Contributor·1 task done·

  ·
  1

• Fix: Verfify jti claim exists on backchannel logout token

  #481·samuelwei opened May 7, 2025Contributor·1 task done·

  ·

• Fix: Missing events claim check on backchannel logout

  #480·samuelwei opened May 7, 2025Contributor·1 task done·

  ·

• Parse content type on userInfo Response to allow application/jwt;charset=UTF-8

  #479·samuelwei opened May 6, 2025Contributor·1 task done·

  ·
  1

• Check subject on unsigned / unencrypted response

  #478·samuelwei opened Apr 29, 2025Contributor·1 task done·

  ·

• Fix exception when iss is missing

  #477·samuelwei opened Apr 29, 2025Contributor·1 task done·

  ·

• Verify iat on verifyJWTClaims

  #476·samuelwei opened Apr 28, 2025Contributor·1 task done·

  ·
  1

  2

• Add support for X-Forwarded-Host & X-Forwarded-Prefix Headers

  #468·calw20 opened Mar 22, 2025·1 task done·

  ·
  2

• Avoided duplicates in scopes

  #467·daniele-andriani-io opened Mar 19, 2025·

  ·
  5

• fix: Remove urlencode from Basic Authentication header construction

  #466·ovsep404 opened Mar 13, 2025·

  ·
  1

  12

• Add redirect_uri in refreshToken parameters

  #455·jsimonet-caldera opened Jan 8, 2025·

  ·
  1

• Validate state before ID Token request

  #447·ricklambrechts opened Sep 30, 2024Contributor·1 task done·

  ·
  2

• Split up authenticate() into individual actions to allow per-action use

  #436·bartgloudemans opened Sep 12, 2024·2 tasks done·

  ·
  7

• Feat/aws cognito logout

  #421·thiagomdiniz opened May 28, 2024·1 task·

  ·
  1

• Support for mTLS

  #420·ricklambrechts opened May 26, 2024Contributor·1 task·

  ·
  4