omniauth-google-oauth2 1.2.2 → 1.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/rubocop.yml +1 -1
- data/CHANGELOG.md +166 -4
- data/README.md +77 -45
- data/examples/config.ru +42 -23
- data/lib/omniauth/google_oauth2/version.rb +1 -1
- data/lib/omniauth/strategies/google_oauth2.rb +248 -21
- data/omniauth-google-oauth2.gemspec +1 -1
- data/spec/omniauth/strategies/google_oauth2_spec.rb +588 -19
- data/spec/spec_helper.rb +9 -0
- metadata +7 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 4ce851358d916e9ca658928491f439ed90b13be620c6cee889530fcd8cbdab23
|
|
4
|
+
data.tar.gz: 8ab78932795f49af9cfb974669c680a0138af5ce9752d43cb041a3332889f3dd
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 23e96c5c0f2853bbca7ddac277abc160ff24ebf170f71154b17b8a41f51f0e57dfe04b53e78334f7739fe702904de08b209748ae89fc9de715ae560b59ddc198
|
|
7
|
+
data.tar.gz: 248bc72e9cb561afa7153eb6a76d20cae09e36b7cff39828ad55c83f6c2f5ff0ef234bffb92a1147a84eaefab5e51ab7e6c17e118a66b256481137d0988d9e8a
|
data/CHANGELOG.md
CHANGED
|
@@ -1,406 +1,553 @@
|
|
|
1
1
|
# Changelog
|
|
2
|
+
|
|
2
3
|
All notable changes to this project will be documented in this file.
|
|
3
4
|
|
|
4
|
-
## 1.2.
|
|
5
|
+
## 1.2.3 - 2026-08-31
|
|
6
|
+
|
|
7
|
+
### Security
|
|
8
|
+
|
|
9
|
+
- Verify caller-supplied ID tokens against Google's published signing keys before trusting them. An ID token sent alongside a direct `access_token` callback was previously decoded without checking its signature, so `extra.id_info` and `extra.id_token` could be populated from a forged token. `uid` and `info` were never affected, as they come from the userinfo endpoint. A caller-supplied ID token genuinely issued by Google for the same user and a trusted client continues to be accepted after verification.
|
|
10
|
+
- Require a caller-supplied ID token to describe the same user as the access token it was sent with, by comparing the token's `sub` against the userinfo subject. A verified signature only proves Google issued the token, not that it belongs to the person the access token identifies, so without this a genuine ID token for one user could be paired with an access token for another and leave `uid` and `extra.id_info` describing different people. The `at_hash` claim is checked first as a fast path, and this subject check settles the cases `at_hash` cannot: tokens that omit the claim, and tokens whose `at_hash` is stale because the client refreshed its access token after sign-in. This check runs even when `skip_info` is set, as that option trims the auth hash rather than waiving verification.
|
|
11
|
+
- The bundled example app no longer disables TLS certificate verification. Anyone who copied that line into an application should remove it: it turns off certificate checking for every Faraday-based request in the process, not just the ones this gem makes.
|
|
12
|
+
|
|
13
|
+
### Added
|
|
14
|
+
|
|
15
|
+
- `reset_jwks_cache!` for clearing the cached Google signing keys between tests.
|
|
16
|
+
- `cached_jwks`, the class-level fetch-and-cache primitive behind it, which takes the fetch itself as a block.
|
|
17
|
+
- `JWKS_URL`, `JWKS_CACHE_TTL`, and `JWKS_RETRY_INTERVAL` constants, and a `JwksUnavailable` error.
|
|
18
|
+
- An upper bound of `< 4` on the `jwt` dependency. This is precautionary rather than a response to a released version: it keeps a future major release from being picked up before it has been verified against this strategy.
|
|
19
|
+
|
|
20
|
+
### Deprecated
|
|
21
|
+
|
|
22
|
+
- Nothing.
|
|
23
|
+
|
|
24
|
+
### Removed
|
|
25
|
+
|
|
26
|
+
- The fallback that placed the opaque access token in `extra.id_token` when no ID token was present. `extra.id_token` is now absent in that case rather than holding a value that was never an ID token. This was only reachable with `skip_jwt` set; without it the fallback raised instead.
|
|
27
|
+
|
|
28
|
+
### Fixed
|
|
29
|
+
|
|
30
|
+
- Ignore every credential field a caller supplies in a direct access-token callback apart from the access token itself and a verified ID token. `refresh_token` and token expiry in particular cannot be verified, so they are no longer carried through.
|
|
31
|
+
- Avoid decoding opaque access tokens as JWTs when no ID token is available.
|
|
32
|
+
- Fail with a normal authentication failure when a callback carries no usable credential, such as an ID token with no access token, a JSON body that is not an object, or an unparseable body. Previously these raised a `NoMethodError` or `TypeError` that OmniAuth turned into a failure whose message was the raw Ruby error, so applications received an unstable `message` parameter such as `undefined method 'expired?'` instead of `invalid_credentials`.
|
|
33
|
+
- Serve the cached signing keys when Google's key endpoint is briefly unreachable, and back off before refetching, rather than retrying on every request, including when nothing is cached yet.
|
|
34
|
+
- Reject a signing key response that is not an object with a `keys` array, rather than passing it on to be interpreted as some other kind of key.
|
|
35
|
+
- Cap how often an ID token naming an unrecognised key can force a key refresh, so it cannot be used to drive unbounded outbound requests while holding the shared cache lock. Key rotation still resolves within `JWKS_RETRY_INTERVAL`.
|
|
36
|
+
- `jwt_leeway` now also applies when verifying caller-supplied ID tokens, matching how it already behaved for the `extra` block.
|
|
37
|
+
- Support non-rewindable JSON request bodies under Rack 3.
|
|
38
|
+
- Accept ID tokens issued to any configured `authorized_client_ids`, matching the audiences already accepted for access tokens.
|
|
39
|
+
- Reuse successfully verified ID token claims when building `extra`, so each ID token is decoded and validated only once per request.
|
|
40
|
+
|
|
41
|
+
## 1.2.2 - 2026-02-23
|
|
5
42
|
|
|
6
43
|
### Added
|
|
7
|
-
|
|
44
|
+
|
|
45
|
+
- Ruby 4.0 support.
|
|
8
46
|
|
|
9
47
|
### Deprecated
|
|
48
|
+
|
|
10
49
|
- Nothing.
|
|
11
50
|
|
|
12
51
|
### Removed
|
|
52
|
+
|
|
13
53
|
- Unused `IMAGE_SIZE_REGEXP` constant.
|
|
14
54
|
- Dead `skip_friends` and `skip_image_info` options (Google+ was shut down in 2019).
|
|
15
|
-
- `CGI.parse` dependency replaced with `URI.decode_www_form` for Ruby 4.0 compatibility.
|
|
16
55
|
|
|
17
56
|
### Fixed
|
|
57
|
+
|
|
58
|
+
- Replaced `CGI.parse` with `URI.decode_www_form` for Ruby 4.0 compatibility.
|
|
18
59
|
- Updated gemspec description to reference OmniAuth instead of OmniAuth 1.x.
|
|
19
60
|
- Modernized CI: bumped actions/checkout to v6, rake to 13.3, and rubocop to latest.
|
|
61
|
+
- Added edge case tests for `uid`, `strip_unnecessary_query_parameters`, `verify_token`, `verify_hd` wildcard, and malformed JSON handling.
|
|
20
62
|
|
|
21
63
|
## 1.2.1 - 2025-01-18
|
|
22
64
|
|
|
23
65
|
### Added
|
|
66
|
+
|
|
24
67
|
- Use jwt v2.9.2's public claims verification API - https://github.com/zquestz/omniauth-google-oauth2/pull/465
|
|
25
68
|
|
|
26
69
|
### Deprecated
|
|
70
|
+
|
|
27
71
|
- Nothing.
|
|
28
72
|
|
|
29
73
|
### Removed
|
|
74
|
+
|
|
30
75
|
- Support for jwt < 2.9.2.
|
|
31
76
|
|
|
32
77
|
### Fixed
|
|
78
|
+
|
|
33
79
|
- Nothing.
|
|
34
80
|
|
|
35
81
|
## 1.2.0 - 2024-09-15
|
|
36
82
|
|
|
37
83
|
### Added
|
|
84
|
+
|
|
38
85
|
- jwt 2.9.0 support for their updated claims code.
|
|
39
86
|
|
|
40
87
|
### Deprecated
|
|
88
|
+
|
|
41
89
|
- Nothing.
|
|
42
90
|
|
|
43
91
|
### Removed
|
|
92
|
+
|
|
44
93
|
- Ruby 2.3 and 2.4 support.
|
|
45
94
|
- Support for jwt < 2.9.0.
|
|
46
95
|
|
|
47
96
|
### Fixed
|
|
97
|
+
|
|
48
98
|
- Fixed image sizing code.
|
|
49
99
|
- Rubocop configuration updates.
|
|
50
100
|
|
|
51
101
|
## 1.1.3 - 2024-08-29
|
|
52
102
|
|
|
53
103
|
### Added
|
|
104
|
+
|
|
54
105
|
- Updated to use POST instead of GET for tokeninfo endpoint.
|
|
55
106
|
|
|
56
107
|
### Deprecated
|
|
108
|
+
|
|
57
109
|
- Nothing.
|
|
58
110
|
|
|
59
111
|
### Removed
|
|
112
|
+
|
|
60
113
|
- Nothing.
|
|
61
114
|
|
|
62
115
|
### Fixed
|
|
116
|
+
|
|
63
117
|
- Documentation typos.
|
|
64
118
|
- Rubocop configuration updates.
|
|
65
119
|
|
|
66
120
|
## 1.1.2 - 2024-03-28
|
|
67
121
|
|
|
68
122
|
### Added
|
|
123
|
+
|
|
69
124
|
- Add support for enable_granular_consent option (#455)
|
|
70
125
|
|
|
71
126
|
### Deprecated
|
|
127
|
+
|
|
72
128
|
- Nothing.
|
|
73
129
|
|
|
74
130
|
### Removed
|
|
131
|
+
|
|
75
132
|
- Nothing.
|
|
76
133
|
|
|
77
134
|
### Fixed
|
|
135
|
+
|
|
78
136
|
- Nothing.
|
|
79
137
|
|
|
80
138
|
## 1.1.1 - 2022-09-05
|
|
81
139
|
|
|
82
140
|
### Added
|
|
141
|
+
|
|
83
142
|
- Nothing.
|
|
84
143
|
|
|
85
144
|
### Deprecated
|
|
145
|
+
|
|
86
146
|
- Nothing.
|
|
87
147
|
|
|
88
148
|
### Removed
|
|
149
|
+
|
|
89
150
|
- Nothing.
|
|
90
151
|
|
|
91
152
|
### Fixed
|
|
153
|
+
|
|
92
154
|
- Fixed JWT decoding issue. (Invalid segment encoding) [#431](https://github.com/zquestz/omniauth-google-oauth2/pull/431)
|
|
93
155
|
|
|
94
156
|
## 1.1.0 - 2022-09-03
|
|
95
157
|
|
|
96
158
|
### Added
|
|
159
|
+
|
|
97
160
|
- `overridable_authorize_options` has been added to restrict overriding authorize_options by request params. [#423](https://github.com/zquestz/omniauth-google-oauth2/pull/423)
|
|
98
161
|
- Support for oauth2 2.0.x. [#429](https://github.com/zquestz/omniauth-google-oauth2/pull/429)
|
|
99
162
|
|
|
100
163
|
### Deprecated
|
|
164
|
+
|
|
101
165
|
- Nothing.
|
|
102
166
|
|
|
103
167
|
### Removed
|
|
168
|
+
|
|
104
169
|
- Nothing.
|
|
105
170
|
|
|
106
171
|
### Fixed
|
|
172
|
+
|
|
107
173
|
- Nothing.
|
|
108
174
|
|
|
109
175
|
## 1.0.1 - 2022-03-10
|
|
110
176
|
|
|
111
177
|
### Added
|
|
178
|
+
|
|
112
179
|
- Output granted scopes in credentials block of the auth hash.
|
|
113
180
|
- Migrated to GitHub actions.
|
|
114
181
|
|
|
115
182
|
### Deprecated
|
|
183
|
+
|
|
116
184
|
- Nothing.
|
|
117
185
|
|
|
118
186
|
### Removed
|
|
187
|
+
|
|
119
188
|
- Nothing.
|
|
120
189
|
|
|
121
190
|
### Fixed
|
|
191
|
+
|
|
122
192
|
- Overriding the `redirect_uri` via params or JSON request body.
|
|
123
193
|
|
|
124
194
|
## 1.0.0 - 2021-03-14
|
|
125
195
|
|
|
126
196
|
### Added
|
|
197
|
+
|
|
127
198
|
- Support for Omniauth 2.x!
|
|
128
199
|
|
|
129
200
|
### Deprecated
|
|
201
|
+
|
|
130
202
|
- Nothing.
|
|
131
203
|
|
|
132
204
|
### Removed
|
|
205
|
+
|
|
133
206
|
- Support for Omniauth 1.x.
|
|
134
207
|
|
|
135
208
|
### Fixed
|
|
209
|
+
|
|
136
210
|
- Nothing.
|
|
137
211
|
|
|
138
212
|
## 0.8.2 - 2021-03-14
|
|
139
213
|
|
|
140
214
|
### Added
|
|
215
|
+
|
|
141
216
|
- Constrains the version to Omniauth 1.x.
|
|
142
217
|
|
|
143
218
|
### Deprecated
|
|
219
|
+
|
|
144
220
|
- Nothing.
|
|
145
221
|
|
|
146
222
|
### Removed
|
|
223
|
+
|
|
147
224
|
- Nothing.
|
|
148
225
|
|
|
149
226
|
### Fixed
|
|
227
|
+
|
|
150
228
|
- Nothing.
|
|
151
229
|
|
|
152
230
|
## 0.8.1 - 2020-12-12
|
|
153
231
|
|
|
154
232
|
### Added
|
|
233
|
+
|
|
155
234
|
- Support reading the access token from a json request body.
|
|
156
235
|
|
|
157
236
|
### Deprecated
|
|
237
|
+
|
|
158
238
|
- Nothing.
|
|
159
239
|
|
|
160
240
|
### Removed
|
|
241
|
+
|
|
161
242
|
- No longer verify the iat claim for JWT.
|
|
162
243
|
|
|
163
244
|
### Fixed
|
|
245
|
+
|
|
164
246
|
- A few minor issues with .rubocop.yml.
|
|
165
247
|
- Issues with image resizing code when the image came with size information from Google.
|
|
166
248
|
|
|
167
249
|
## 0.8.0 - 2019-08-21
|
|
168
250
|
|
|
169
251
|
### Added
|
|
252
|
+
|
|
170
253
|
- Updated omniauth-oauth2 to v1.6.0 for security fixes.
|
|
171
254
|
|
|
172
255
|
### Deprecated
|
|
256
|
+
|
|
173
257
|
- Nothing.
|
|
174
258
|
|
|
175
259
|
### Removed
|
|
260
|
+
|
|
176
261
|
- Ruby 2.1 support.
|
|
177
262
|
|
|
178
263
|
### Fixed
|
|
264
|
+
|
|
179
265
|
- Nothing.
|
|
180
266
|
|
|
181
267
|
## 0.7.0 - 2019-06-03
|
|
182
268
|
|
|
183
269
|
### Added
|
|
270
|
+
|
|
184
271
|
- Ensure `info[:email]` is always verified, and include `unverified_email`
|
|
185
272
|
|
|
186
273
|
### Deprecated
|
|
274
|
+
|
|
187
275
|
- Nothing.
|
|
188
276
|
|
|
189
277
|
### Removed
|
|
278
|
+
|
|
190
279
|
- Nothing.
|
|
191
280
|
|
|
192
281
|
### Fixed
|
|
282
|
+
|
|
193
283
|
- Nothing.
|
|
194
284
|
|
|
195
285
|
## 0.6.1 - 2019-03-07
|
|
196
286
|
|
|
197
287
|
### Added
|
|
288
|
+
|
|
198
289
|
- Return `email` and `email_verified` keys in response.
|
|
199
290
|
|
|
200
291
|
### Deprecated
|
|
292
|
+
|
|
201
293
|
- Nothing.
|
|
202
294
|
|
|
203
295
|
### Removed
|
|
296
|
+
|
|
204
297
|
- Nothing.
|
|
205
298
|
|
|
206
299
|
### Fixed
|
|
300
|
+
|
|
207
301
|
- Nothing.
|
|
208
302
|
|
|
209
303
|
## 0.6.0 - 2018-12-28
|
|
210
304
|
|
|
211
305
|
### Added
|
|
306
|
+
|
|
212
307
|
- Support for JWT 2.x.
|
|
213
308
|
|
|
214
309
|
### Deprecated
|
|
310
|
+
|
|
215
311
|
- Nothing.
|
|
216
312
|
|
|
217
313
|
### Removed
|
|
314
|
+
|
|
218
315
|
- Support for JWT 1.x.
|
|
219
316
|
- Support for `raw_friend_info` and `raw_image_info`.
|
|
220
317
|
- Stop using Google+ API endpoints.
|
|
221
318
|
|
|
222
319
|
### Fixed
|
|
320
|
+
|
|
223
321
|
- Nothing.
|
|
224
322
|
|
|
225
323
|
## 0.5.4 - 2018-12-07
|
|
226
324
|
|
|
227
325
|
### Added
|
|
326
|
+
|
|
228
327
|
- New recommended endpoints for Google OAuth.
|
|
229
328
|
|
|
230
329
|
### Deprecated
|
|
330
|
+
|
|
231
331
|
- Nothing.
|
|
232
332
|
|
|
233
333
|
### Removed
|
|
334
|
+
|
|
234
335
|
- Nothing.
|
|
235
336
|
|
|
236
337
|
### Fixed
|
|
338
|
+
|
|
237
339
|
- Nothing.
|
|
238
340
|
|
|
239
341
|
## 0.5.3 - 2018-01-25
|
|
240
342
|
|
|
241
343
|
### Added
|
|
344
|
+
|
|
242
345
|
- Added support for the JWT 2.x gem.
|
|
243
346
|
- Now fully qualifies the `JWT` class to prevent conflicts with the `Omniauth::JWT` strategy.
|
|
244
347
|
|
|
245
348
|
### Deprecated
|
|
349
|
+
|
|
246
350
|
- Nothing.
|
|
247
351
|
|
|
248
352
|
### Removed
|
|
353
|
+
|
|
249
354
|
- Removed the `multijson` dependency.
|
|
250
355
|
- Support for versions of `omniauth-oauth2` < 1.5.
|
|
251
356
|
|
|
252
357
|
### Fixed
|
|
358
|
+
|
|
253
359
|
- Nothing.
|
|
254
360
|
|
|
255
361
|
## 0.5.2 - 2017-07-30
|
|
256
362
|
|
|
257
363
|
### Added
|
|
364
|
+
|
|
258
365
|
- Nothing.
|
|
259
366
|
|
|
260
367
|
### Deprecated
|
|
368
|
+
|
|
261
369
|
- Nothing.
|
|
262
370
|
|
|
263
371
|
### Removed
|
|
372
|
+
|
|
264
373
|
- New `authorize_url` and `token_url` endpoints are reverted until JWT 2.0 ships.
|
|
265
374
|
|
|
266
375
|
### Fixed
|
|
376
|
+
|
|
267
377
|
- Nothing.
|
|
268
378
|
|
|
269
379
|
## 0.5.1 - 2017-07-19
|
|
270
380
|
|
|
271
381
|
### Added
|
|
272
|
-
|
|
382
|
+
|
|
383
|
+
- _Breaking_ JWT iss verification can be enabled/disabled with the `verify_iss` flag - see the README for more details.
|
|
273
384
|
- Authorize options now includes `device_id` and `device_name` for private ip ranges.
|
|
274
385
|
|
|
275
386
|
### Deprecated
|
|
387
|
+
|
|
276
388
|
- Nothing.
|
|
277
389
|
|
|
278
390
|
### Removed
|
|
391
|
+
|
|
279
392
|
- Nothing.
|
|
280
393
|
|
|
281
394
|
### Fixed
|
|
395
|
+
|
|
282
396
|
- Updated `authorize_url` and `token_url` to new endpoints.
|
|
283
397
|
|
|
284
398
|
## 0.5.0 - 2017-05-29
|
|
285
399
|
|
|
286
400
|
### Added
|
|
401
|
+
|
|
287
402
|
- Rubocop checks to specs.
|
|
288
403
|
- Defaulted dev environment to ruby 2.3.4.
|
|
289
404
|
|
|
290
405
|
### Deprecated
|
|
406
|
+
|
|
291
407
|
- Nothing.
|
|
292
408
|
|
|
293
409
|
### Removed
|
|
410
|
+
|
|
294
411
|
- Testing support for older versions of ruby not supported by OmniAuth 1.5.
|
|
295
412
|
- Key `[:urls]['Google']` no longer exists, it has been renamed to `[:urls][:google]`.
|
|
296
413
|
|
|
297
414
|
### Fixed
|
|
415
|
+
|
|
298
416
|
- Updated all code to rubocop conventions. This includes the Ruby 1.9 hash syntax when appropriate.
|
|
299
417
|
- Example javascript flow now picks up ENV vars for google key and secret.
|
|
300
418
|
|
|
301
419
|
## 0.4.1 - 2016-03-14
|
|
302
420
|
|
|
303
421
|
### Added
|
|
422
|
+
|
|
304
423
|
- Nothing.
|
|
305
424
|
|
|
306
425
|
### Deprecated
|
|
426
|
+
|
|
307
427
|
- Nothing.
|
|
308
428
|
|
|
309
429
|
### Removed
|
|
430
|
+
|
|
310
431
|
- Nothing.
|
|
311
432
|
|
|
312
433
|
### Fixed
|
|
434
|
+
|
|
313
435
|
- Fixed JWT iat leeway by requiring ruby-jwt 1.5.2
|
|
314
436
|
|
|
315
437
|
## 0.4.0 - 2016-03-11
|
|
316
438
|
|
|
317
439
|
### Added
|
|
440
|
+
|
|
318
441
|
- Addedd ability to specify multiple hosted domains.
|
|
319
442
|
- Added a default leeway of 1 minute to JWT token validation.
|
|
320
443
|
- Now requires ruby-jwt 1.5.x.
|
|
321
444
|
|
|
322
445
|
### Deprecated
|
|
446
|
+
|
|
323
447
|
- Nothing.
|
|
324
448
|
|
|
325
449
|
### Removed
|
|
450
|
+
|
|
326
451
|
- Removed support for ruby 1.9.3 as ruby-jwt 1.5.x does not support it.
|
|
327
452
|
|
|
328
453
|
### Fixed
|
|
454
|
+
|
|
329
455
|
- Nothing.
|
|
330
456
|
|
|
331
457
|
## 0.3.1 - 2016-01-28
|
|
332
458
|
|
|
333
459
|
### Added
|
|
460
|
+
|
|
334
461
|
- Verify Hosted Domain if hd is set in options.
|
|
335
462
|
|
|
336
463
|
### Deprecated
|
|
464
|
+
|
|
337
465
|
- Nothing.
|
|
338
466
|
|
|
339
467
|
### Removed
|
|
468
|
+
|
|
340
469
|
- Dependency on addressable.
|
|
341
470
|
|
|
342
471
|
### Fixed
|
|
472
|
+
|
|
343
473
|
- Nothing.
|
|
344
474
|
|
|
345
475
|
## 0.3.0 - 2016-01-09
|
|
346
476
|
|
|
347
477
|
### Added
|
|
478
|
+
|
|
348
479
|
- Updated verify_token to use the v3 tokeninfo endpoint.
|
|
349
480
|
|
|
350
481
|
### Deprecated
|
|
482
|
+
|
|
351
483
|
- Nothing.
|
|
352
484
|
|
|
353
485
|
### Removed
|
|
486
|
+
|
|
354
487
|
- Nothing.
|
|
355
488
|
|
|
356
489
|
### Fixed
|
|
490
|
+
|
|
357
491
|
- Compatibility with omniauth-oauth2 1.4.0
|
|
358
492
|
|
|
359
493
|
## 0.2.10 - 2015-11-05
|
|
360
494
|
|
|
361
495
|
### Added
|
|
496
|
+
|
|
362
497
|
- Nothing.
|
|
363
498
|
|
|
364
499
|
### Deprecated
|
|
500
|
+
|
|
365
501
|
- Nothing.
|
|
366
502
|
|
|
367
503
|
### Removed
|
|
504
|
+
|
|
368
505
|
- Removed some checks on the id_token. Now only parses the id_token in the JWT processing.
|
|
369
506
|
|
|
370
507
|
### Fixed
|
|
508
|
+
|
|
371
509
|
- Nothing.
|
|
372
510
|
|
|
373
511
|
## 0.2.9 - 2015-10-29
|
|
374
512
|
|
|
375
513
|
### Added
|
|
514
|
+
|
|
376
515
|
- Nothing.
|
|
377
516
|
|
|
378
517
|
### Deprecated
|
|
518
|
+
|
|
379
519
|
- Nothing.
|
|
380
520
|
|
|
381
521
|
### Removed
|
|
522
|
+
|
|
382
523
|
- Nothing.
|
|
383
524
|
|
|
384
525
|
### Fixed
|
|
526
|
+
|
|
385
527
|
- Issue with omniauth-oauth2 where redirect_uri was handled improperly. We now lock the dependency to ~> 1.3.1
|
|
386
528
|
|
|
387
529
|
## 0.2.8 - 2015-10-01
|
|
388
530
|
|
|
389
531
|
### Added
|
|
532
|
+
|
|
390
533
|
- Added skip_jwt option to bypass JWT decoding in case you get decoding errors.
|
|
391
534
|
|
|
392
535
|
### Deprecated
|
|
536
|
+
|
|
393
537
|
- Nothing.
|
|
394
538
|
|
|
395
539
|
### Removed
|
|
540
|
+
|
|
396
541
|
- Nothing.
|
|
397
542
|
|
|
398
543
|
### Fixed
|
|
544
|
+
|
|
399
545
|
- Resolved JWT::InvalidIatError. https://github.com/zquestz/omniauth-google-oauth2/issues/195
|
|
400
546
|
|
|
401
547
|
## 0.2.7 - 2015-09-25
|
|
402
548
|
|
|
403
549
|
### Added
|
|
550
|
+
|
|
404
551
|
- Now strips out the 'sz' parameter from profile image urls.
|
|
405
552
|
- Now uses 'addressable' gem for URI actions.
|
|
406
553
|
- Added image data to extras hash.
|
|
@@ -408,52 +555,67 @@ All notable changes to this project will be documented in this file.
|
|
|
408
555
|
- Handle authorization codes coming from an installed applications.
|
|
409
556
|
|
|
410
557
|
### Deprecated
|
|
558
|
+
|
|
411
559
|
- Nothing.
|
|
412
560
|
|
|
413
561
|
### Removed
|
|
562
|
+
|
|
414
563
|
- Nothing.
|
|
415
564
|
|
|
416
565
|
### Fixed
|
|
566
|
+
|
|
417
567
|
- Fixes double slashes in google image urls.
|
|
418
568
|
|
|
419
569
|
## 0.2.6 - 2014-10-26
|
|
420
570
|
|
|
421
571
|
### Added
|
|
572
|
+
|
|
422
573
|
- Nothing.
|
|
423
574
|
|
|
424
575
|
### Deprecated
|
|
576
|
+
|
|
425
577
|
- Nothing.
|
|
426
578
|
|
|
427
579
|
### Removed
|
|
580
|
+
|
|
428
581
|
- Nothing.
|
|
429
582
|
|
|
430
583
|
### Fixed
|
|
584
|
+
|
|
431
585
|
- Hybrid authorization issues due to bad method alias.
|
|
432
586
|
|
|
433
587
|
## 0.2.5 - 2014-07-09
|
|
434
588
|
|
|
435
589
|
### Added
|
|
590
|
+
|
|
436
591
|
- Support for versions of omniauth past 1.0.x.
|
|
437
592
|
|
|
438
593
|
### Deprecated
|
|
594
|
+
|
|
439
595
|
- Nothing.
|
|
440
596
|
|
|
441
597
|
### Removed
|
|
598
|
+
|
|
442
599
|
- Nothing.
|
|
443
600
|
|
|
444
601
|
### Fixed
|
|
602
|
+
|
|
445
603
|
- Nothing.
|
|
446
604
|
|
|
447
605
|
## 0.2.4 - 2014-04-25
|
|
448
606
|
|
|
449
607
|
### Added
|
|
608
|
+
|
|
450
609
|
- Now requiring the "Contacts API" and "Google+ API" to be enabled in your Google API console.
|
|
451
610
|
|
|
452
611
|
### Deprecated
|
|
612
|
+
|
|
453
613
|
- The old Google OAuth API support was removed without deprecation.
|
|
454
614
|
|
|
455
615
|
### Removed
|
|
616
|
+
|
|
456
617
|
- Support for the old Google OAuth API. `OAuth2::Error` will be thrown and state that access is not configured when you attempt to authenticate using the old API. See Added section for this release.
|
|
457
618
|
|
|
458
619
|
### Fixed
|
|
620
|
+
|
|
459
621
|
- Nothing.
|