openid-client - npm Package Compare versions

Comparing version 1.7.1 to 1.7.2

CHANGELOG.md

@@ -22,6 +22,13 @@ # openid-client CHANGELOG
 ## Version 1.7.0
-- [DIFF](https://github.com/panva/node-openid-client/compare/v1.6.4...v1.7.0)
+### Version 1.7.2
+- [DIFF](https://github.com/panva/node-openid-client/compare/v1.7.1...v1.7.2)
+- added missing check for webfinger issuer location protocol
+
+### Version 1.7.1
+- [DIFF](https://github.com/panva/node-openid-client/compare/v1.6.4...v1.7.1)
 - added authorizationCallback support for submitting code_verifier
 - example now includes session management OP and RP frames
 
+1.7.0 failed to publish properly, use 1.7.1 instead
+
 ## Version 1.6.0
@@ -28,0 +35,0 @@ ### Version 1.6.4

lib/issuer.js

@@ -160,5 +160,6 @@ 'use strict';
       .then((body) => {
-        const foo = _.find(body.links, link => typeof link === 'object' && link.rel === REL && link.href);
-        assert(foo, 'no issuer found in webfinger');
-        const expectedIssuer = foo.href;
+        const location = _.find(body.links, link => typeof link === 'object' && link.rel === REL && link.href);
+        assert(location, 'no issuer found in webfinger');
+        assert(typeof location.href === 'string' && location.href.startsWith('https://'), 'invalid issuer location');
+        const expectedIssuer = location.href;
         if (registry.has(expectedIssuer)) return registry.get(expectedIssuer);
@@ -165,0 +166,0 @@

package.json

 {
   "name": "openid-client",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "OpenID Connect Relying Party (RP, Client) implementation for Node.js servers, supports passportjs",
@@ -5,0 +5,0 @@ "main": "lib/index.js",

No alert changes

Improved metrics

Total package byte prevSize

71868

increased by0.52%

Lines of code

1378

increased by0.07%

No dependency changes