league/oauth2-server

• Fix for determining access token in header (Issue #328)
• Refresh tokens are now returned for MAC responses (Issue #356)
• Added integration list to readme (Issue #341)
• Expose parameter passed to exceptions (Issue #345)
• Removed duplicate routing setup code (Issue #346)
• Docs fix (Issues #347, #360, #380)
• Examples fix (Issues #348, #358)
• Fix typo in docblock (Issue #352)
• Improved timeouts for MAC tokens (Issue #364)
• hash_hmac() should output raw binary data, not hexits (Issue #370)
• Improved regex for matching all Base64 characters (Issue #371)
• Fix incorrect signature parameter (Issue #372)
• AuthCodeGrant and RefreshTokenGrant don't require client_secret (Issue #377)
• Added priority argument to event listener (Issue #388)

• Docblock, namespace and inconsistency fixes (Issue #303)
• Docblock type fix (Issue #310)
• Example bug fix (Issue #300)
• Updated league/event to ~2.1 (Issue #311)
• Fixed missing session scope (Issue #319)
• Updated interface docs (Issue #323)
• .travis.yml updates

• Remove side-effects in hash_equals() implementation (Issue #290)

• Changed symfony/http-foundation dependency version to ~2.4 so package can be installed in Laravel 4.1.*

• Added MAC token support (Issue #158)
• Fixed example init code (Issue #280)
• Toggle refresh token rotation (Issue #286)
• Docblock fixes

• Prevent duplicate session in auth code grant (Issue #282)

• Ensure refresh token hasn't expired (Issue #270)

• Fix bad type hintings (Issue #267)
• Do not forget to set the expire time (Issue #268)

• Improved interfaces (Issue #255)
• Learnt how to spell delimiter and so getScopeDelimiter() and setScopeDelimiter() methods have been renamed
• Docblock improvements (Issue #254)

• Alias the master branch in composer.json (Issue #243)
• Numerous PHP CodeSniffer fixes (Issue #244)
• .travis.yml update (Issue #245)
• The getAccessToken method should return an AccessTokenEntity object instead of a string in ResourceServer.php (#246)

• Complete rewrite
• Check out the documentation - http://oauth2.thephpleague.com

• Support Authorization being an environment variable. See more

• Normalize headers when getallheaders() is available (Issues #108 and #114)

• Forgot to tell TravisCI from testing PHP 5.3

• Added conditional isValid() flag to check for Authorization header only (thanks @alexmcroberts)
• Fixed semantic meaning of requireScopeParam() and requireStateParam() by changing their default value to true
• Updated some duff docblocks
• Corrected array key call in Resource.php (Issue #63)

• Fixed oauth_session_token_scopes table primary key
• Removed DEFAULT '' that has slipped into some tables
• Fixed docblock for SessionInterface::associateRefreshToken()

• Renamed primary key in oauth_client_endpoints table
• Adding missing column to oauth_session_authcodes

Security

• A refresh token should be bound to a client ID

• Fixed a link to code in composer.json

• Updated README with wiki guides
• Removed null as default parameters in some methods in the storage interfaces
• Fixed license copyright

• Fixed check for required state parameter
• Fixed check that user's credentials are correct in Password grant

• Added method requireStateParam()
• Added method requireScopeParam()

• Added links to tutorials in the README
• Added missing state parameter request to the checkAuthoriseParams() method.

• Fixed the SQL example for SessionInterface::getScopes()

• Changed all instances of the "authentication server" to "authorization server"

• Fixed MySQL create table order
• Fixed version number in composer.json

• Updated AuthServer.php to use self::getParam()

• First major release