supertokens-website - npm Package Versions

[8.1.0] - 2021-06-25

Added:

• SESSION_CREATED event, which can be consumed by onHandleEvent

Fixed:

• If a new session is created, and we try and fetch userId or jwtPayload before the frontToken is set, then it would throw an error. However, now we wait for the frontend token to be set / removed and then return the requested information.
• Fires UNAUTHORISED event before attempting to refresh if we know that a session does not exist.
• Fires SIGN_OUT event when signOut is called and a session doesn't exist.

Refactor:

• Removes use of addedFetchInterceptor in fetch.ts

[8.0.0] - 2021-06-06

Added:

• Recipe interface that can be overrided
• preAPIHook and onHandleEvent functions

Changed:

• sessionScope is a now a string

Removed:

• Backward compatibility with cross domain localstorage
• Removes setAuth0API, getAuth0API and getRefreshURLDomain functions.
• Removed refreshAPICustomHeaders and signoutAPICustomHeaders from config. Use preAPIHook instead.

[7.2.2] - 2021-06-14

Fixes:

• Pushes new version to show this version as latest in npm

[7.2.1] - 2021-06-11

Fixes:

• Fixes issue https://github.com/supertokens/supertokens-node/issues/134

[7.2.0] - 2021-06-05

Added:

• Allow specifying of cookieDomain in config to add interceptors to multiple API subdomain: https://github.com/supertokens/supertokens-website/issues/58

[7.1.1] - 2021-05-31

Fixed:

• Fixes .d.ts file to allow all styles of imports

Added:

• Adds a ts testing file in test folder.

[7.1.0] - 2021-05-11

Added:

• Support for sessions if used within an iframe: https://github.com/supertokens/supertokens-website/issues/53

[7.0.1] - 2021-05-07

Fixed:

• https://github.com/supertokens/supertokens-website/issues/50: originalFetch was being assigned twice such that the the refresh call was calling it too, resulting in a refresh inside a refresh -> deadlock
• When fetching the idRefreshToken from the frontend, if the backend is not working, we assume that the session doesn't exist.

[7.0.0] - 2021-05-01

Changed:

• Uses frontend set cookies instead of localstorage so that sub domain session works on Safari
• Sends rid on each request - acts as a CSRF protection measure (see https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#use-of-custom-request-headers)
• Refreshes session if the frontend set cookies are deleted (due to privacy features in Safari).
• New FDI 1.8