github.com/ory/fosite

autogen(docs): regenerate and update changelog

Bug Fixes

• Always rollback (#638) (7edf673), closes #637

• Empty client secret via basic auth header means "none" authn (#655) (7a2d972), closes /github.com/golang/oauth2/blob/ee480838109b20d468babcb00b7027c82f962065/internal/token.go#L174-L176:

  The existing client authentication code treats an empty client_secret query parameter to be equivalent to "none" authentication instead of "client_secret_post."

  This change updates the basic auth check to be consistent with this. That is, an empty secret via the basic auth header is considered to mean "none" instead of "client_secret_basic."

  The "golang.org/x/oauth2" library probes for both methods of authentication, starting with the basic auth header approach first.

  As required, both client ID and secret are encoded in one header:

• Handle invalid_token error for refresh_token is expired (#664) (76bb274)

• Handle token_inactive error for multiple concurrent refresh requests (#652) (7c8f4ae):

  See https://github.com/ory/hydra/issues/3004

• Url-encode the fragment in the redirect URL of the authorize response (#649) (beec138), closes #648:

  This patch reverts the encoding logic for the fragment of the redirect URL returned as part of the authorize response to what was the one before version 0.36.0. In that version, the code was refactored and the keys and values of the fragment ceased to be url-encoded. This in turn reflected on all Ory Hydra versions starting from 1.9.0 and provoked a breaking change that made the parsing of the fragment impossible if any of the params contain a character like & or = because they get treated as separators instead of as text

• Use the correct algorithm for at_hash and c_hash (#659) (8cb4b4b), closes #630

Code Generation

• docs: Regenerate and update changelog (5dbfa9a)

Documentation

• Add deprecation to communicate ropc discouragement (#665) (df491be):

  This adds godoc deprecations to the compose.OAuth2ResourceOwnerPasswordCredentialsFactory and oauth2.ResourceOwnerPasswordCredentialsGrantHandler in order to clearly communicate the discouragement of the ROPC grant type to users implementing this library.

Features

• Use custom hash.Hash in hmac.HMACStrategy (#663) (d09a8c3), closes #654