PackageTrack
Sign in Get early access

yiisoft/yii2-authclient

External authentication via OAuth and OpenID for the Yii framework

2.2.17 6.7M downloads/mo #2330 most downloaded on Packagist yiisoft/yii2-authclient

What this package is like to depend on

Last release 2 years ago

no release in 18 months

Ships fairly regularly

a new release about every 5 months

Nearly every release is documented

notes for 34 of 34 stable releases

Nothing withdrawn

no release was ever pulled

12 years old

36 releases · first in 2014

0 releases in the last 12 months

see the full history below

Release timeline

36 releases · Apr 2014 to Feb 2025
2015 2017 2019 2021 2023 2025
Release Pre-release

Releases

latest 36
  1. 2.2.17 13 Feb 2025
    Release notes
    • Bug #392: Now using array as default value for token_endpoint_auth_methods_supported in OpenIdConnect::applyClientCredentialsToRequest() (strtob, rhertogh)
    Open source →
  2. 2.2.16 10 May 2024
    Release notes
    • Enh #387: Use appropriate exception if client does not exist (eluhr)
    • Enh #388: Added support to configure the OAuth2 access token location in requests and added a generic OAuth2 client (rhertogh)
    • Enh #389: Added ability to configure OpenIdConnect cache duration, default is 1 week (viktorprogger)
    Open source →
  3. 2.2.15 16 Dec 2023
    Release notes
    • Enh GHSA-w8vh-p74j-x9xp: Improved security for OAuth1, OAuth2 and OpenID Connect clients by using timing attack safe string comparsion (rhertogh)
    • Enh GHSA-rw54-6826-c8j5: Improved security for OAuth2 client by requiring an authCodeVerifier if PKCE is enabled and clearing it after usage (rhertogh)
    • Bug #364: Use issuer claim from OpenID Configuration (radwouters)
    • Enh #367: Throw more specific ClientErrorResponseException when the response code in BaseOAuth::sendRequest() is a 4xx (rhertogh)
    Open source →
  4. 2.2.14 18 Nov 2022
    Release notes
    • Bug #351: Unable to set TokenParamKey in OAuth2 config, gets hard overwritten in OAuth2::createToken() (DSTester)
    Open source →
  5. 2.2.13 04 Sep 2022
    Release notes
    • Bug #354: Fix PHP 8.1 deprecated message in BaseOAuth stripos(): Passing null to parameter #1 ($haystack) of type string is deprecated (marty-macfly)
    Open source →
  6. 2.2.12 03 Dec 2021
    Release notes
    • Bug #330: OpenID Connect client now defaults to 'client_secret_basic' in case token_endpoint_auth_methods_supported isn't specified (rhertogh)
    • Bug #331: OpenID Connect aud claim can either be a string or a list of strings (azmeuk)
    • Bug #332: OpenID Connect aud nonce is passed from the authentication request to the token request (azmeuk)
    • Bug #339: OpenID Connect client now regenerates a new nonce when refreshing the access token (rhertogh)
    • Bug #344: Fix Facebook OAuth 400 error when latin characters are used in App name (pawelkania)
    • Enh #279: Add AuthAction::$defaultClientId and AuthAction::getClientId() (ditibal)
    • Enh #341: OpenID Connect client now uses access token 'id_token' claim for getUserAttributes() if userinfo_endpoint is not available (rhertogh)
    • Enh #342: OpenID Connect client support for JWT in userinfo_endpoint response (rhertogh)
    Open source →
  7. 2.2.11 09 Aug 2021
    Release notes
    • Enh #318: Add statusCode from response to init InvalidResponseException in sendRequest method of yii\authclient\BaseOAuth class (vleedev)
    • Enh #327: Use random_int() when generating OAuth1 nonce (samdark)
    Open source →
  8. 2.2.10 05 May 2021
    Release notes
    • Chg #315: Add proof key for code exchange PKCE support to oauth2 (AdeAttwood)
    Open source →
  9. 2.2.9 13 Nov 2020
    Release notes
    • Bug #312: do not refresh access token if it is not expired (albertborsos)
    Open source →
  10. 2.2.8 10 Nov 2020
    Release notes
    • Bug #309: Try to refresh token in BaseOAuth->beforeApiRequestSend() if BaseOAuth->autoRefreshAccessToken = true instead of throwing "Invalid access token" exception (marty-macfly)
    • Bug #311: Fix PHP 8 compatibility (samdark)
    Open source →
  11. 2.2.7 12 Feb 2020
    Release notes
    • Bug #292: Updated GitHub token transfer method according to https://developer.github.com/changes/2019-11-05-deprecated-passwords-and-authorizations-api/#authenticating-using-query-parameters (raidkon)
    Open source →
  12. 2.2.6 19 Nov 2019
    Release notes
    • Bug #288: Default request option for turning off SSL peer verification was removed (Rutger, samdark)
    • Enh #205: Add alternative storage system based on cache component (marty-macfly, tunecino)
    Open source →
  13. 2.2.5 05 Nov 2019
    Release notes
    • Enh #217: Replace spomky-labs/jose by JWT Framework (marty-macfly, smcyr)
    Open source →
  14. 2.2.4 02 Jul 2019
    Release notes
    • Enh #276: Bumped VK API version to 5.95, according to developers recommendation (EvgeniyRRU)
    • Enh #278: Keep only selected parameters in default return URLs of OAuth services (albertborsos)
    Open source →
  15. 2.2.3 04 Jun 2019
    Release notes
    • Chg #273: OpenIdConnect::validateClaims() is now protected (samdark)
    Open source →
  16. 2.2.2 14 May 2019
    Release notes
    • Bug #270: Updated Facebook icon to match brand guidelines (ServerDotBiz)
    Open source →
  17. 2.2.1 23 Apr 2019
    Release notes
    • Bug #252: Fix bug when OAuthToken is incorrectly instantiated if configuration array has incorrect order (rob006)
    Open source →
  18. 2.2.0 16 Apr 2019
    Release notes
    • Bug #266: Updated Google client image (nurielmeni)
    • Bug #267: Upgrade LinkedIn client to v2 (machour)
    Open source →
  19. 2.1.8 28 Jan 2019
    Release notes
    • Bug #237: Fix redirect from LinkedIn if user refused to authorize permissions request (jakim)
    • Enh #218: Allow configuring user component in AuthAction (samdark, lab362)
    • Enh #258: Use Google Sign-in API instead of Google Plus in yii\authclient\clients\Google as Google Plus is deprecated (alexeevdv)
    • Enh #259: Allow to pass buildAuthUrl params to OAuth flows in AuthAction (albertborsos)
    Open source →
  20. 2.1.7 20 Sep 2018
    Release notes
    • Bug #241: Unset parameter scope on defaultReturnUrl for OAuth2 class since it was causing bad request response from Google provider (okiwan)
    Open source →
  21. 2.1.6 06 Sep 2018
    Release notes
    • Bug #211: RsaSha was not passing $key to openssl_pkey_get_private() in generateSignature() (cfhodges)
    • Bug #220: Make OpenIdConnect client send token as bearer auth instead of querystring parameter (lukos)
    • Bug #237: Fixed redirect if user cancels login in auth form (msvit1989)
    • Enh #203: Updated VKontakte client to use API version 5.0 (Shketkol)
    Open source →
  22. 2.1.5 07 Feb 2018
    Release notes
    • Enh #187: URL endpoints for authUrl and tokenUrl for yii\authclient\clients\LinkedIn updated (Felli)
    • Enh #195: yii\authclient\AuthAction refactored to use yii\web\Application::$request for request data access (klimov-paul)
    • Enh #196: Added yii\authclient\AuthAction::$cancelCallback allowing custom handling for authentication cancelation (terales, klimov-paul)
    Open source →
  23. 2.1.4 03 Nov 2017
    Release notes
    • Bug #152: Fixed JavaScript callback generated by \yii\authclient\widgets\GooglePlusButton consider 'immediate_failed' as instant auth error (klimov-paul)
    • Bug: Usage of deprecated yii\base\Object changed to yii\base\BaseObject allowing compatibility with PHP 7.2 (klimov-paul)
    • Enh #178: Added yii\authclient\clients\TwitterOAuth2 supporting 'application-only authentication' workflow for Twitter (klimov-paul)
    • Enh #179: Added apiVersion at yii\authclient\clients\VKontakte (isudakoff)
    • Enh #185: yii\authclient\clients\VKontakte::initUserAttributes() now throws verbose exception on unexpected API response instead of PHP error (klimov-paul)
    Open source →
  24. 2.1.3 23 Jun 2017
    Release notes
    • Bug #152: Fixed \yii\authclient\OAuth1::fetchRequestToken() skips formatting for yii\httpclient\Request (klimov-paul)
    • Bug #160: Fixed \yii\authclient\OAuth1::composeSignatureBaseString() does not take URL query string into account (klimov-paul)
    • Enh #155: Added \yii\authclient\OpenIdConnect supporting OpenID Connect protocol (klimov-paul)
    • Enh #156: Added \yii\authclient\signature\RsaSha and \yii\authclient\signature\HmacSha supporting general 'SHAwithRSA' and 'HMAC SHA' signature methods (klimov-paul)
    • Enh #157: Added \yii\authclient\OAuth2::authenticateUserJwt() supporting authentication via JSON Web Token (JWT) (klimov-paul)
    • Enh #163: Added support for exchanging access token at yii\authclient\clients\Facebook (klimov-paul)
    • Enh #163: Added support for client-specific access tokens at yii\authclient\clients\Facebook (klimov-paul)
    • Chg #163: yii\authclient\clients\Facebook::$autoRefreshAccessToken is now disabled by default (klimov-paul)
    Open source →
  25. 2.1.2 15 Feb 2017
    Release notes
    • Bug #135: Fixed \yii\authclient\OAuth1::fetchRequestToken() duplicates auth params in the request body, which may cause error on some OAuth 1.0 providers (klimov-paul)
    • Bug #149: Changed $ to jQuery to prevent global conflicts in widget JavaScript (Ariestattoo)
    • Enh #67: Added appsecret_proof generation for the API requests at yii\authclient\clients\Facebook (blackhpro, SDKiller, klimov-paul)
    Open source →
  26. 2.1.1 29 Aug 2016
    Release notes
    • Bug #128: Fixed \yii\authclient\BaseClient::createRequest() does not apply defaultRequestOptions and requestOptions (klimov-paul)
    • Bug #130: Fixed \yii\authclient\OAuth1::fetchRequestToken() unable to unset current access token (klimov-paul)
    • Enh #27: Added \yii\authclient\OAuth1::authorizationHeaderMethods option allowing to control request methods, which require authorization header (klimov-paul)
    • Enh #132: URL endpoints for authUrl and tokenUrl for yii\authclient\clients\VKontakte updated (KhristenkoYura)
    Open source →
  27. 2.1.0 04 Aug 2016
    Release notes
    • Enh #27: This extension no longer require PHP 'cURL' extension to be installed (klimov-paul)
    • Enh #30: Added support for 'client_credentials' grant type via \yii\authclient\OAuth2::authenticateClient() (klimov-paul)
    • Enh #33: Added ability to pass raw request content at \yii\authclient\BaseOAuth::api() (klimov-paul)
    • Enh #41: Added support for signature generation from request token at \yii\authclient\OAuth1::fetchAccessToken() (klimov-paul)
    • Enh #63: Markup for \yii\authclient\widgets\AuthChoice simplified (klimov-paul)
    • Enh #108: This extension now uses yii2-httpclient library for the HTTP requests (klimov-paul)
    • Enh #118: Added support for 'password' grant type via \yii\authclient\OAuth2::authenticateUser() (klimov-paul)
    • Enh #121: Auth client 'State Storage' abstraction layer extracted (klimov-paul)
    • Enh #124: Methods clientLink() and renderMainContent() of yii\authclient\widgets\AuthChoice reworked to return HTML instead of echo (klimov-paul)
    • Enh #127: Auth 'state' validation added to OAuth2 for preventing cross-site request forgery (klimov-paul)
    Open source →
  28. 2.0.6 08 Jul 2016
    Release notes
    • Bug #37: Fixed \yii\authclient\widgets\AuthChoice overrides any <a> tag click behavior between begin() and end() methods (klimov-paul)
    • Enh #31: Allow to disable automatic 'refresh access token' requests (klimov-paul)
    • Enh #58: Added support for user attribute request params setup for Twitter (umanamente, klimov-paul)
    • Enh #111: yii\authclient\clients\GitHub now retrieves user email even if it is set as 'private' at GitHub account (klimov-paul)
    Open source →
  29. 2.0.5 23 Sep 2015
    Release notes
    • Bug #25: yii\authclient\BaseOAuth now can be used without without session application component available (klimov-paul)
    • Enh #40: Added attributeNames field to yii\authclient\clients\Facebook, which allows definition of attributes list fetched from API (samdark)
    • Chg: #47: Default popup size for yii\authclient\clients\Facebook has been increased up to 860x480 (lame07, klimov-paul)
    Open source →
  30. 2.0.4 10 May 2015
    Release notes
    • Bug #7224: Fixed incorrect POST fields composition at yii\authclient\OAuth1 (klimov-paul)
    • Bug #7639: Automatic exception throw on 'error' key presence at yii\authclient\BaseOAuth::processResponse() removed (klimov-paul)
    • Enh #17: Added attributeNames field to yii\authclient\clients\VKontakte and yii\authclient\clients\LinkedIn, which allows definition of attributes list fetched from API (klimov-paul)
    • Enh #6743: Icon for Google at yii\authclient\widgets\AuthChoice fixed to follow the Google Brand guidelines (klimov-paul)
    • Enh #7733: yii\authclient\clients\VKontakte now gets attributes from access token also (klimov-paul)
    • Enh #7754: New client yii\authclient\clients\GooglePlus added to support Google recommended auth flow (klimov-paul)
    • Chg: #7754: yii\authclient\clients\GoogleOpenId is now deprecated because this auth method is no longer supported by Google as of April 20, 2015 (klimov-paul)
    Open source →
  31. 2.0.3 01 Mar 2015
    Release notes
    • Enh #6892: Default value of yii\authclient\clients\Twitter::$authUrl changed to 'authenticate', allowing usage of previous logged user without request an access (kotchuprik)
    Open source →
  32. 2.0.2 11 Jan 2015
    Release notes
    • Bug #6502: Fixed \yii\authclient\OAuth2::refreshAccessToken() does not save fetched token (sebathi)
    • Bug #6510: Fixed infinite redirect loop using default \yii\authclient\AuthAction::cancelUrl (klimov-paul)
    Open source →
  33. 2.0.1 07 Dec 2014
    Release notes
    • Bug #6000: Fixed CCS for yii\authclient\widgets\AuthChoice does not loaded if popupMode disabled (klimov-paul)
    Open source →
  34. 2.0.0 12 Oct 2014
    Release notes
    • Enh #5135: Added ability to operate nested and complex attributes via yii\authclient\BaseClient::normalizeUserAttributeMap (zinzinday, klimov-paul)
    Open source →
  35. 2.0.0-rc 28 Sep 2014 pre-release
    Release notes
    • Bug #3633: OpenId return URL comparison advanced to prevent url encode problem (klimov-paul)
    • Bug #4490: yii\authclient\widgets\AuthChoice does not preserve initial settings while opening popup (klimov-paul)
    • Bug #5011: OAuth API Response with 20x status were not considered success (ychongsaytc)
    • Enh #3416: VKontakte OAuth support added (klimov-paul)
    • Enh #4076: Request HTTP headers argument added to yii\authclient\BaseOAuth::api() method (klimov-paul)
    • Enh #4134: yii\authclient\InvalidResponseException added for tracking invalid remote server response (klimov-paul)
    • Enh #4139: User attributes requesting at GoogleOAuth switched to Google+ API (klimov-paul)
    Open source →
  36. 2.0.0-beta 13 Apr 2014 pre-release
    Release notes
    • Initial release.
    Open source →

Every package, every release, already written down.

The archive is open and free. Watching your own project is what we are building next.

Browse the archive