@cloudflare/workers-oauth-provider 0.8.3

v0.8.3

on Node.js NPM

Patch Changes

• #240 0061270 Thanks @agent-think! - Fix worker crash (HTTP 500) when the /token request sends a malformed
  Content-Type header. The endpoint previously used a loose includes() check,
  so a header such as application/json, application/x-www-form-urlencoded passed
  validation and then caused request.formData() to throw. The media type is now
  parsed strictly (parameters are stripped and the exact media type is compared),
  and form parsing is guarded so invalid bodies return a 400 invalid_request
  instead of crashing the worker.

• #246 771a207 Thanks @agent-think! - Validate the RFC 8707 resource parameter before consuming an authorization code, so a token request rejected with invalid_target can be retried with an allowed resource.

• #249 f0f5dc0 Thanks @mattzcarey! - Preserve a subject access token's scope when issuing tokens through OAuth 2.0 Token Exchange.