7.1.1

Fixed

• No longer set a WWW-Authenticate header for invalid clients if the client did not send an Authorization header in the original request (PR #902)

7.1.0

Changed

• Changed hint for unsupportedGrantType exception so it no longer references the grant type parameter which isn't always expected (PR #893)
• Upgrade PHPStan checks to level 7 (PR #856)

Added

• Added event emitters for issued access and refresh tokens (PR #860)
• Can now use Defuse\Crypto\Key for encryption/decryption of keys which is faster than the Cryto class (PR #812)

7.0.0

Merge pull request #854 from Sephster/master

Version 7

6.1.1

• Removing check on empty scopes

6.1.0

• Changed the token type issued by the Implicit Grant to be Bearer instead of bearer. (PR #724)
• Replaced call to array_key_exists() with the faster isset() on the Implicit Grant. (PR #749)
• Allow specification of query delimiter character in the Password Grant (PR #801)
• Add Zend Diactoros library dependency to examples (PR #678)
• Can set default scope for the authorization endpoint. If no scope is passed during an authorization request, the default scope will be used if set. If not, the server will issue an invalid scope exception (PR #811)
• Added validation for redirect URIs on the authorization end point to ensure exactly one redirection URI has been passed (PR #573)

5.1.6

• Add toggle to disable key permissions check. (Issue #776)

6.0.2

• An invalid refresh token that can't be decrypted now returns a HTTP 401 error instead of HTTP 400 (Issue #759)
• Removed chmod from CryptKey and add toggle to disable checking (Issue #776)
• Fixes invalid code challenge method payload key name (Issue #777)

5.1.5

To address feedback from the security release the following two changes have been made:

• If an RSA key cannot be chmod'ed to 600 then it will now throw a E_USER_NOTICE instead of an exception.
• Not using the new encryption key method on AuthorizationServer will set throw an E_USER_DEPRECATED message instead of an error.

6.0.0

• Breaking change: The AuthorizationServer constructor now expects an encryption key string instead of a public key
• Remove support for HHVM
• Remove support for PHP 5.5

5.1.4

• Fixed multiple security vulnerabilities as a result of a security audit paid for by the Mozilla Secure Open Source Fund. All users of this library are encouraged to update as soon as possible to this version or version 6.0 or greater.
  • It is recommended on each AuthorizationServer instance you set the setEncryptionKey(). This will result in stronger encryption being used. If this method is not set messages will be sent to the defined error handling routines (using error_log). Please visit this page for more information - https://oauth2.thephpleague.com/v5-security-improvements/
• TravisCI now tests PHP 7.1 (Issue #671)
• Fix middleware example fatal error (Issue #682)
• Fix typo in the first README sentence (Issue #690)
• Corrected DateInterval from 1 min to 1 month (Issue #709)