openid-client - npm Package Compare versions

Comparing version 3.15.0 to 3.15.1

CHANGELOG.md

@@ -5,2 +5,11 @@ # Change Log
 
+## [3.15.1](https://github.com/panva/node-openid-client/compare/v3.15.0...v3.15.1) (2020-05-12)
+
+
+### Bug Fixes
+
+* A192CBC-HS384 and A256CBC-HS512 direct encryption key derivation ([c356bbe](https://github.com/panva/node-openid-client/commit/c356bbeaba1e28b6a56534b9ba503cb536c14d57))
+
+
+
 # [3.15.0](https://github.com/panva/node-openid-client/compare/v3.14.2...v3.15.0) (2020-04-28)
@@ -7,0 +16,0 @@

lib/client.js

@@ -1194,3 +1194,8 @@ /* eslint-disable max-classes-per-file */
 
-    const derivedBuffer = crypto.createHash('sha256')
+    const hash = len <= 256 ? 'sha256' : len <= 384 ? 'sha384' : len <= 512 ? 'sha512' : false; // eslint-disable-line no-nested-ternary
+    if (!hash) {
+      throw new Error('unsupported symmetric encryption key derivation');
+    }
+
+    const derivedBuffer = crypto.createHash(hash)
       .update(this.client_secret)
@@ -1197,0 +1202,0 @@ .digest()

package.json

 {
   "name": "openid-client",
-  "version": "3.15.0",
+  "version": "3.15.1",
   "description": "OpenID Connect Relying Party (RP, Client) implementation for Node.js runtime, supports passportjs",
@@ -5,0 +5,0 @@ "keywords": [

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

161788

increased by0.32%

Lines of code

3156

increased by0.13%

No dependency changes