@cloudflare/workers-oauth-provider 0.9.0

v0.9.0

on Node.js NPM

Minor Changes

• #253 f4e026c Thanks @mattzcarey! - Reject authorization-code requests from public clients that omit PKCE. OAuth 2.1 requires authorization servers to enforce code_challenge for clients that cannot authenticate at the token endpoint.

• #248 194154e Thanks @ksinder! - Report CIMD metadata fetch failures instead of treating them as unknown clients.
  A failed Client ID Metadata Document fetch previously became a null client
  lookup, so a network problem (timeout, WAF block, upstream outage) was
  indistinguishable from an unregistered client — at the token endpoint, in the
  onError hook, and for OAuthHelpers callers. The fetch failure now throws a
  new exported CimdFetchError carrying the metadata URL, stable
  metadata_resolution_failed reason, and underlying diagnostic detail. The
  token endpoint still returns the same generic invalid_client / "Client not
  found" response, but reports the failure through the onError hook's
  internal field (category client-id-metadata-document) together with a new
  optional request field. Breaking for callers of OAuthHelpers.lookupClient
  (and methods built on it) that relied on null for CIMD fetch failures: catch
  CimdFetchError to restore the old behavior.

• #259 71ec864 Thanks @mattzcarey! - Enable RFC 9207 authorization response issuer identification. Authorization server metadata advertises support, parsed requests carry the expected issuer for application-owned terminal error responses, and successful code and implicit redirects include iss.

• #255 5cc336c Thanks @mattzcarey! - Validate protected resource metadata at construction time. Reject empty or invalid authorization server issuer lists, invalid resource and scope values, and bearer presentation methods the provider does not implement instead of publishing unusable or misleading RFC 9728 metadata.

• #277 9e88aa4 Thanks @mattzcarey! - Require S256 PKCE by default. Authorization servers now advertise only S256 and reject PKCE challenges that use plain or omit code_challenge_method unless allowPlainPKCE: true is configured for legacy compatibility. Confidential clients may continue to omit PKCE entirely.

• #260 248a9e7 Thanks @mattzcarey! - Separate authorization-server and protected-resource scope configuration. Explicit resourceMetadata.scopes_supported values become baseline Bearer challenge guidance, operation-specific requiredScopes takes precedence, and offline_access is omitted from provider-generated resource-facing scope lists. Deployments relying on the old scopesSupported fallback must configure protected-resource scopes explicitly.

• #251 98d642f Thanks @mattzcarey! - Add an exported ExternalTokenError for intentional structured errors from resolveExternalToken. Existing callbacks keep their previous behavior: returning { props, audience? } authenticates, returning null returns a generic 401 invalid_token, and every other thrown value, including OAuthError, propagates as an unexpected failure. Standard bearer-token ExternalTokenError failures receive WWW-Authenticate challenges, requiredScopes supplies step-up guidance, callback headers are preserved, and browser clients can read WWW-Authenticate and Retry-After through CORS.

• #256 510b20c Thanks @mattzcarey! - Use resourceMetadata.resource as the strict RFC 8707 resource policy. Configured deployments now require that exact resource throughout authorization, token issuance, and access-token validation. Unconfigured deployments remain interoperable by inheriting requested resources and defaulting omitted authorization resources to the request origin.

• #273 cd5e96a Thanks @mattzcarey! - Validate configured scopes and registered OAuth client capabilities. Dynamic registration now applies RFC 7591 defaults, rejects unsupported or inconsistent authentication, grant, and response types before storage, and applies the same capability checks to CIMD metadata.

Patch Changes

• #254 79270da Thanks @mattzcarey! - Tighten Client ID Metadata Document validation by requiring a non-empty client_name and accepting only the currently implemented public-client authentication method, none. Support OpenID RP Metadata Choices by selecting none from token_endpoint_auth_methods_supported, including ChatGPT-style documents that also advertise private_key_jwt.

• #273 cd5e96a Thanks @mattzcarey! - Fail closed when ID-JAG assertions contain unsupported authorization_details or cnf authorization constraints. These claims now produce a generic invalid_grant response before replay reservation, mapping, or token storage.

• #258 8883c0a Thanks @mattzcarey! - Validate refresh-token resource parameters before invoking callbacks, rotating refresh tokens, or writing grant state. Invalid or out-of-grant resource requests now return invalid_target without mutating the authorization grant.

• #247 9d045d2 Thanks @agent-think! - Return RFC-compliant 401 invalid_client responses for malformed HTTP Basic client credentials, recognize the Basic scheme case-insensitively, and include the required Basic challenge on authentication failures.

• #252 fdba134 Thanks @mattzcarey! - Return a bare RFC 6750 bearer challenge when protected resource requests omit credentials or use an unsupported authorization scheme. These responses no longer mislabel absent credentials as invalid_token or include OAuth error details.

• #273 cd5e96a Thanks @mattzcarey! - Require ID-JAG assertions to identify exactly one authorization server audience. Multi-element, duplicate, empty, malformed, and mismatched audience arrays are now rejected before authorization state is written.

• #275 ee5b487 Thanks @mattzcarey! - Reject unsupported PKCE code_challenge_method values instead of treating them as plain. Discovery and request validation now share one PKCE capability policy, completeAuthorization() revalidates reconstructed requests, and token exchange fails closed for malformed grants created by older versions.

• #276 94cc3db Thanks @agent-think! - Enforce each client's registered token_endpoint_auth_method when authenticating token and revocation endpoint requests.

• #271 0fa9bd5 Thanks @mattzcarey! - Replace internal env: any parameters with typed shapes. Internal provider methods now take Env & ProviderEnv (where ProviderEnv declares the required OAUTH_KV: KVNamespace binding), ResolveExternalTokenInput threads the Env generic through to the resolveExternalToken callback, and OAuthHelpersImpl is generic over Env. No runtime behavior change.

• #273 cd5e96a Thanks @mattzcarey! - Validate authorization response types in both parseAuthRequest() and completeAuthorization(). Missing, unsupported, and client-disallowed values are rejected after client and redirect URI validation but before grant creation or existing-grant revocation.