v1.7.0

Added

• Include message body in 302 responses #564 (michielvangendt)

Fixed

• Honor configured sameSite in transient cookies so you can login to iframe using 'none' #571 (adamjmcgrath)
• Cookies with samesite=none must have the secure attr set #570 (adamjmcgrath)
• Improve types in server-side withPageAuthRequired #554 (misoton665)

v1.6.2

Fixed

• Fix issue where error reporting wrong instanceof #543 (adamjmcgrath)

Security

• Enforce configured host on user supplied returnTo #557 (adamjmcgrath)

v1.6.1

Fixed

• [Snyk] Upgrade openid-client from 4.8.0 to 4.9.0 #518 (snyk-bot)

v1.6.0

Added

• SDK-2818 Export error classes #508 (adamjmcgrath)
• SDK-2529 Add ability to pass custom params to refresh grant and code exchange #507 (adamjmcgrath)
• SDK-2813 Add afterRefresh hook #506 (adamjmcgrath)

Fixed

• Fix types in server-side withPageAuthRequired #512 (Widcket)

v1.5.0

Added

• Add IE11 support #432 (Widcket)

v1.4.2

Fixed

• Fix reflected XSS from the callback handler's error query parameter CVE-2021-32702 (adamjmcgrath)

v1.4.0

Added

• withPageAuthRequired CSR now adds user to wrapped component props #405 (adamjmcgrath)

Fixed

• env var substitutions now means you can define AUTH0_BASE_URL from VERCEL_URL in next.config.js #404 (adamjmcgrath)

v1.3.1

Fixed

• Use window.location.toString() as the default returnTo value #370 (Widcket)
• returnTo should be encoded as it contains url unsafe chars #365 (adamjmcgrath)

v1.3.0

Added

• Organizations support #343 (adamjmcgrath)

v1.2.0

Added

• Export UserContext for overriding default hook initialisation behaviour #325 (adamjmcgrath)

Fixed

• returnTo should respect application’s basePath configuration #317 (Widcket)