[github-actions]

v0.9.0 is the next minor release.

Timetable: to be announced.

👉 Changelog

compare changes

⚠️ Breaking

• session: __Host- prefixed default cookie names (af4f91d)
• session: symmetric JWE session keys with a rotation set (d341a77)
• a key lookup returns a key or throws (8428df0)
• key lookups take one argument (cd69008)
• session: rename the key lookup hooks to onKeyLookup (d3f8e4d)
• session: keep the Web driver's state under context.unjwt (0f14500)
• remove the Elysia adapter (819638d)
• adapters: remove createJWSSession and createJWESession (ab9c70d)
• remove the h3 adapters (b6c7837)
• remove the deprecated utils, jws, jwe and jwk aliases (a8e8cd5)
• drop allowSymmetricJWKSet (3511c0d)

🚀 Enhancements

• docs: automd regions over the examples directory (74694bd)
• session: remember how the read ended (43ff9fb)
• session: keep the cookie when a read fails (eaef2f5)
• session: rotate HMAC secrets with a key set (6a5fad8)
• session: one candidate path for rotation sets (edeac83)
• session: export the JWE session key types (cef42eb)
• session: expose the token source on the session (58d2d5b)
• session: decide the token source once at the gate (c71c35b)
• share one key-attempt budget across a multi-recipient call (5162c9a)

🩹 Fixes

• session: a key the lookup returns that cannot be used is a read failure (3ce8a27)
• session: the definition's token is the transport's view (2d72ee2)
• a key lookup may return undefined for no key (ece9d12)
• session: refuse a public half that cannot verify the issuing key (79d4cc5)
• session: a pair takes its algorithm from the issuing half (c928454)
• jws: infer the signing algorithm from the key's curve (293b5db)
• session: let onKeyLookup return every key shape key takes (90ffa2a)
• session: cap the candidates a kid-less key can meet (4809c71)
• session: align the JWS and JWE key rules (032b7b5)
• session: accept every algorithm the key set can serve (51b31ad)
• session: refuse a silent key without its algorithm at definition (d7a9b40)
• session: roll cookie sessions only (80c653b)
• report a lone entry's failure directly in a multi call (a76738f)
• session: refuse a pinned algorithm the key cannot serve (534d56c)
• jwk: check keyUsage when deriving a key from a password (9a057c4)
• jwk: infer the unwrapped key algorithm for every unwrapping algorithm (90d4966)
• jwk: report a missing keyLength as ERR_INVALID_OPTION (cadff9e)
• aggregate the per-entry failures of a multi call (978fbde)
• refuse claim and time options that a non-JSON payload cannot honour (a321412)
• jwk: accept OKP keys in deriveSharedSecret types (3de763a)
• session: default the definition event to WebSessionEvent (eb1ac7a)
• session: check the config when the session is defined (e77c234)
• session: type the onExpire error as JWTError (796820f)
• jwk: wrap a failed key agreement in ERR_JWK_INVALID (97a2292)
• report a missing key as ERR_JWK_INVALID (90d1cd5)
• jwk: refuse an alg hint the key type cannot serve (e569aad)
• keep a present iat of 0 (7409482)
• session: empty the session when onRead throws (456376f)
• session: default JWS session cookies to HttpOnly (8f3819c)
• infer only the wrapping algorithm from an AES CryptoKey (8567c45)

💅 Refactors

• session: rotate keys through onKeyLookup (efa1cb1)
• session: open rotation sets through the core key set (b8ebe8f)
• session: fold the hook arguments and request state into the core (d0db18c)
• session: issue the token where the session is already held (1bfca8c)
• adapters: share the per-request session state with the Web driver (b93188c)
• session: read the header only when sessionHeader names it (4516fae)

📖 Documentation

• the session reports how its read ended (5db6c51)
• read failures, the two token views and the Nitro release candidate (2d19e59)
• a lookup returns undefined when it has no key (082acc6)
• a lookup returns a key or throws, a pair verifies what it issues (cdc1623)
• follow the lookup shape, curve inference and pair rule (dbb28c1)
• rotate session keys through onKeyLookup (f479294)
• add direct token access examples (8347153)
• note the Web driver's context slot (21aea22)
• describe the token source and sessions without cookies (489d84c)
• reword the PBES2 budget row (69b0ce3)
• rewrite the JWK section (83399ca)
• rewrite the recipes as framework walkthroughs (2b0422d)
• rewrite the safety and DPoP pages (0444234)
• rewrite the sessions section (b592c92)
• rewrite the JWS and JWE sections (f90843c)
• rewrite the getting started section (a26f83f)
• session: Nitro sends errHeaders too (711a723)
• session: state which token the definition returns (4d090fe)
• session: state what update and clear reach per source (c58e792)
• correct the p2s note and the session key message (3ef76d1)

🏡 Chore

• unify pnpm workspace (9ee54c8)

❤️ Contributors

• Sandro Circi (@sandros94)

[netlify]

✅ Deploy Preview for unjwt canceled.

Name	Link
🔨 Latest commit	954449f
🔍 Latest deploy log	https://app.netlify.com/projects/unjwt/deploys/6ae816bd859a3bf631353d6e

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/sandros94/unjwt@42

commit: 954449f