lexik/jwt-authentication-bundle

What's Changed

• Update 10-web-token.rst by @cosminsandu in #1235
• Test with API Platform 4 by @chalasr in #1250
• chore: add testrun for PHP 8.4. Fix implicit nullable parameter by @Chris53897 in #1238
• Fix default values in WebToken services when encryption disabled by @NeuralClone in #1225
• fix issue #1258 JWTCookieProvider does set flags cookie flags when va… by @nuryagdym in #1259
• Fix wrongly silenced signing failure by @BackEndTea in #1267

New Contributors

• @cosminsandu made their first contribution in #1235
• @NeuralClone made their first contribution in #1225
• @nuryagdym made their first contribution in #1259
• @BackEndTea made their first contribution in #1267

Full Changelog: v3.1.0...v3.1.1

What's Changed

• feature: fix deprecation of Extension by @Chris53897 in #1226

New Contributors

• @Chris53897 made their first contribution in #1226

Full Changelog: v3.0.0...v3.1.0

What's Changed

• Drop PHP <7.1 and Symfony <5.3 support by @wouter-toppy in #1056
• Clean 3.x by @maxhelias in #1108
• [3.x] Remove support for Symfony <6.4 and PHP <8.2 by @chalasr in #1202
• Fix CI on 3.x by @chalasr in #1201
• Fix ci 3x by @Spomky in #1214
• Bump the dependencies group with 2 updates by @dependabot in #1203
• CI: Fix deprecations from ApiPlatform 3.2 & PHPUnit 10 by @chalasr in #1221

New Contributors

• @wouter-toppy made their first contribution in #1056

Full Changelog: v2.21.0...v3.0.0

⚠️ This is the LAST 2.X FEATURE RELEASE ⚠️ The branch 2.x is now bugfix-only.

What's Changed

• [CI] Fixed CI for PHP 7.2 by @mnocon in #1188
• Web-Token Framework simplified by @Spomky in #1207
• feat: Invalidate a JWT token by @ldaspt in #1170
• Invalidate a JWT token - Adding the jti claim by the JWTManager class instead of doing it via a listener by @ldaspt in #1218

New Contributors

• @mnocon made their first contribution in #1188
• @ldaspt made their first contribution in #1170

Full Changelog: v2.20.3...v2.21.0

What's Changed

• Fix for PHP <7.4 compatibility by @fracsi in #1183
• Wrong type exception for AccessTokenLoader with certain configuration by @athanasius-kircher in #1184

New Contributors

• @athanasius-kircher made their first contribution in #1184

Full Changelog: v2.20.2...v2.20.3

What's Changed

• Fix for PHP <7.4 compatibility by @fracsi in #1174
• ci: Group GitHub Actions upgrades by @theofidry in #1177
• [GHA] Infra & build updates by @chalasr in #1178

New Contributors

• @fracsi made their first contribution in #1174

Full Changelog: v2.20.1...v2.20.2

What's Changed

• Removed constructor property promotion to fix compatibility with PHP 7.x by @webhdx in #1172

New Contributors

• @webhdx made their first contribution in #1172

Full Changelog: v2.20.0...v2.20.1

What's Changed

• Support Symfony 7 by @endroid in #1165
• feat: add support for partitioned cookies by @EmilePerron in #1167
• Added: JWT security scheme to openapi by @Ninos in #1159
• WebToken support integration by @Spomky in #1041

New Contributors

• @endroid made their first contribution in #1165
• @EmilePerron made their first contribution in #1167
• @Ninos made their first contribution in #1159

Full Changelog: v2.19.1...v2.20.0

What's Changed

• Fix missing array claims BC break in 2.9.0 by @ostrolucky in #1144
• add description to authentication path by @Altherius in #1149

New Contributors

• @ostrolucky made their first contribution in #1144
• @Altherius made their first contribution in #1149

Full Changelog: v2.19.0...v2.19.1

• bug #1119 Fix API Platform integration (@maxhelias)
• bug #1120 Remove deprecation symfony 6.3 (@maxhelias)
• bug #1133 Fixed issue with option user_id_claim (@koftikes)
• bug #1134 Fix ForwardCompatAuthenticatorTrait with OPCache preload (@elavrom)
• feature #1125 Allow lcobucci/jwt v5 (@maxhelias)

• bug #1115 Fix compatibility with lcobucci v3.4 (maxhelias)

• bug #1109 Replaced deprecated ValidAt() with LooseValidAt() (carcabot)
• feature #1112 Better API Platform and json_login compatibility (alanpoulain)

• bug #1110 Use the Security domain for translated messages (jderusse)
• bug #1105 Fix creation of dynamic property (SpartakusMd)
• feature #1098 Add API Platform compatibility (vincentchalamon)
• bug #1096 Test under Symfony 6.2 / PHP 8.2 (chalasr)
• feature #1092 allow environment variables for remove_token_from_body_when_cookies_used (usu)
• bug #1067 Fixes TypeError in JWTManager (magikid)
• feature #1072 Inject Clock in LcobucciJWSProvider (dbrumann)
• bug #1069 Improve user_identity_field deprecation message (lobodol)
• feature #1046 try to invalidate realpath cache if keypair loading failed (lobodol)

• feature #1037 Deprecate user_identity_field config option (chalasr)
• feature #1020 Add allow_no_expiration option to allow validating tokens without ttl (pluk77)
• bug #1019 Fix lexik#944: Separate CompatFailureResponse from FailureResponse (GErpeldinger)
• bug #1015 Fix ECDSA algo names in LcobucciJWSProvider (lovenunu)
• feature #1007 Allow for creation of tokens without exp (pluk77)
• bug #1001 Fix deprecations on Symfony 6.1 (chalasr)

## 2.15.1 (2022-04-06)

• bug #999 Unify audience claim (aerrasti)
• feature #995 Add Request object into AuthenticationFailureEvent (dmytro-shulyakov)

• feature #995 Add Request object into AuthenticationFailureEvent (dmytro-shulyakov)
• bug #982 Fix a type related depreciation with php 8.1 (RiffFred)
• feature #973 Translate message errors (flohw)
• bug #976 Fix authentication with integer as useridentifier (Floruzus)

• bug #972 Typo-Fix in the ChainUserProvider (KhorneHoly)

• feature #940 Add remove_token_from_body_when_cookies_used config option (TjorvenB)
• feature #928 Add support of multiple public keys to verify tokens with a set of keys (alexandre-daubois)
• feature #958 Allowing session cookie (split cookie) (JeremyPasco)
• bug #969 Fix PHP 8.1 deprecation - avoid passing null to is_file() (chalasr)
• bug #966 fix getIterator compatible with php 8.1 (eerison)

• bug #961 Allow symfony/deprecations-contract v3.0 (bravik)
• bug #951 Test instanceof Passport instead of more restrictive SelfValidatingPassport (TristanPouliquen)

• bug #942 Fix Symfony 5.3 compatibility (chalasr)

• feature #923 Add 3 new getter method to JWTTokenAuthenticator (fd6130)
• bug #931 Only attempt split_cookie extraction if all of the cookies are present (carlobeltrame)
• feature #925 Allow to set provider in jwt authenticator (fd6130)
• feature #937 Symfony 6 Compatibility (mbabker)
• bug #922 Fix error when trying to decode token using new authenticator system (fd6130)

• feature #916 Allow to use custom authenticator by extending JWTAuthenticator (fd6130)
• bug #914 Bundle breaks application if Symfony Console not installed (yivi)
• feature #912 Added argument to AuthenticationSuccessHandler to stop token from being removed from response (naitsirch)
• bug #905 Changed JWTAuthenticator::start method return type to more generic Response type (aurimasniekis)
• feature #903 Implement AuthenticatorInterface::createToken() (Symfony 5.4) (chalasr)

• bug 66ec1e0 Fix missing import (chalasr)

• bug #897 Fix unexpected deprecation about Guard (bis) (chalasr)

• bug #895 Fix unexpected deprecation about Guard (chalasr)

• bug #887 JWTAuthenticator logic fix (ergnuor)

• bug #886 Fix remaining deprecations on Symfony 5.3 (chalasr)

• bug #884 Remove development files from releases (chalasr)

• feature #872 Add new jwt authenticator for Symfony 5.3+ Security system (TristanPouliquen, chalasr)
• bug #878 Handle misc. Symfony 5.3 deprecations, update CI config (mbabker)
• bug #864 Remove development files from releases (phansys)

• bug a175d6dab9 Prevent user enumeration via response content (chalasr)

• bug #840 [Security] On Authentication failure, replace MessageData (mpiot)
• bug #838 Fix wiring GenerateKeyPairCommand when key paths are null (chalasr)

• bug #835 Fix #834: Re-add namshi/jose as required dependency until v3 (filisko)

• bug #833 KeyLoaderInterface::getPassphrase() might return null and we need a string (drupol)
• feature #832 Make AbstractKeyLoader::getSigningKey() and AbstractKeyLoader::getPublicKey public (drupol)
• feature #817 Feat: add keypair generation command (bpolaszek)
• feature #816 Remove support for lcobucci/jwt <3.4 & symfony/* <4.4 (chalasr)

• bug a175d6dab9 Prevent user enumeration via response content (chalasr)

• bug #827 Use named constructor for lcobucci/jwt Ecdsa signers (chalasr)
• bug #826 Fix creating tokens when iat is already set in the payload (chalasr)

• bug #815 Fix compatibility for lcobucci/jwt v3.x (bis) (chalasr)

• bug #813 Fix undefined variable (chalasr)

• bug #804 Fix ability to set extra standard claims in the input payload (bis) (chalasr)
• bug #807 Fix compatibility with locbucci/jwt 3.2 (chalasr)

• bug #801 Fix ability to set extra standard claims in the input payload (chalasr)
• bug #796 Set Token on ExpiredTokenException (AdrienBr)

• bug #797 Fix support for lcobucci/jwt v3.4 and 4.0 (chalasr)

• feature #790 Fix Symfony 5.2 getProviderKey deprecation (ogizanagi)
• feature #792 PHP 8 Support (chalasr)

• feature #769 Added support for composed cookies (lukacovicadam)
• bug #787 fix day saving transition php (flaugere)
• bug #780 Add deprecation message argument to JWTFactory.php (chrBrd)
• feature #786 Allow token creation from an existing payload (RicoLannez)
• feature #677 chore/implement-against-key-loader-interface (TiMESPLiNTER)
• feature #767 Added the possibility to choose if the cookie is "secure" or not (Mael-91)

• feature #761 Expose payload in encode/decode exceptions (chalasr)
• bug #755 Drop php 5.5 compat, Test against php 7.4 + symfony 5.1 and fix deprecations (acrobat)
• bug #683 Handle ChainUserProvider (Gemorroj)

• feature #753 Add set_cookies option to store JWT in secure cookies (chalasr)
• feature #737 Enable to keep the modified payload after decode (cedriclombardot)

• bug #689 Symfony 4.4/5.0 compatibility (Deuchnord)
• bug #687 Authentication Exception Message from its key (arslan)
• bug #675 Use late static binding on JWTUser (kaznovac)

• bug #669 Fix dispatch signature on SF > 4.3 (Webonaute)
• bug #650 Fixed AuthenticaionFailureHandler to utilize messages from custom exceptions (EresDev)

• bug #644 Fix FC/BC layer for EventDispatcher (nicolas-grekas)

• bug #637 Fix deprecations on symfony/event-dispatcher:4.3 (chalasr)
• bug #620 Fix missing $config variable (Oliboy50)
• bug #618 Use the JWTTokenManagerInterface (trsteel88)
• bug #593 Make JWTManager::$userIdClaim nullable (chalasr)

• bug #577 Fix argument order in JWTProvider service declaration (fjogeleit)

• bug #574 fix clockSkew not taken into account in some case (mu4ddi3)
• bug #554 Fix deprecations on Symfony 4.2 (chalasr)
• feature #537 Customizable User ID Claim (Spomky)
• feature #503 Allow setting the "exp" claim from event listeners (MaximeMaillet)

• bug #542 Fix missing implemenets breaking JWT header alteration (tucksaun)

• bug #525 Make openssl key loader service deprecated (Faecie)

• bug #522 Fix clock skew + deprecation message (chalasr)

• bug #515 Re-add namshi/jose as an hard requirement until 3.0 (chalasr)

• feature #508 Replace namshi/jose by lcobucci/jwt (chalasr)
• feature #485 Add a lexik:jwt:generate-token command (sroze)
• feature #369 Fix HMAC support (chalasr)
• feature #492 Clock skew (patrickjDE)
• feature #433 Added setPayload to JWTDecodedEvent analogous to JWTCreatedEvent. (vgeyer)
• feature #412 Make the token type case insensitive (greg0ire)
• feature #404 CheckConfigCommand should not be container aware (chalasr)
• feature #352 JWT header alteration (Spomky)
• feature #344 Add an extension point on the PayloadAwareUserProviderInterface (sroze)

• bug #408 Response classes shouldn't have the @internal PhpDoc tag (lashae)
• bug #403 Switch to PSR-4 namespaces for PHPUnit (chalasr)
• bug #399 Fix sf3.4 command autoregistration deprecation (ogizanagi)

• bug #398 Fix Symfony 4 compatibility (benji07)
• bug #383 Don't register lcobucci encoder if lcobucci/jwt is not installed (chalasr)

• bug #356 Dont use DefinitionDecorator on Symfony 3.3+ (chalasr)