Atproto: @atproto/[email protected] Release

Minor Changes

• #3659 371e04aad Thanks @matthieusieben! - OAuthProvider will now always generate JWT access tokens. This will prevent "leaked" tokenId values from being used as access tokens directly. This change also introduces an AccessTokenMode that allows generating "stateless" tokens (when the AS and RS are different servers), or shorter "light" tokens (that only act as wrapper around tokenId values).

• #3659 371e04aad Thanks @matthieusieben! - Remove unused getAuthorizationDetails hook

• #3659 371e04aad Thanks @matthieusieben! - Change name of onSignupAttempt hook to onSignUpAttempt

• #3659 371e04aad Thanks @matthieusieben! - Store & verify new authorization requests against previously approved scopes for the same client

• #3659 371e04aad Thanks @matthieusieben! - Split oauth endpoints & authorization page routes from OAuthProvider

• #3659 371e04aad Thanks @matthieusieben! - Fix bug allowing to authenticate using previous account even if the "remember me" checkbox was left unchecked

• #3659 371e04aad Thanks @matthieusieben! - Change "brand" color to "primary"

• #3659 371e04aad Thanks @matthieusieben! - Remove instrospection endpoint

Patch Changes

• #3659 371e04aad Thanks @matthieusieben! - Security fix: Properly validate JWT exp claim when it is zero.

• #3659 371e04aad Thanks @matthieusieben! - Always log to console in dev mode

• #3659 371e04aad Thanks @matthieusieben! - Do not return invalid authorization response errors

• #3659 371e04aad Thanks @matthieusieben! - Apply time mitigation strategy on the sensitive part of the operation only.

• Updated dependencies [8b98fec88, 371e04aad, 371e04aad, 371e04aad, 26a077716, 371e04aad]:

  • @atproto/[email protected]
  • @atproto/[email protected]
  • @atproto-labs/[email protected]
  • @atproto/[email protected]
  • @atproto/[email protected]
  • @atproto/[email protected]
  • @atproto/[email protected]