Fix fatal error on the authorization form when the current user cannot be determined
Fix user detection on the authorization form by calling wp_get_current_user() instead of relying on the global variable
Modernize codebase with namespaces, an autoloader and a new folder structure (all global functions keep working)
4.6.0
Add FedCM (Federated Credential Management) support
Fix critical error when client is not found in the taxonomy
Raise minimum required PHP version to 7.4
4.5.5
Security: Fix CSRF vulnerability in authorization endpoint
Security: PKCE mandatory in the IndieAuth spec is no longer optional in the plugin. If your client does not support this security measure then updates must be made.
4.5.4
Fix error on settings page reported via wordpress.org forums
4.5.3
Fix issue with uninitialized variables
4.5.2
Fix issue with loop on adding new clients
Store client_uri and last modified date for new clients.
4.5.1
Fix issue with failure if logo_uri is not a URL
Fix conflict with Jetpack plugin due not returning error property (props @janboddez)
4.5.0
Remove experimental manifest searching code for client discovery
Add support for client json metadata files recently added to specification with fallback to MF2 HTML
Fix declaration issue(props @janboddez)
4.4.2
Prevent returning 401 for other successful OAuth2 plugins
4.4.1
Add MF2 Parser for Client Information Discovery
Fix ticket endpoint and add additional checks
Fix issue with discovery not checking html links if there were any http links
Rearrange so each endpoint is more independent and registers its own parameters
Add way to register new grant types.
Rewrite Web Signin to support latest version of flow.
Add PKCE support to websignin flow
Fix issue with PKCE support where it would not actually verify PKCE for token flow because PKCE is optional
Invert PKCE message to highlight when PKCE is not being used over it being used.
Do not do client discovery on a non-retrievable URL
Validate identifiers to IndieAuth Spec
Remove URL plus password login as part of effort to simplify code.
Fix error message surfacing in websignin form
Fix CSS on websignin and authorization forms to not misrender the language bar.
4.3.0
Introduce Client Taxonomy to store client data so it is not stored individually
Sideload Client Application icons
4.2.1
Fix issue with not loading User Token library with old remote endpoint code
Fix issue with not loading metadata endpoint when not logging in
4.2.0
Add Server Metadata Endpoint
Add Issuer Property to Authorization Response
In 4.1.0, introspection endpoint was introduced and shared an endpoint with the token endpoint. This approach was abandoned with the metadata endpoint and the introspection endpoint no longer shares. As this was only in for a short time deprecation is immediate.
Revocation endpoint added. Old revocation method will remain until metadata endpoint adoption is sufficient.
User Info Endpoint added. This returns the user profile offered during the authorization flow.
4.1.1
Fix issue where class from ticket auth was being called even though ticket auth was not enabled.
4.1.0
Add experimental ticket auth endpoint
Bug fix on endpoint discovery discovered during ticket auth development
Introduce Token Introspection Endpoint as per proposal to integrate RFC7662. For now, will exist concurrently with the older token verification response until it is deprecated.
Ensure profile responses are returned when appropriate.
Misc Bug Fixes discovered in unit testing
Updating of settings configuration
Improved default for user who gets to identify as root of site.
Introduce Refresh Token Functionality
Create was not pre-checked in new selections when offered as an option.
4.0.0
Add default expiry time.
Ensure tokens expire at their proper time.
Cleanup related to expiry
3.6.2
Fix missing argument, props @chee
Fix issue with new sanitization, props @akirk
Fix issue with improperly encoded HTML in JSON
Switch test token to mirror length of real token to properly test servers who may use mod_security.
3.6.1
Clean up template pages in order to remove HTML from i18n strings.
3.6.0
Adopt changes to the living spec as of the November 26, 2020 version.
Drop explicit support for response_type=id. Endpoint will convert to type code for backcompat until further notice.
Change experimental profile return behavior to match newly documented behavior in spec.
Support profile and email scopes, to be handled within this plugin.
Add additional code comments
Remove unique URL code as looking for user URLs is no longer supported
Add UUID to tokens as used in the WP5.6 Application Password feature.
Add Last IP Accessed to storage as used in the WP5.6 Application Password feature.
3.5.1
Make Site Health More Explicit
Update scope descriptions
Adjust scope capabilities to be more consistent
3.5.0
Restore ability to use a remote endpoint but keep this feature hidden for now.
Add load function and config setting in order to load the files appropriate for your configuration
Create Authorization plugin base class that can be used to create different IndieAuth configurations
Add Site Health Check for SSL and Unique Users
Create local and remote classes that can be instantiated depending on configuration
3.4.2
Repair issue with other flow caused by function name issue
3.4.1
Add setting to set the user who will be using the site URL as their URL as opposed to their author URL which removes dependency on Indieweb plugin for this.
3.4.0
Enforce unique URLs for user accounts
Add user url to user table
Redo association for URL to user account. At this time, only the root path and the author archive URLs are allowed as a return. Hoping to add more options in future
Add Site Health Check
Improve text and links for authorization failure
3.3.2
Add new diagnostic script that will nag you until you run it at least once
Add cache control headers on return from endpoint
Verifying the token at the token endpoint did not use REDIRECT_HTTP_AUTHORIZATION now added
Add header check to settings page
Add option to generate tokens on the backend with any scope
Add option to bulk expire tokens
Add cleanup option
3.3.1
Add definition of profile scope
Improve documentation in README
3.3
Switch to SHA256 hashing from built in salted hash used by WordPress passwords
Add PKCE Support
3.2
Only add headers to front page and author archive pages
Return basic profile data in returns so the client can display the name and avatar of the user
3.1.11
Fix issue with silent conversion when not array
Add client name and icon automatically on setting token
3.1.10
Fixed PHP notice with icon determination
Silently convert requests for the post scope to the create update scope
Update tagline
3.1.9
Fixed PHP warnings
3.1.8
When local verification is performed the code was not updating the profile URL and passing through the URL from the original request. This code was in the remote verification portion of the token endpoint and is now mirrored in the verify local code.
3.1.7
Add authdiag.php script written by @Zegnat
3.1.6
Add ability to generate a token on the backend
Added a test endpoint that tests whether the authentication provider for the REST API is working and tries to return useful errors
3.1.5
Add Client Information Discovery to search for names and icon for clients
Add icon and client name to Manage Token page
Add action to refresh icon and other information in the Manage Token interface
3.1.4
Rearrange token logic so that if a token is provided the system will fail if it is invalid
Add last accessed field to token and add that to token management table
3.1.3
Allow selection of scopes and add stock descriptions
Update Manage Token Page to use WP_List_Table
3.1.2
Fix issue with scope encoding
Fix issue where function returned differently than parent function
3.1.1
Fixed PHP error with version < PHP 5.4
3.1.0
Fixed state param handling
3.0.4
Fixed admin settings
3.0.3
Verify user ID directly from the token endpoint rather than mapping URL.
Display $me parameter instead of user_url on authenticate screen
Remove deprecated functions and parameters
3.0.2
Automatically rewrite local URLs to https if the local site is site to SSL
3.0.1
In previous version fixed issue where error message was not returned if there was a missing bearer token. This was needed due fact that some servers filter tokens. However, this meant that it would do this for all API requests, even ones not requiring authentication such as webmentions. Reverted change with flag
Added constant INDIEAUTH_TOKEN_ERROR which if set to true will return an error if it cannot find a token.
3.0.0
Major refactor to abstract out and improve token generation code
Set one cookie with the state instead of multiple cookies.
Store other parameters as a transient
Remove extra settings
2.1.1
Bug Fix
2.1.0
Refactor to change load order
Textual fix
Add defaults when core functions not yet enabled
Rework of the admin-interface
2.0.3
Add improved getallheaders polyfill
Check for missing cookie
Check for alternate authorization location
2.0.2
If using local endpoint verify token locally without making remote call
Add filters for scope and response so they can be accessed elsewhere
urlencode state as some encode information into state that was being lost
Switch from failure to warning message for different domains for redirect
Hide token endpoint management page if local endpoint not enabled
2.0.1
Improve error handling if null endpoint sent through
Adjust cookie to GMT
Add whitepace to form
2.0.0
Support author profiles in addition to user URLs
Change token verification method to match current Indieauth specification
Add support for token verification to act as a WordPress authentication mechanism.
Add ability to set any token or authorization endpoint
Add authorization and token endpoint headers to the site
Discover and use authorization endpoint for provided URL when logging in
Allow login using URL
Add built-in token endpoint ( props to @aaronpk for support on this )
Add built-in authorization endpoint ( props to @aaronpk for support on this )
Hide option to login with your domain by default
Option to sign into your domain is now a separate form
