09/01/2026
- release 2.4.20.3

08/30/2026
- util/appinfo: join array claims and propagate a token's claims in linear instead of quadratic memory
  and time, so a large or claim-heavy token cannot exhaust or stall a worker (OSS-Fuzz 554464974)
- http: redact logged request bodies and provider responses in linear instead of quadratic memory
  (OSS-Fuzz 554483423)

08/27/2026
- proto/jwt: retry a failed no-"kid" signature verification with a forced JWKs refresh only when the keys
  came from a JWKs URI: with none configured the retry handed the HTTP layer a NULL URL and a retry
  back-off, a delay any client could trigger with a bad token (found by the new fuzz targets)
- session: drop the stale oidc_session_set_client_id() prototype that had no definition
- test/fuzz: add seven fuzz targets for the browser/internet-facing surfaces -- the back-channel logout
  endpoint, the authorization response, the Host/X-Forwarded-*/Forwarded parsers, OAuth resource-server
  bearer tokens, the redirect_uri dispatcher, POST preservation and the request string helpers -- and run
  the chunked-cookie reassembly and state-cookie sweep in fuzz_cookie; 19 targets in total

08/24/2026
- http/handle: build the authorization request's query string (and POST auto-submit form) in a single
  join instead of re-printing the accumulated string per parameter, which made the memory (and CPU)
  quadratic in the parameter count; a client can drive that count through "auth_request_params" on a
  discovery response, turning it into an out-of-memory (OSS-Fuzz 551746349, found by the
  discovery_response fuzz target)

08/23/2026
- jose: build the PEM wrapper for an "x5c" JWK element in a single allocation; re-printing the accumulated
  string per line made the memory (and CPU) spent on one key quadratic in the length of the x5c value,
  which a provider controls through its JWKs document (OSS-Fuzz 551146117, found by the jwks fuzz target);
  the same accumulate-per-element pattern is replaced in the preserved-POST parameter JSON (whose element
  count a client controls), in the published JWKs document and in oidc_util_hex_encode()
- jose: fail the import of an RSA or EC key whose required public components (n/e, x/y) OpenSSL 3.x cannot
  supply instead of dereferencing a NULL BIGNUM (OSS-Fuzz 550951150, found by the pem_key fuzz target)

08/21/2026
- test/fuzz: build the fuzz targets with the library's USE_* feature macros so oidc_cfg_t has the same
  layout on both sides; fixes fuzz_url crashing on every input in the OSS-Fuzz build

08/20/2026
- util/jose: fix a NULL-pointer crash in oidc_util_url_parameter_get() when the query string is only
  separators (e.g. "&"), reachable from any handler that reads a query parameter; also release the
  partially built key list in oidc_jwks_parse_json() when a later JWKs element fails to parse
- test/fuzz: add jwks, discovery_response and pem_key fuzz targets, and extend fuzz_jwt to verify
  and decrypt against a key set and fuzz_url to cover the OIDCRedirectURLsAllowed configuration
- ci: drop the live per-push fuzzing run and keep only the deterministic seed-corpus replay; continuous
  fuzzing is covered by OSS-Fuzz, and live-fuzzing the JWE targets against the older distro cjose made CI
  fail nondeterministically

08/19/2026
- cache/shm: serialize shared-memory operations with one cross-process mutex and use an exact
  expired-or-LRU scan only when the cache is full

08/15/2026
- cache/shm: shard hash locking, use per-segment SipHash, safely bound segment sizing, preferentially
  sweep expired slots, and rate-limit capacity warnings outside cache locks; extend pressure/concurrency tests

08/14/2026
- source/test: simplify overly detailed comments while preserving essential rationale and invariants

08/12/2026
- handle/oauth/util: reject a duplicated security-critical protocol parameter at the endpoints that
  consume it - "state"/"code"/"access_token"/"id_token" in an authorization response, "access_token"
  in a bearer-token request body/query, "logout_token" in a back-channel logout - instead of
  silently taking the last value; generic form parsing and POST preservation keep last-wins
- metadata: fail the JWKs forced-refresh throttle closed when its shared-cache lookup errors instead
  of reading the error as "not throttled", and stop a throttled or failed forced refresh from falling
  through to a second unguarded fetch: during a cache outage that let every request carrying an
  unknown "kid"/"x5t" drive a synchronous OP JWKs fetch and pin a worker thread. An ordinary initial
  cache miss is still fetched normally (not throttled)
- proto/handle: log a warning when the cache read or write behind nonce / logout-token "jti" replay
  detection returns an error, instead of silently ignoring it: the cache API distinguishes a miss
  from a backend error, and a backend error still fails open (accepts) as before, but is now visible
- session: store session timestamps as full 64-bit seconds instead of narrowing them through an
  (int) cast: an expiry past January 2038 wrapped negative on persist and then read back as
  already-expired, sending the user round the authentication loop. Wire-compatible: values below
  2^31 serialize identically
- json: reject a successfully parsed non-object (e.g. a top-level array) from
  oidc_json_decode_object_err even when logging is disabled: the log flag controlled rejection as
  well, so a userinfo response that was a JSON array was accepted as claims instead of being
  retried as a JWT
- proto: saturate out-of-range JWT "exp"/"iat" timestamps instead of casting an arbitrary JSON
  number to apr_time_t (undefined behaviour): compare "exp" in the double domain and route session
  expiry through oidc_util_apr_time_from_sec, so a signed but far-future ("exp":1e300) token can no
  longer flip validity or wrap the stored expiry depending on the platform
- cache: NUL-terminate the file-cache value buffer (allocate len + 1) so a corrupt or externally
  planted cache file whose data is not \0-terminated cannot make a caller over-read past it
- util: reject a value that is not an importable, GCM-authenticated JWE in oidc_util_jwt_verify
  instead of passing it back verbatim as if it had been verified (fail-open hardening)

08/11/2026
- jose: stream brotli decompression into a growing buffer instead of a fixed 4 * input_len one,
  which made any payload that compressed better than 4:1 unreadable
- util: remove the undocumented OIDC_JWT_INTERNAL_STRIP_HDR environment variable: stripping the
  internal JWE header was mutually broken with a rotating (two-secret) OIDCCryptoPassphrase
- util/metadata: follow symlinks when reading operator-managed files (provider/client metadata,
  HTML templates, keys) and require the target to be a regular file, instead of refusing the
  symlink itself
- metadata: serve the in-memory provider metadata when live discovery succeeded and validated
  but only the disk write of the cache file failed
- jose: pass a payload that zlib cannot fully inflate through instead of failing the read: the
  two-byte header heuristic has false positives among raw cache values ("80...", "HK...") and
  inflate() cannot always disprove one - a fixed-Huffman continuation emits literal bytes
  before the stream turns invalid - so partial output no longer makes the failure fatal; only
  the decompression-bomb cap still fails hard. Also pass a heuristic match through in a build
  without zlib (which never wrote zlib itself) instead of erroring out
- session: killing a session no longer deletes the per-user "sub" logout index when it points
  at a surviving session of the same user: the index is a single slot shared by all of that
  user's sessions (last writer wins), so logging out - or merely expiring - an older session
  removed the entry for the newest one and a back-channel logout token carrying only a sub
  (Back-Channel Logout 1.0 allows omitting the sid) silently no longer terminated it
- config: only read the "<alg>[+<alg>...]@" key tuple prefix as an algorithm list when every
  token names a known JOSE algorithm exactly: a kid containing '@' (key@example.org) or a
  slash-less server-root-relative filename (cert@2024.pem) in OIDCPublicKeyFiles /
  OIDCPrivateKeyFiles / OIDC(Provider|OAuth)VerifyCertFiles was misread as an algorithm -
  failing startup, or, when the segment happened to pass oidc_alg2kty()'s two-character match
  ("RSbank"), silently truncating the kid and publishing a bogus "alg" in the RP JWKs
- http: register the curl easy-handle pool's cleanup after the process cleanup: pool cleanups
  run last-in-first-out, so the pooled handles were curl_easy_cleanup()d only after
  oidc_process_cleanup had already run curl_global_cleanup() - undefined behavior in libcurl
  that can crash a process that both served requests and destroys its configuration pool (the
  Windows winnt MPM child, httpd -X) at shutdown or restart
- proto: share the duplicate guard's directive-added key tracking across OIDCAuthRequestParams
  and the per-path/dynamic parameters: a key the first directive added is not one this module
  owns, so a per-path or discovery-supplied occurrence of the same key (RFC 8707 "resource" per
  audience) was dropped with a misleading warning instead of being sent alongside it
- cache/redis: do not unlock the serialized-model process mutex when the retry backoff released
  it for the sleep and could not re-acquire it: posting the semaphore twice hands the shared
  connection to two threads at once, interleaving their hiredis replies from then on
- session: drop the decoded object when rejecting a payload with a newer format version instead
  of leaving it on the session struct: the callers treat the rejection as "no session" and the
  OIDCSessionCacheFallbackToCookie load then overwrote the pointer, leaking the refcounted
  object once per rejected read in a mixed-version fleet
- proto: only fire the extra-parameter duplicate guard against parameters that were already in
  the authorization request before the directive was processed: a key repeated within
  OIDCAuthRequestParams / OIDCPathAuthRequestParams itself (RFC 8707 sends "resource" once per
  audience) collided with its own first occurrence and all but one value were silently lost
- cache/redis: flush the idle connection pool when a checked-out connection turns out dead:
  checkout only inspects hiredis' err flag, which cannot see the peer closing an idle socket, so
  after a Redis restart or server-side idle timeout each retry popped the next dead socket and
  the operation failed - bouncing an authenticated user back through login - with Redis
  perfectly reachable
- jose: pass a payload that brotli cannot decode through instead of failing the read: a libbrotli
  build assumed every non-zlib-framed payload was brotli, so a payload written uncompressed
  (OIDC_JWT_INTERNAL_NO_COMPRESS, or a writer built without brotli) made every session, state and
  encrypted-cache read fail; also make the zlib helpers available alongside brotli so a build
  defining both macros compiles
- http: use ceil division for the chunked-cookie chunk count: a value whose length is an exact
  multiple of OIDCSessionCookieChunkSize advertised a trailing empty chunk that set_cookie turns
  into a delete, so the browser stored one chunk fewer than the counter claimed and the reader
  (since it stopped accepting partial assemblies) dropped the whole client-cookie session,
  sending the affected user round the login loop indefinitely
- logout: zero the stack session struct in the back-channel/front-channel cleanup: the session
  cache load reports a sid/sub index entry whose session entry is gone (superseded login,
  eviction) as success without touching the struct, so the token-revocation step read
  uninitialized memory as a session
- metadata: actually fall back to the filename-derived issuer when a provider file carries no
  "issuer" string: the JSON getter reports an absent key as success with a NULL value, so checking
  its return code passed a NULL issuer onward and crashed in the issuer-to-filename conversion
  when listing providers

08/10/2026
- http: bound the trailing CRLF strip on a captured response header value to the value's length, so
  an empty header value cannot read (and, if the adjacent byte happens to match, write) before the
  start of the buffer
- http: return NULL instead of a truncated prefix when a chunked cookie is missing one of its
  chunks, so a broken cookie set falls back to re-authentication instead of failing session decode
  with a value that keeps getting resubmitted
- revocation: require the remove_at_cache parameter before looking up the access token cache,
  matching revoke_session's existing check, instead of probing the cache with a NULL key
- session: skip the prompt=none "user changed" check when there is no prior remote_user, so a first
  prompt=none response can establish a session instead of being rejected outright
- DPoP: reject an omitted token_type explicitly when DPoP is required, and log a placeholder instead
  of passing NULL to the error message
- util/file, cache/file: reject symlinks/non-regular files and cap read size before loading a
  metadata file or cached value into memory; metadata writes are now atomic (temp file + rename)
- metadata: preserve the issuer's scheme when listing providers, instead of assuming https and
  silently dropping HTTP-only providers from the list

08/10/2026
- remove the process-local derived-object cache tier (util/cache_local) and the five caches on it:
  parsed session state, appinfo claim pairs, provider metadata, JWKs selection and compiled
  Require-claim regexes. It was worth 24-34% of the module's own CPU, nearly all of that the
  session cache alone, which does not pay for the concurrency and teardown surface it added
- add OIDCDebugMaskSecrets, a server-level directive that turns off the masking of secrets and
  tokens in the debug log for short-lived troubleshooting; it defaults to On and warns at startup
  for as long as it is Off
- cache/file: report an expired entry as a miss without unlinking it, leaving that to the cleaning
  cycle; a writer's rename could land in between and the unlink then threw away the entry that had
  just replaced it
- cache/file: have the cleaning cycle confirm an entry is still the file it inspected before
  removing it, so it cannot unlink an entry a writer replaced in the meantime either
- cache/shm: compute the per-slot value size limit signed, so it cannot wrap into a huge limit when
  the configured slot size is smaller than the entry header
- do not strand a failed regular-expression compile in the pool it was handed: oidc_pcre_compile
  now allocates nothing unless the compile succeeds, and takes a NULL error_str
- release 2.4.20.2

08/09/2026
- store the process-local JWKS selection cache serialized and give each request its own parsed
  copy, instead of sharing imported keys that could never be released; a worker no longer retains
  another set of keys per OIDCJWKSRefreshInterval for the life of the process, at the cost of
  parsing the one or two selected keys per request
- fix a data race on the process-local caches' last-access stamp, which was written under the
  read lock; it is now a whole-second value updated atomically, which is the resolution the
  eviction order already had
- do not leak a process-local cache's private pool when its creation fails part-way, and count an
  entry dropped by a declining rebuild towards the compaction that reclaims its key
- reduce the process-local cache to two operations, get_use and set_build, both of which run the
  caller's callback under the lock, so that no cached pointer outlives it
- only infer the OpenID Connect RP role from an OIDCRedirectURI that a vhost sets itself, not from
  one it inherited from the base server: a server-level redirect URI lands in the merged config of
  every vhost, including those that do no OpenID Connect at all (a static site, a health check, a
  redirect-only vhost), and refusing to start over one of those would take down the whole server
  for a configuration that worked before
- name the (virtual) host in the messages of the post-config check: httpd does not record which
  server_rec a startup message was logged against, so with more than one vhost neither the refusals
  nor the warnings said which one to fix
- release 2.4.20.1

08/08/2026
- do not lose an uncompressed payload whose first two bytes happen to look like a zlib header:
  19 printable two-character prefixes satisfy that test ("x ", "H,", "80", "X(", "h$", ...), and
  cache values -- unlike sessions and state cookies -- are arbitrary strings, so such a value was
  declared compressed, failed to inflate and was silently dropped. Only reachable when payloads
  are written uncompressed (OIDC_JWT_INTERNAL_NO_COMPRESS, or a build with neither zlib nor
  brotli). A payload that does start inflating and then fails is still reported as an error
- performance: grow the decompression buffer by doubling rather than by a fixed 8KB chunk;
  inflating up to the 10MB cap took ~1280 rounds and left 6.25GB of dead buffers behind in the
  request pool, which is the outcome that cap exists to prevent. It now costs under 30MB
- fix oidc_proto_jwt_header_peek handing back no key id to a caller that asks only for the "kid"
- test: raise line coverage from 94.2% to 95.6% and start measuring branch coverage (54.9%),
  both gated in CI; the test suite no longer runs twice per coverage job

08/07/2026
- recognize whether a stored payload is compressed instead of assuming the local setting, so a
  session survives a change to OIDC_JWT_INTERNAL_NO_COMPRESS and is readable across servers
  built with and without compression; previously flipping that variable handed the compressed
  bytes back as the session contents. The written format is unchanged.
- stamp the session payload with a format version and discard a session written in a newer
  format instead of misreading it; sessions written before this carry no version and still
  load, so upgrading and downgrading are both unaffected
- docs: correct five wrong statements in auth_openidc.conf about the defaults of
  OIDCMemCacheConnectionsMin, OIDCHTTPTimeoutShort, OIDCClientName, OIDCResponseMode and
  OIDCProviderMetadataRefreshInterval
- security: give each process-local cache its own memory pool instead of sharing one across all
  five, which let two threads in two different caches allocate from that pool concurrently
  under different locks (threaded MPMs only)
- performance: re-check the entry under the write lock when replacing a process-local cache
  entry, so concurrent refreshers no longer each rebuild it
- performance: release the cross-process refresh mutex while backing off for a refresh that
  another caller is performing, so one waiter no longer blocks every refresh on the machine
- security: do not revoke a session's tokens at the OP on an unauthenticated front-channel
  logout that names it only by sid, matching what the back-channel handler already did
- security: do not let an extra authorization request parameter duplicate one that the
  module sets itself; a request-supplied one is dropped and a configured one replaces
  ours, rather than both being sent and the provider deciding which wins
- security: HTML-escape the three values still interpolated raw into an attribute on a
  generated page: the redirect URI in the discovery page's provider links and form action,
  which a relative OIDCRedirectURI resolves against the request's host, and the provider's
  authorization endpoint in the auto-POST form
- security: start a new session on login instead of writing the newly authenticated
  identity into whatever session id the browser presented, which let anyone able to set a
  cookie for the host keep a handle on the session and leave state in it beforehand;
  server-cache sessions only, but client-cookie sessions are re-keyed too
- security: ignore the "scopes" and "auth_request_params" query parameters unless the
  Discovery response passes CSRF validation; they shape the authorization request and are
  documented as values returned from the Discovery page, but were honoured on 3rd-party
  initiated SSO too, so any cross-site link could choose the scopes a session ends up with.
  NB a deployment that passes either of these on a 3rd-party initiated login URL will now
  see them ignored, with a warning logged
- security: require the "iat" and "jti" claims in a back-channel logout token, both of
  which OpenID Connect Back-Channel Logout 1.0 makes REQUIRED; without them a captured
  logout token stayed valid indefinitely and its replay was undetectable
- security: redact the credentials that were written verbatim to the log: the provider's
  response body, the authorization code and tokens parsed out of a front-channel response
  or back-channel logout request, the unhashed cache key (which is the session id or a
  token, and was logged at warning level), a refresh token and full cookie values
- security: scrub client-supplied OIDC_* headers on the request paths that are let
  through without authentication - the CORS preflight (OPTIONS) shortcuts and the two
  redirect-URI/JWKS content-handler dispatches - so a forged claim header cannot reach
  the application on a request where no authentication took place
- cfg: accept "OIDCSessionCookieChunkSize 0", which auth_openidc.conf and the directive
  help both document as the way to disable chunking, and which the runtime already
  honours, but which the parser rejected as below the 256 minimum
- test: fail the build when auth_openidc.conf has drifted from the code: every directive
  must be documented, every documented directive must exist, and the OIDCMetricsData
  class list must match the metrics classes the parser accepts
- doc: correct 17 directive descriptions shown by "httpd -L", most importantly the three
  OIDCUserInfo*ResponseAlg entries, which claimed to apply only to dynamic client
  registration although they are required to verify and decrypt a UserInfo JWT
- doc: correct the OIDCMetricsData class list in auth_openidc.conf, which offered an
  invalid "requests" class that makes Apache refuse to start, omitted "provider" from
  the syntax line and omitted the "logout" class entirely
- metrics: flush on a scratch pool and serve a scrape from the request pool, rather than
  copying and re-serializing the whole document onto the never-cleared process pool
- metrics: build the per-sample lookup key on the request pool, so only the copy the
  hash retains on insert is allocated from the never-cleared process pool
- cache: fail a file cache write when the value could not be fully written, instead of
  reporting success and leaving a truncated entry that only fails on the next read;
  also drop the partially written temporary file rather than leaking a locked fd
- metrics: add counters and timers for the remaining outbound provider calls and
  operational events: JWKs retrieval, pushed authorization requests, dynamic client
  registration, token revocation, DPoP nonce retries, back-channel logout outcomes,
  session-cache-to-cookie fallbacks and cache operation retries
- metadata: avoid a NULL pointer dereference (segfault) when the OP selection/discovery
  page is served while no OIDCMetadataDir is configured, and catch an RP vhost that
  configures OIDCRedirectURI without any provider source at startup
- test: increase unit test line coverage from 91% to over 94% with negative-path and
  option-matrix tests across the http, jose, session, cache, oauth and handler code
- test: fail the fuzz seed corpus replay when no target actually ran, instead of
  reporting a pass after skipping all of them
- jose: test the compression backend macro with "#elif defined(USE_ZLIB)", matching
  the "#ifdef USE_LIBBROTLI" above it and keeping the file -Wundef clean
- src: drop the include of mod_auth_openidc.h from 11 files that use nothing from it,
  and include session.h directly in session.c, which was picking it up transitively
- ci: set an explicit GITHUB_TOKEN permission scope on all three workflows, which ran
  at the repository default; only the issue-triage job gets a write scope
- configure: fail when --with-jq is given but libjq is absent, instead of silently
  building a module with the claims-expression directives compiled out
- proto: pass the server config in explicitly rather than looking it up from the global
  module config, so no protocol code depends on a live Apache server record
- ci: promote -Wformat-security, -Wimplicit-fallthrough and -Wpointer-arith to errors
  on the gcc and clang legs, which the tree already passes
- test: cast the seven size_t lengths that were narrowed implicitly to int/unsigned,
  so the suite also builds clean under the clang leg's -Wshorten-64-to-32
- ci: run "make check" on the clang static-analysis leg too, so those type checks
  cover the test suite rather than only the module sources
- ci: pin the third-party GitHub Actions by commit SHA instead of by mutable tag
- configure: fail when --with-hiredis is given but hiredis is absent; the unflagged
  default still probes and degrades silently, as its help string advertises

08/03/2026
- metrics: fix the description of the "authtype.handler" timer, which read
  "authz+authz" instead of "authn+authz". The string is published verbatim in
  the Prometheus "# HELP" line and in the description field of the JSON format,
  so it was user-visible output, not just an internal comment

08/01/2026
- release 2.4.20

07/31/2026
- refresh: validate a refreshed id_token before applying it to the session.
  oidc_refresh_token_grant_apply_id_token took the id_token returned by the token
  endpoint apart with a bare oidc_jwt_parse and stored its claims unconditionally:
  no decryption keys, no signature verification and none of the payload checks. It
  now runs the same oidc_proto_idtoken_parse as the id_token obtained at
  authentication time, as OpenID Connect Core 1.0 section 12.2 requires - keeping
  the section 3.1.3.7 item 6 exception for an unsigned id_token received over the
  TLS-protected back-channel, which a refresh response is - and additionally
  refuses a refreshed id_token whose "sub" differs from the one the session was
  established with. An id_token that does not validate no longer contributes its
  claims, is no longer stored in its serialized form and is no longer handed back
  to the caller; the refresh grant itself still succeeds, so the refreshed access
  token is unaffected. Thanks to Sun Liqiang for reporting the missing signature
  verification

07/30/2026
- metadata: report an "mtls_endpoint_aliases" entry that is not a valid URL as
  an error instead of quietly using the conventional endpoint for it. RFC 8705
  section 5 has the client use the alias for the endpoints that are listed, and
  the conventional endpoint is precisely the one that does not bind the access
  token to the TLS client certificate, so the fallback silently produced the
  unbound tokens the aliases exist to avoid. An endpoint the aliases do not
  mention at all still falls back, as it should
- build: parenthesize the arithmetic in the object-like macros defining size and
  interval bounds; no behaviour change, since every current use happens to sit
  in a context where the operators bind the intended way
- util: size the output buffer of a regular-expression substitution from what
  the result actually needs, so OIDCRemoteUserClaim/OIDCOAuthRemoteUserClaim no
  longer fail on a long claim value. The buffer was fixed and the input was
  capped at 254 characters to compensate - a limit taken from an unrelated
  constant (the maximum number of capture groups) and reported as "the maximum
  allowed for pcre_subst". The remaining cap on the input is now its own
  constant, at 4096 characters
- oauth: clamp a token expiry claim instead of letting it wrap. A NumericDate is
  a JSON number, so it may carry a value no integer type can hold; converting
  one that does not fit is undefined, and converting seconds to the internal
  microsecond representation multiplies by a million, which wraps into a
  negative - i.e. already expired - timestamp somewhere beyond the year 292277.
  A far-future expiry therefore made the validation result uncacheable, turning
  every request into an introspection call. The same conversion of an id_token
  "exp" when refreshing the session is clamped as well
- dpop: apply the FAPI 2.0 "mutual-TLS or DPoP" rule to a statically configured
  OP too, i.e. one whose endpoints are all set with OIDCProvider* directives
  rather than obtained from OIDCProviderMetadataURL or OIDCMetadataDir. Standing
  down from mandating DPoP relied on OIDCCertBoundAccessTokens having been
  resolved while parsing the provider metadata, which never happens for such an
  OP, so DPoP was still required of it and only an explicit
  OIDCCertBoundAccessTokens "on" worked around it
- session: refuse to write a client-side session cookie that would have to be
  split over more chunks than can be read back. The reader rejects a chunk
  count above 99 but the writer had no bound at all, so a session larger than
  99 times OIDCSessionCookieChunkSize was written out and then dropped on the
  very next request, sending the user round the authentication loop for ever
  rather than failing visibly. With the default chunk size of 4000 that needs a
  ~400Kb session, but OIDCSessionCookieChunkSize can be set as low as 256, at
  which point ~25Kb is enough. It is now an error naming both the chunk size
  and OIDCSessionType "server-cache" as the ways out
- http: redact every occurrence of a sensitive parameter in the debug log of an
  outgoing request body, and only match a parameter name at a parameter
  boundary so that e.g. "xcode=" is no longer taken for "code=". The scan
  restarted from the beginning of the body after each rewrite, where it kept
  finding the "<name>=***" it had just written, so a second occurrence was
  never reached and three quarters of the work was a no-op repeated on every
  outgoing HTTP call regardless of the log level
- util: fix an out-of-bounds read in the "$<n>" replacement handling used by
  OIDCRemoteUserClaim/OIDCOAuthRemoteUserClaim, in builds against libpcre 1.x
  (the libpcre2 path is unaffected). A group reference one past the number of
  capture groups the pattern actually has was accepted, and the arrays holding
  the captured substrings were cleared with a byte count instead of their size,
  leaving all but the first few entries holding stack garbage. So a replacement
  referring to e.g. "$2" against a pattern with a single capture group could
  size the output buffer from an uninitialized length and copy from an
  uninitialized pointer, crashing the child process or overflowing the heap
- metadata: obtain RFC 8705 section 3 certificate-bound access tokens with a
  configured TLS client certificate (OIDCClientTokenEndpointCert/Key) when that
  certificate is not used for client authentication, e.g. alongside
  private_key_jwt or client_secret_basic. Until now the "mtls_endpoint_aliases"
  endpoints of the OP and the "tls_client_certificate_bound_access_tokens"
  client registration parameter were tied to the mutual-TLS client
  authentication methods, so a certificate presented for token binding only
  kept talking to the conventional endpoints and silently ended up with
  unbound tokens against an OP that separates the two. The new
  OIDCCertBoundAccessTokens directive controls it: "auto" (the default) also
  applies the aliases when a certificate is configured and the OP advertises
  "tls_client_certificate_bound_access_tokens", "on" does not require the OP to
  advertise it and "off" restores the previous behaviour of never inferring it
  from the certificate alone. FAPI 2.0 (OIDCProfile) implies "on". The same
  applies to the introspection endpoint on the OAuth 2.0 Resource Server side,
  and it can be set per OP in the .conf metadata with the "cert_bound_tokens"
  key
- metadata: take the RFC 8705 mutual-TLS decisions - which token endpoint
  authentication method to select out of
  "token_endpoint_auth_methods_supported" and whether to prefer the
  "mtls_endpoint_aliases" endpoints - against the settings of the OP they are
  about. They were taken while parsing the provider metadata, i.e. before the
  .conf metadata of that OP was applied, so in a multi-provider
  (OIDCMetadataDir) setup a TLS client certificate ("token_endpoint_tls_client_
  cert") or profile ("profile") configured there went unnoticed and its OP kept
  talking to the conventional endpoints with unbound access tokens; only the
  global OIDCClientTokenEndpointCert/OIDCProfile had any effect
- metadata: apply an "mtls_endpoint_aliases" registration_endpoint (as
  advertised by e.g. the OpenID Foundation conformance suite) to dynamic client
  registration too, and present the configured TLS client certificate on the
  registration request like at the other endpoints
- dpop: do not require DPoP under OIDCProfile "FAPI20" when the access tokens
  are sender-constrained through RFC 8705 mutual-TLS certificate binding
  instead: FAPI 2.0 Security Profile section 5.3.2.1 allows either mechanism,
  while DPoP was mandated unconditionally - and could not be turned off, since
  the profile overrode OIDCDPoPMode - which broke the mutual-TLS variant of the
  profile against an OP that does not support DPoP at all (the token endpoint
  call failed on the "Bearer" token type it returns). An OP that advertises
  "dpop_signing_alg_values_supported" keeps requiring DPoP, so this never
  downgrades an OP that offers it; OIDCDPoPMode/"dpop_mode" now applies under
  FAPI 2.0 for the certificate-bound case and can ask for DPoP on top
- metadata: never override an explicitly configured endpoint URL
  (OIDCProviderTokenEndpoint, OIDCProviderUserInfoEndpoint,
  OIDCProviderRevocationEndpoint,
  OIDCProviderPushedAuthorizationRequestEndpoint) with an
  "mtls_endpoint_aliases" entry from the provider metadata; the precedence is
  now explicit configuration, then the mutual-TLS alias, then the conventional
  metadata endpoint

07/29/2026
- dpop: re-create the token endpoint client authentication when retrying a token
  endpoint call with a server-provided DPoP nonce: a client_secret_jwt or
  private_key_jwt assertion carries a one-time jti and a 60-second exp, so
  resending the assertion of the "use_dpop_nonce" attempt could be rejected by
  the OP as a replay
- jwks: make the forced-refresh overload guard configurable with the
  OIDC_JWKS_FORCED_REFRESH_INTERVAL environment variable (0-3600 seconds, 0
  disables it) instead of fixed at 60; an out-of-range or non-integer value is
  ignored with a warning and the default applies
- id_token: accept an unsigned (alg "none") id_token obtained over the
  back-channel again when the signing algorithm has been pinned to "none"
  itself, through OIDCIDTokenSignedResponseAlg or the client metadata. Since
  2.4.19.4 any pinned algorithm suppressed the "code"-flow exception that
  OpenID Connect Core 1.0 section 3.1.3.7 item 6 allows, so a pin of "none" -
  the way an operator, or the OP's own client registration, declares that this
  OP issues unsigned id_tokens - demanded a signature that cannot exist and
  failed every login. A pin of any other algorithm still overrides the
  exception and rejects the unsigned token, and an unsigned id_token received
  over the front channel is still rejected in all cases
- request: make the scope=openid parameter that accompanies a request_uri on the
  authorization request dependent on the configured OIDCProfile: OpenID Connect
  Core 1.0 requires it, but FAPI 2.0 Security Profile section 5.3.3.2 allows the
  client_id and request_uri parameters only, so it is now omitted when the
  profile is FAPI20; this fixes a regression for FAPI 2.0 deployments introduced
  in 2.4.19.3 (and present in 2.4.19.4), which sent the parameter unconditionally

07/28/2026
- security: never log the credentials that an OIDCRedisCacheServer value may
  carry: the value is echoed verbatim when it fails to parse, and the failover
  backend accepts per-server credentials in it as
  [<username>:<password>@]<host>:<port>, so a misconfigured value could put a
  password in the error log; the credentials part of each comma-separated tuple
  is replaced with a placeholder now
- security: don't log the cached value when the sanity check on a Redis reply
  fails: the length mismatch that check guards against is a property of the
  reply, not of its content, so report the two lengths instead of the value,
  which is cached (session) data that has no business in the error log
- session: take the OIDCSessionCacheFallbackToCookie fallback when the cache has
  no entry for the session cookie, not only when the cache reports an error. On a
  save that cannot reach the cache the module stores the whole session in the
  cookie, but the load treated that cookie as a stale cache key: it deleted the
  cookie and returned success, so the fallback branch never ran and the user was
  sent round the authentication loop on every request. A backend whose writes fail
  while its reads report a plain miss - a file cache on a directory it cannot
  write to - hit this on every request

07/27/2026
- security: add OIDCOAuthVerifyAudience and OIDCOAuthVerifyIssuer to bind
  locally validated JWT access tokens to this resource server. The local
  (non-introspection) OAuth 2.0 Resource Server path verified only the
  signature of a JWT access token: neither "aud" nor "iss" was checked, and no
  directive existed to configure what to check them against, so any token
  signed by the configured key (set) was accepted - including one that the
  Authorization Server issued for a completely different resource server, whose
  claims were then used to set REMOTE_USER (RFC 9068 section 4).
  OIDCOAuthVerifyAudience takes one or more identifiers of this resource server
  and accepts a token when its "aud" claim - a string or an array - contains at
  least one of them; OIDCOAuthVerifyIssuer matches the "iss" claim. Both are
  also applied to claims served from the validation cache, which is keyed on
  the token and the crypto passphrase and therefore shared between vhosts that
  inherit the same OIDCCryptoPassphrase. When neither is configured nothing
  changes, so existing deployments keep working; a startup warning is logged
  when JWT access tokens are validated locally without an audience configured.
  As an alternative (or in addition) the audience can be enforced in the
  authorization policy with "Require claim aud:<value>", which works on earlier
  releases as well. Note that the OAuth 2.0 Resource Server functionality has
  been deprecated since 2.4.0 and is superseded by mod_oauth2. Reported by
  EQSTLab, see:
    https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-wcvh-g65p-v576
- security: require the "exp" claim in locally validated JWT access tokens: it
  was optional, so a JWT access token without an expiry was accepted forever
- fix: accept a token expiry claim that carries a non-integer value: a
  NumericDate is a JSON number and may hold a fraction (RFC 7519 section 2), but
  the claim was read back as a JSON integer when it bounds the validation cache
  entry, whereas it is verified as a JSON number. A JWT access token with a
  fractional "exp" was therefore cached for the 60 second default instead of
  until its expiry, and an introspection result whose expiry claim was
  configured as mandatory (OIDCOAuthTokenExpiryClaim ... mandatory) was rejected
  outright, failing the whole introspection

07/22/2026
- perf: give the process-local derived-object caches a proper LRU eviction and
  an overflow warning: on a full cache the least-recently-used entry is evicted
  (retaining the hot working set) instead of clearing the whole cache, and a
  rate-limited warning is logged when a still-recently-used entry has to be
  evicted so an operator can tell the cache is undersized for the concurrency;
  the session and appinfo cache defaults are raised (500->2000, 256->1000) for
  high-concurrency deployments (e.g. OIDCCacheShmMax-sized session stores)
- fix: cache/shm: anchor the shm segment (and round the per-slot stride) to a
  64-byte boundary so the aligned(64) entry slots really are 64-aligned; without
  this the compiler's aligned SIMD stores into an under-aligned slot fault
  (SIGSEGV) on builds that vectorize them (e.g. amazonlinux 2023's
  -march=x86-64-v2)
- refactor: consolidate the five per-file process-local derived-object caches
  (compiled authz regexes, parsed provider metadata, parsed session state,
  flattened appinfo claim pairs, selected JWKs) onto a single reusable
  util/cache_local module, so the rwlock, write-lock-only pool allocation,
  bounding/reset, config-reload owner-reset and pool-cleanup ordering live in
  one tested place instead of being re-implemented in each cache; behavior is
  unchanged (same keys, freshness validators and refcount/retire semantics)
- perf: check Redis connections out per request from a per-process idle pool
  instead of serializing every worker thread's network round-trip on one
  shared connection under a mutex; the mutex now only guards the (short) pool
  push/pop, a connection-level failure tears down only the request's own
  connection (the retry then reconnects), and setting OIDC_REDIS_MUTEX_GLOBAL
  restores the legacy single-connection global-lock model; the
  cluster/sentinel/failover backends keep their existing serialized model
- perf: extend the parsed-session cache to client-cookie sessions, with the
  cookie value acting as both cache key and validator, so an unchanged session
  cookie skips the per-request JWE decryption, decompression and JSON parse; a
  full authenticated request with client-cookie sessions measures 50% faster
  (35.8us -> 18.0us), on par with server-cache sessions
- perf: keep a small pool of reusable libcurl easy handles instead of creating
  and destroying one per outbound call: a reused handle retains its connection
  cache, DNS cache and TLS session cache, so consecutive requests to the same
  endpoint (token, userinfo, introspection, JWKs, metadata) reuse the TCP/TLS
  connection instead of paying DNS + TCP + TLS handshake every time; handles
  whose request failed are destroyed rather than reused, handles inherited
  over fork() are dropped in the child (their connections share descriptors
  and TLS state with the parent), and TCP keepalive is enabled on outbound
  connections
- perf: index the shm cache with an in-segment hash table (bucket chains plus
  a free list, 1-based slot indexes) instead of linearly scanning all slots on
  every get/set while holding the global mutex: operations become O(chain)
  independent of OIDCCacheShmMax - at just 500 slots a miss measures 87%
  faster (1136ns -> 149ns) and a set 72% faster (963ns -> 268ns), with the
  gap growing linearly with the slot count (default 10000) - and the mutex
  hold time shrinks accordingly for all worker processes; a full cache evicts
  via bounded random sampling picking the least-recently-used of the sample
  (the Redis approach) rather than a full LRU scan
- perf: cache the flattened claim name/value pairs (header-name construction,
  value rendering of object/array claims, base64url/latin1 encoding) keyed by
  the identity of the shared claims object from the parsed-session cache, so
  the per-claim flattening work runs once per session change instead of on
  every request; each entry pins its claims object through a JSON reference
  so the pointer key cannot be reused while cached; a full authenticated
  request measures another 8% faster (18.1us -> 16.6us), more with
  object/array-heavy claim sets
- perf: release the Redis serialization mutex while sleeping between
  connect-retry attempts (default 300ms): other worker threads in the process
  can then proceed (and fail fast themselves) instead of queueing behind the
  sleeping thread for the whole interval on a transient Redis outage
- perf: compress internal encrypted JWTs (state/session cookies, encrypted
  cache values) with deflate level/window/memory parameters sized for their
  small payloads instead of Z_BEST_COMPRESSION with a 32KB window, cutting the
  ~256KB of per-call zlib allocations by an order of magnitude and halving the
  envelope creation cost (51us -> 21us for a 3KB session) at ~1% ratio loss;
  zlib streams are self-describing so old and new binaries decode each other's
  values unchanged
- perf: hoist the string-length evaluation out of the per-character loop in
  oidc_http_hdr_normalize_name (was re-evaluated every iteration)
- perf: keep the parsed session state of server-cache sessions in a per-process
  cache keyed by session id and validated against the raw cached session
  document, so the multi-KB JSON parse of the session runs only when the
  session actually changed; the parsed object is shared read-only (requires
  atomic JSON reference counting, disabled otherwise) and the session setters
  copy-on-write for the rare mutating request; a full authenticated request
  through the authentication + authorization hooks measures 44% faster
  (31.5us -> 17.8us)
- perf: keep parsed provider metadata from the metadata directory in a
  process-level cache validated by the file's mtime+size, so the per-request
  disk read + JSON parse of the provider .provider file only happens when the
  file actually changed; requires the JSON library's atomic reference counting
  (the cache stays disabled otherwise) and multi-process consistency is
  retained through the shared file's timestamp
- perf: hand out JWKs-cache keys as shared objects instead of per-request
  refcounted copies: cjose's key refcount is not atomic, so the previous
  copy-with-retain on the (concurrent) cache read path was a data race under
  threaded MPMs; shared keys are marked so oidc_jwk_destroy leaves the backend
  object alone, and purged/replaced keys are retired until pool cleanup since
  in-flight requests may still use them
- perf: restore the parsed id_token/userinfo/scope request state from the
  previous request on internal redirects (ErrorDocument, mod_rewrite) instead
  of re-loading and re-parsing the whole session from the cache; the session
  reload remains as a fallback when the previous request carries no state
- perf: cache parsed JWKs selection results per process keyed by
  (jwks-uri, kid, x5t, kty) so repeated JWT validations against the same
  signing key skip the per-validation JSON decode of the JWKs document and
  the bignum-parsing cjose key imports (~4us per RSA key import); entries
  expire in lockstep with the JWKs refresh interval, a forced refresh
  (suspected key rollover) purges the cache, and the refcounted cjose keys
  keep request-held copies safe across a purge
- perf: take a shared (instead of exclusive) file lock when reading file-cache
  entries so concurrent requests reading the same (session) entry no longer
  serialize; writers are unaffected (they write a temp file and atomically
  rename it) and the expiry cleaner's exclusive lock still excludes readers;
  tolerate a concurrent reader having already removed an expired entry
- fix: authorization regression (some "Require claim" checks that should grant
  wrongly denied with 401) from memoizing the merged authorization claim set in
  the request state across a request; Apache evaluates the authorization
  provider in phases/subrequests where the underlying claim state differs, so
  the cached merge could go stale - build it fresh for each evaluation again
- perf: register request-state JSON cleanups on the main request's pool so a
  subrequest can no longer tear down state the main request still uses;
  introduces oidc_request_state_json_set_new (ownership-transferring)
- perf: cache locally validated JWT access token claims keyed by the token and
  bounded by its "exp" claim (60s without one), mirroring the existing
  introspection-result cache, so repeated resource-server requests with the
  same bearer token skip decryption-key setup and signature re-verification;
  OIDCOAuthTokenIntrospectionInterval semantics apply: -1 disables the cache
  and a value > 0 bounds result reuse (e.g. to pick up JWKs key rotation)
- perf: cache compiled Require-claim regular expressions for the lifetime of the
  server process instead of recompiling them on every authorization evaluation;
  a full "Require claim <name>~<regex>" evaluation measures 43% faster
  (1374ns -> 782ns)
- perf: replace the curl-based URL encode/decode in http.c with a plain RFC 3986
  percent-codec, avoiding a throwaway CURL handle init/cleanup plus heap churn
  on every call; measures 10x faster (761ns -> 74ns per encode)

07/21/2026
- proto/token: fix a NULL-pointer dereference (Apache worker crash) when the
  token endpoint returns a "use_dpop_nonce" error while DPoP is disabled
- util/jq: fix a negative OIDC_JQ_FILTER_CACHE_TTL causing jq filter results to
  be cached under a NULL key with an already-past expiry; only cache when the
  TTL is positive, matching the cache-read guard
- cfg/metadata: fix the globally configured OIDCProviderSignedJwksUri
  verification keys being silently dropped in metadata-directory mode when a
  provider's .conf did not itself supply a "signed_jwks_uri_key", which caused
  the signed JWKs signature verification to be skipped
- metadata: fix the client-metadata "response_types" fallback never running in
  metadata-directory mode; .conf parsing pre-set response_type to the "code"
  default, so an OP that only advertises other response types (e.g. implicit)
  was still sent response_type=code
- oauth: fix a configured OIDCProviderMetadataRefreshInterval being applied to
  the OAuth AS metadata cache expiry as microseconds instead of seconds, which
  made the metadata document re-fetched over HTTP on almost every bearer-token
  request
- metadata: fix several JSON/JWT memory leaks on the provider-metadata refresh,
  dynamic client (re-)registration and signed-JWKs validation error paths that
  accumulated over a worker process's lifetime
- cfg/parse: reject overflowing and trailing-junk integer values ("300x",
  out-of-range) that were silently accepted before, share one strict parse core
  so the lenient _oidc_str_to_int() falls back to its default (not 0) on bad
  input, stop truncating timeout values above INT_MAX microseconds, and make an
  invalid OIDCHTTPTimeoutLong/Short value fail config load instead of becoming a
  0 (infinite) curl timeout
- oauth: parse OIDCOAuthServerMetadataURL metadata into a private per-request
  config view instead of mutating the shared server config with request-pool
  memory, which was a cross-request use-after-free / data race under threaded
  MPMs (worker/event)
- cfg: fix the "method[:alg]" token/introspection endpoint-authentication pair
  merging member-wise across virtual hosts, so a vhost that re-set only the
  method wrongly inherited the base server's algorithm instead of resetting it
- metadata: fix a per-authentication heap leak of the inline "keys" from a
  provider .conf in metadata-directory mode (the parsed cjose keys were never
  released); release them with the request pool
- metadata: also release the signed-JWKs verification keys per request; a .conf
  "signed_jwks_uri_key" was parsed into an owned key set that leaked, and the
  global-keys fallback now inherits a private copy so it is cleaned up uniformly
- json: fix oidc_json_object_get_string_array pushing a NULL entry for each
  non-string array element instead of skipping it (e.g. a numeric value in a
  .conf "id_token_aud_values" array)

07/20/2026
- metrics: give the revoke-session counter a unique name
  ("request.revoke_session") instead of colliding with the session-management
  counter
- cfg/oauth: fix OIDCOAuthIntrospectionEndpointKeyPassword being lost in
  merged (virtual host) configurations
- cfg/cache: fix OIDCCacheShmMax/OIDCCacheShmEntrySizeMax explicitly set to
  their default value in a vhost not overriding a differing base server value
- proto/request_object: fix a leak of the parsed OIDCRequestObject
  configuration on the request-object-type error paths
- refactor for readability/maintainability: deduplicate security-relevant
  logic (log-redaction list, HTML/JS escaping, RFC 8705 endpoint-auth
  selection, JOSE digest/hash-length mapping, refresh-error policy, RFC 7009
  revocation, no-cache headers, per-flow response-parameter stripping), share
  one config merge-helper trio, split proto/request_object.c out of
  proto/request.c, move authentication-request emission into the handle
  layer, dispatch per-profile behavior through an ops table, add a portable
  OIDC_STATIC_ASSERT, and table-drive the authz handlers and redirect-URL
  character checks
- jose/config: support publishing an "alg" (algorithm) parameter on the keys in
  the client JWKs and duplicating a single RSA/EC key under multiple algorithms;
  OIDCPublicKeyFiles/OIDCPrivateKeyFiles now accept an optional
  "<alg>[+<alg>...]@" prefix, e.g. "enc:RSA-OAEP@<file>" publishes the key with
  "alg":"RSA-OAEP" and "enc:RSA-OAEP+RSA-OAEP-256@<file>" publishes it once per
  algorithm under distinct, alg-derived "kid"s; this lets an OP (e.g. Keycloak)
  fetch the key from OIDCClientJwksUri and select a key-management algorithm
  itself, instead of the RP having to register the encryption JWK inline

07/19/2026
- request: emit "cty":"JWT" on an encrypted request object and stop appending a
  trailing NUL byte to the JWE plaintext, so that OPs which strictly follow
  RFC 7519 section 5.2 (e.g. Keycloak) can decrypt and parse a signed-then-
  encrypted request object; previously such a request was rejected with
  "invalid_request"/"Failed to deserialize JWT" because the decrypted Nested JWT
  was neither flagged with a content type nor cleanly base64url-decodable; adds a
  "cty" field to the JOSE header struct
- add support for RFC 8705 OAuth 2.0 Mutual-TLS Client Authentication:
  "tls_client_auth" and "self_signed_tls_client_auth" can now be configured
  as the authentication method in OIDCProviderTokenEndpointAuth and
  OIDCOAuthIntrospectionEndpointAuth (and the per-provider
  token_endpoint_auth .conf key), using the TLS client certificate configured
  with OIDCClientTokenEndpointCert/Key resp.
  OIDCOAuthIntrospectionEndpointCert/Key; an mTLS method is auto-selected
  from token_endpoint_auth_methods_supported resp.
  introspection_endpoint_auth_methods_supported only when such a
  certificate is configured and no client secret is set (with a client
  secret configured, client_secret_basic remains preferred and the
  certificate is used solely for RFC 8705 section 3 certificate-bound
  access tokens)
- metadata: apply the RFC 8705 section 5 "mtls_endpoint_aliases" from the
  provider metadata to the token, userinfo, revocation and pushed
  authorization request endpoints, and from the AS metadata to the
  introspection endpoint, when a mutual-TLS authentication method is in
  effect
- http: also present the configured TLS client certificate at the userinfo,
  revocation, pushed authorization request and aggregated/distributed-claims
  endpoints (previously only at the token and introspection endpoints) so
  RFC 8705 section 3 certificate-bound access tokens can be used against
  those endpoints
- registration: request "tls_client_certificate_bound_access_tokens" during
  dynamic client registration when a mutual-TLS authentication method is
  configured

07/18/2026
- id_token: fix a memory leak on the id_token parse failure path: the
  symmetric decryption key derived from the client secret was only freed
  after a successful JWT parse, so every authorization response carrying an
  unparseable id_token leaked the (process-lifetime allocated) key material
- request: fix a memory leak on the authentication request error path: when
  the original URL could not be stored in the state the freshly created
  proto state object was not destroyed before returning the error
- cfg: fix the token endpoint authentication method validation so that
  private_key_jwt is consistently rejected for configurations without private
  signing keys: the candidate-method list was a static array that got the
  private_key_jwt entry added in place when a private-key-carrying config
  validated first (e.g. another virtual host) and never removed, so later
  no-private-key validations wrongly accepted it too
- refresh: bound the back-off loop that waits for a sibling caller's
  in-progress refresh grant to the refresh-lock TTL, so a cache backend that
  does not expire the lock entry promptly can no longer stall the request
  indefinitely; this also makes the "timeout waiting for refresh token cache
  to unlock" recovery branch reachable again - it had become dead code since
  the wait loop could only ever exit once the lock value was gone
- jose: size the zlib deflate output buffer with deflateBound(); the fixed
  input_len * 2 allocation was smaller than zlib's constant header/trailer
  overhead for values of just a few bytes, so compressing such values failed
  and any cache write of a tiny value (e.g. a cached jq expression result of
  "null") was silently dropped with a "could NOT store" warning

07/17/2026
- logout: support back-channel logout tokens that carry only "sub" (allowed by
  OpenID Connect Back-Channel Logout 1.0 section 2.6) for sessions that were
  created with a distinct "sid"; when the OP supports back-channel logout, a
  session is now additionally indexed by "sub" so such a logout token can
  locate it, and a logout cleans up all of the session's index entries. The
  secondary index is only maintained when back-channel logout is enabled on
  the provider (OIDCProviderBackChannelLogoutSupported or the OP's discovery
  metadata), so there is no extra cache usage otherwise. Also fixes a latent
  session-state leak on the logout cleanup path
- session management: persist the per-path authentication request parameters
  (OIDCPathAuthRequestParams) and scope (OIDCPathScope) used at initial
  authentication in the session, and reuse them for the silent "check"
  re-authentication triggered by the RP iframe; previously that re-check ran
  at the redirect URI and therefore picked up the redirect URI's own per-path
  configuration (usually empty), silently dropping the values that applied to
  the originally protected path; the values are only stored when session
  management is enabled (a check_session_iframe is configured), so there is no
  session-size impact otherwise, and sessions predating this fall back to the
  old behaviour
- metadata: inherit the token endpoint authentication algorithm from the
  global configuration in per-client .conf files; when a .conf does not set
  "token_endpoint_auth" the globally configured method was inherited but its
  ":<alg>" suffix (e.g. private_key_jwt:RS256) was dropped, so multi-provider
  setups silently signed client-authentication JWTs with the default
  algorithm; the fallback now re-appends the global algorithm (an explicit
  "token_endpoint_auth" in the .conf still overrides both)
- logout: support decrypting a symmetrically encrypted back-channel logout
  token by adding a symmetric key derived from the configured provider's
  client secret to the decryption key set (alongside the RP's private keys);
  the JOSE header is peeked to size that key correctly, since the issuer -
  and thus the provider - is only known after the token has been parsed
- appinfo: when concatenating a multi-valued (array) claim into a single
  delimiter-separated application header/environment variable, backslash-escape
  any delimiter (and the backslash escape character itself) occurring inside an
  element value, so a value that contains the delimiter can no longer be
  mistaken for - or used to inject - additional elements by the application
  (e.g. a group DN "CN=Admins,OU=Groups" no longer splits on its commas when
  the delimiter is ","); the escaping is reversible and only affects values
  that actually contain the delimiter or a backslash
- userinfo: only refresh the access token and retry the userinfo request when
  the endpoint responded with a 401 (invalid/expired token); other HTTP
  errors (e.g. 403 or 5xx) are no longer "resolved" by pointlessly presenting
  a freshly refreshed token, which also avoids needlessly spending a refresh
  token on a transient server-side error
- proto: when verifying a JWT signature, give dynamically obtained JWKS keys
  precedence over statically configured keys that carry the same "kid",
  instead of the other way around; the provider's currently published JWKS
  is authoritative for its signing keys, so a stale locally configured key
  with a colliding kid no longer permanently shadows a rotated JWKS key
  (a warning is logged when such a collision is detected)
- refresh: when our own refresh token grant fails (typically because another
  cluster node or worker already spent and rotated the exact same refresh
  token in a rolling-refresh setup), do a final best-effort re-read of the
  refresh token cache before locking the token out, and re-use the results
  another caller populated in the meantime instead of needlessly failing the
  refresh and killing the session

07/16/2026
- cache: allocate the cache mutex on the provided (per-config-generation)
  pool again and register the server-config cleanup as a pool *pre*-cleanup,
  so it runs before libapr closes the underlying POSIX semaphore; this fixes
  a parent-process segfault (sem_post on an unmapped semaphore during
  oidc_cache_shm_destroy) on graceful restarts that previously had to be
  worked around by keeping the mutex on the never-cleared process pool, and
  removes the accompanying long TODO/valgrind-trace comment block
- discovery: strip leading/trailing whitespace from the user-typed
  issuer/account-name input submitted from the OP-selection discovery page,
  so copy-pasted values with stray whitespace no longer fail issuer matching
  or account-based (webfinger) discovery
- oauth: add the OIDCOAuthDecryptSharedKeys directive to configure dedicated
  symmetric key(s) - using the same key specification syntax as
  OIDCOAuthVerifySharedKeys - for decrypting encrypted JWT access tokens
  locally, instead of reusing the client secret configured for the OpenID
  Connect provider; when not configured the client-secret fallback keeps
  working for backwards compatibility, and OIDCPrivateKeyFiles key material
  is used alongside in both cases
- oauth: use the JWKs refresh interval (OIDCJWKSRefreshInterval) as the cache
  TTL for keys retrieved from OIDCOAuthVerifyJwksUri, as was documented and
  intended, instead of accidentally using OIDCUserInfoRefreshInterval (whose
  -1 default happened to resolve to the correct 3600s, but any explicitly
  configured userinfo refresh interval - including 0, i.e. refetch on every
  bearer-token request - silently became the OAuth JWKs cache TTL); configs
  that relied on that coupling should set OIDCJWKSRefreshInterval
- build: add a minimum-line-coverage gate (lcov --fail-under-lines 85) to the
  coverage CI job so coverage slippage fails the pull request instead of only
  being reported in the job summary; as a side effect the job now also fails
  on test failures, which the AX_CODE_COVERAGE "-make -k check" recipe
  otherwise swallows
- handle: split the two remaining 100+ line request handlers into focused
  static helpers: oidc_content_handler() delegates redirect-URI content and
  session-info requests to oidc_content_handle_redirect_uri_request()/
  oidc_content_handle_info_request(), and oidc_discovery_request() delegates
  the external-discovery redirect and the two discovery-page HTML fragments to
  oidc_discovery_request_external()/oidc_discovery_page_providers()/
  oidc_discovery_page_form(); no functional changes
- doc: document the OIDC_ERROR/OIDC_ERROR_DESC error-reporting environment
  variables (and their REDIRECT_-prefixed ErrorDocument forms) in
  auth_openidc.conf and on oidc_util_html_send_error(), including the caveat
  that they are set unescaped so custom error pages rendering them into HTML
  must apply HTML-escaping to avoid cross-site scripting
- util: check the apr_generate_random_bytes() return value when generating a
  trace-id in oidc_util_set_trace_parent() and skip setting the traceparent
  header (with a warning) on failure, instead of hashing uninitialized stack
  bytes into the header
- const: make the NULL-safe _oidc_strcmp() wrapper a byte-exact strcmp()
  instead of apr_strnatcmp() "natural ordering", which skips whitespace and
  compares digit runs numerically so two different byte strings could compare
  equal - surprising equality semantics for the protocol values (nonce, state,
  issuer, client_id) it guards; no caller relies on the natural sort order and
  the NULL-rejection semantics are unchanged
- jose: complete step 2 of the cjose encapsulation: turn the cjose_jwk/cjose_jws
  members of the public oidc_jwk_t/oidc_jwt_t structs into backend-private void
  pointers and drop the cjose type forward-declarations from jose.h, so the
  public header exposes no JOSE-backend types and a future JOSE-backend
  migration stays contained to jose.c and the jose/ subdirectory

07/04/2026
- build: add a .clang-tidy configuration with a deliberately narrow,
  warning-free check set (bugprone-* minus the checks that conflict with
  documented project conventions, plus the nested-conditional guard) and a
  clang-tidy CI job that runs it with warnings-as-errors over a
  bear-generated compilation database, so new findings fail the build close
  to the change instead of surfacing post-hoc in SonarCloud
- mod_auth_openidc: rewrite oidc_handle_redirect_uri_request()'s long if/else
  chain into a declarative dispatch table: each redirect_uri sub-feature is one
  table entry carrying its matcher (protocol predicate or query-parameter
  name), authentication requirement, handler, metrics counter and timing flag,
  so adding a sub-feature becomes a one-line table addition; no functional
  changes
- jose: split the JWK, JWS/JWT and JWE implementations out of the 2000+ line
  jose.c into a new jose/ source subdirectory (jose/jwk.c, jose/jws.c,
  jose/jwe.c plus the internal-only jose/internal.h carrying the shared
  cjose error/kty helpers), leaving jose.c with the backend-independent
  common core (error reporting, hashing, compression, supported-algorithm
  lists, version reporting); a pure code move with no functional changes,
  mirroring the source-tree subdirectory convention
- metadata/cfg: fix the client-metadata "response_types" fallback in
  oidc_metadata_client_parse_response_type(): it was unreachable because the
  response_type getter substitutes the "code" default and so never returns
  NULL; add oidc_cfg_provider_response_type_is_set() to detect an explicitly
  configured value instead. When no response_type is configured and the client
  metadata advertises a "response_types" array that does not include the
  global/default value, the first advertised entry is now actually used, as
  documented

07/03/2026
- cfg/mod_auth_openidc: memoize the PBKDF2-HMAC-SHA256 crypto-passphrase key
  derivation (oidc_crypto_passphrase_derive_keys_cached()) by secret text across
  every server_rec checked in a single post_config pass, so a server with
  hundreds of <VirtualHost>s that all inherit/set the same OIDCCryptoPassphrase
  only pays for the ~210,000-iteration KDF once per distinct secret instead of
  once per vhost -- avoiding a startup/graceful-restart delay that otherwise
  scaled with vhost count
- http: fix a -Wformat-overflow warning in oidc_http_form_encoded_data(): the
  "no params" branch logged a provably-NULL "data" variable via "%s"; log the
  literal "(null)" there instead, matching the "(null)" convention used
  elsewhere in this file
- cfg/util/cache: stretch OIDCCryptoPassphrase into the AES key used for the internal
  "dir"/A256GCM JWE (state cookie, session cookie, cache value encryption) with
  PBKDF2-HMAC-SHA256 (210,000 iterations, a fixed application-specific salt) instead
  of a single SHA-256 pass, so an offline attacker who obtains an encrypted
  cookie/cache value cannot brute-force a weak passphrase at raw-SHA256 speed; the
  stretching happens once per server config (the base server and every merged
  vhost, each carrying its own copy of the passphrase), so the per-request
  encrypt/decrypt path pays no extra cost. This changes the effective key for a
  given passphrase, so all sessions/state cookies/cache entries created before an
  upgrade fail to decrypt afterwards (same as changing OIDCCryptoPassphrase
  itself): plan for users to be logged out once
- cfg/handle: add OIDCDiscoverIssuersAllowed, an OIDCRedirectURLsAllowed-style
  list of regular expressions that bounds which issuer values dynamic OpenID
  Connect Discovery (webfinger/URL-based, account-based, or direct issuer
  selection via OIDCMetadataDir) is allowed to resolve to; checked against the
  candidate host before any outbound webfinger/URL-based or account-based
  discovery HTTP call is made, not only against the final resolved issuer, so a
  disallowed host is never probed. Unset (default) preserves the previous,
  unrestricted behavior
- handle/discovery: bump the Discovery CSRF token from 8 to 16 random bytes
  (64 to 128 bits of entropy)
- doc: recommend prefixing OIDCCookie with "__Host-" so the browser enforces
  Secure/no-Domain/Path=/ on the session cookie
- state: use SHA-256 instead of SHA-1 to compute the browser-fingerprint hash
  bound into the "state" value (X-Forwarded-For/User-Agent headers plus the
  per-request nonce); in-flight authentication redirects started just before
  an upgrade will fail state validation on return and require the user to
  restart the login, same as any other state-timeout
- util/cache: create metadata files (which can hold a dynamically registered
  client_secret) and file-cache entries with owner-only (0600) permissions
  instead of relying on the process umask via APR_OS_DEFAULT
- handle/util: compare request-supplied secrets (the state-vs-browser-fingerprint
  check, the refresh-token XSRF access_token check, and the Discovery CSRF cookie
  check) using a new constant-time oidc_util_strcmp_const_time() instead of a
  plain string compare, so a failing check cannot leak timing information about
  how many leading bytes matched
- http/oauth/refresh/userinfo/proto: stop writing access tokens, refresh tokens,
  client secrets/assertions, authorization codes, PKCE code_verifiers and nonces
  in full to the debug log; introduce oidc_util_mask_value() (keeps a short
  prefix plus the length for log correlation) and redact well-known sensitive
  parameters out of logged request bodies/URLs and the state-cookie debug dump
- bump to 2.4.20dev

07/02/2026
- proto: no longer send an empty "request_uri" (or "request") parameter on the
  authorization request when creating the request object fails
- proto: fix the misleading "will be dropped" warning about an access token
  returned from the token endpoint in hybrid flows: it overrides the value
  obtained from the authorization response
- test: improve unit test coverage: signed_jwks_uri verification, request object
  (JAR) encryption, id_token aud values, OAuth RS metadata-URL/local-JWT/POST/
  sub-request paths, jq claims-expression authorization, key-record encodings and
  TLS client-cert setters, metrics shm-merge and Prometheus counter shapes,
  composite and DPoP-bound userinfo requests, webfinger discovery failure paths
  and client-secret expiry; no functional change

07/01/2026
- release 2.4.19.4

06/22/2026
- cfg: allow OIDCProviderUserInfoEndpoint to be set to an empty value to explicitly
  disable calling the UserInfo Endpoint, even when one is advertised in the metadata
  obtained from OIDCProviderMetadataURL; useful when the access token cannot be used
  against the UserInfo Endpoint (e.g. with Microsoft Entra ID) and the required claims
  are already present in the id_token; see #1390; thanks @drpuur

06/15/2026
- cfg: collect the OIDC* directive-name macros in a single cfg/directives.h and
  flatten the config-accessor generator macros (drop the function-name token
  paster, document the generated symbols, ship a ctags recipe to index them);
  no functional change

06/14/2026
- json: introduce a JSON backend abstraction layer; move util/json.c to json.c
  and rename oidc_util_json_* to oidc_json_*, with an opaque oidc_json_t type
  and backend-independent OIDC_JSON_* constants, so that code outside json.c no
  longer references libjansson directly (jose.c remains the cjose seam, which
  uses the same backend value type); a preparatory step towards decoupling the
  underlying JSON backend; no functional change

06/13/2026
- jose: stop exposing the cjose JOSE library through the public jose.h header,
  as a preparatory step towards decoupling the underlying JOSE backend; code
  outside jose.c now uses backend-independent OIDC_JOSE_* constants and accessor
  functions (oidc_jose_version, oidc_jwk_to_public_json, oidc_jwk_default_jws_alg,
  oidc_jwt_hdr_set_json) instead of cjose symbols, and jose.h no longer includes
  <cjose/cjose.h> (the cjose key and signature objects are now opaque forward
  declarations); no functional change

06/12/2026
- proto: when copying authorization request parameters into a request object
  (copy_from_request / copy_and_remove_from_request), no longer interpret the
  values of parameters that the OpenID Connect/OAuth 2.0 specifications define
  as strings (e.g. client_id, scope, nonce, state) as JSON, so a numeric value
  of such a parameter can no longer change type into a JSON integer; values of
  other parameters (e.g. claims, max_age) are still decoded as JSON with a
  fallback to string

06/09/2026
- cache: copy the shm cache value out while holding the global lock instead of
  returning a pointer into the shared memory segment, so a concurrent set() in
  another process cannot tear the value after the lock is released
- info: set "Cache-Control: no-cache, no-store" (and "Pragma: no-cache") on the
  OIDCInfoHook response so the access/refresh/id token and session claims it
  may contain are not stored by the browser or an intermediary cache
- util: parse Apache expressions with AP_EXPR_FLAG_RESTRICTED; the flags were
  combined with bitwise-AND instead of OR, which left them at zero and dropped
  the RESTRICTED flag, so expressions in directives that are valid in .htaccess
  (OIDCUnAuthAction, OIDCUserInfoClaimsExpr, OIDCPathScope,
  OIDCPathAuthRequestParams) were parsed unrestricted
- cache: return failure from the cache mutex lock/unlock helpers when the
  underlying APR mutex operation fails; they previously always returned TRUE,
  so the callers' lock-failure guards never triggered and the code could
  access the shared cache without holding the lock
- state: fix an out-of-bounds read (and one-byte out-of-bounds write) in the
  state-cookie parser; a state-prefixed Cookie token without a "=" scanned
  past the end of the token buffer; stop the scan at the string terminator

06/03/2026
- proto: do not skip id_token signature validation for the "code" flow with
  algorithm "none" when an id_token signing algorithm has been pinned via
  OIDCIDTokenSignedResponseAlg; honor the pin and reject the unsigned token
- oauth: warn when an introspection response omits the RFC 7662 "active"
  member, since token validity then relies solely on the expiry claim
- cache: always hash the memcache key so it satisfies memcached's key
  constraints (length, no whitespace/control chars) regardless of the key
  contents or whether OIDCCacheEncrypt is enabled
- cache: reject shm cache values at ">=" the available entry size so the
  NUL terminator always fits, removing reliance on struct alignment padding
- cache: NUL-terminate the shm cache entry key explicitly after strncpy to
  avoid an in-struct over-read when a key hits the maximum length
- jose: enforce that the kid-selected key type matches the JWT/JWE algorithm
  on the kid lookup path too, not just the no-kid path (defense in depth
  against key/algorithm confusion; cjose already rejected the mismatch)
- doc: correct the sample auth_openidc.conf wrt. JWE/JWS algorithms
- config: remove the JWE/JWS algorithms from the config primitive help texts
  as not to get out of sync: at startup the error message will contain what is
  supported anyhow

06/02/2026
- test: use long symmetric key to work against cjose >= 0.6.2.6
- bump to 2.4.19.4dev

06/01/2026
- ci: bump the GitHub Actions to Node 24 runtimes — actions/checkout
  and actions/upload-artifact to v5, then upload-artifact to v7 and
  codeql-action to v4 (v5/v4 still run on Node 20)
- jose: cast away const at the OpenSSL call sites whose signatures
  vary by version, so the build stays warning-clean across OpenSSL
  1.x/3.x and LibreSSL
- metrics: include unistd.h again, now guarded under #ifndef WIN32
- code: const-qualify the remaining read-only provider parameters in
  logout/userinfo/proto and oidc_proto_request_auth, finishing the
  S995 cascade
- test: portability fixes for old libcheck — parse the JWT and DPoP
  proof headers instead of substring-matching cjose's version-specific
  output, compare the userinfo last-refresh as a 64-bit apr_time_t
  (old libcheck truncates int asserts), shim ck_assert_ptr_ne, and
  redirect the registration-check error/failure messages to stderr
- release 2.4.19.3

05/31/2026
- ci: split valgrind and distcheck into their own jobs; add a
  gcc/clang build matrix; run the suite under ASan and UBSan
  (excluding benign UB classes); surface code coverage on every build;
  and give the coverage and valgrind jobs live redis+memcache service
  containers so the real cache backends are exercised
- jose: fix an out-of-bounds read when logging a malformed JWT payload
- test: add a fuzz harness for the untrusted-input parsers; fail
  make check on unregistered START_TEST bodies; generalize the mock
  HTTP server to serve N scripted responses; add the ck_assert_jwt_parses
  and table-assert helpers and convert the call sites; and reset the
  cache mocks in the fixture so state does not leak under CK_FORK=no
- test: split session.c and state.c into dedicated test_session.c /
  test_state.c; cover the OAuth mixed-mode dispatch and fixups hook,
  the handle/jwks.c and handle/response.c branches, the signed-JWT
  userinfo pass-as path with RSA keys, and the redis (mock) + memcache
  backends in test_cache.c (memcache run offline via injectable mocks)
- code: continue the SonarCloud cleanup — finish const-qualifying the
  read-only pointer parameters and the cfg/oauth/provider getter macros
  (S995/S5350), drop an unused request_rec param (S1172), replace a
  small switch with if statements (S1301), move #include directives to
  the top of file (S954), un-nest ternaries (S3358), make narrowing
  integer conversions explicit (S5276), and remove empty statements,
  commented-out code and redundant casts (S1116/S125/S1905)

05/30/2026
- code: const-qualify more cascade-exposed read-only pointers in
  handle/jose/http/metrics/oauth/cfg and proto/session (S995/S5350)

05/29/2026
- code: fix a memory leak in oidc_metadata_jwks_retrieve_and_cache
- code: clamp json_int_t→int conversions on OP-supplied values to
  avoid silent overflow, and split an assignment out of an && to clear
  an S912 BLOCKER
- code: large SonarCloud sweep — const-qualify read-only pointer
  parameters across jose/http/metrics/session/oauth/proto/handle/util/
  metadata/cfg and make local pointers point-to-const (S995/S5350),
  remove genuinely-unused function parameters (S1172), one variable per
  declaration (S1659), declare loop variables in minimal scope (S5955),
  collapse 26 nested-if findings (S1066), remove 19 redundant
  parenthesis groups (S1110), drop three const-drop casts (S859), hoist
  html/js format strings to static const arrays, and clear assorted
  small findings (S1121/S3358/S3457)
- test: cover the webfinger response parser (proto/discovery.c), the
  metadata jwks_get cache-hit and validation-failure branches, and the
  oidc_provider_static_config / redirect-URL / remote-user /
  cookie-domain branches in mod_auth_openidc.c

05/27/2026
- test: extend coverage across the tree — proto response handlers,
  dpop, request-object removal and userinfo JWT; state.c fingerprint
  and state-cookie cleanup; mod_auth_openidc.c top-level helpers;
  the handle/authz, content, info, logout, refresh and discovery
  branches; and the cfg/parse, cfg/cfg, cfg/oauth, cfg/provider,
  cfg/dir and cfg/cache setters
- code: run clang-format and add *.gcov to the ignore lists

05/26/2026
- test: close five coverage gaps identified from the `make
  check-code-coverage` report; together they add 20 new unit tests
  and one stub-fixture fix without touching production code:
    - proto/userinfo.c: POST token-presentation, mandatory-sub
      rejection and OIDC_NO_USERINFO_SUB skip, plus aggregated-claim
      resolution via an inline alg=none JWT and the no-_claim_sources
      short-circuit (5 tests in e2e_proto).
    - proto/auth.c: client_secret_jwt assertion + private_key_jwt
      with no keys, with the test/private.pem RSA key, and with an
      explicit RS384 override; assertions decode the JWS header to
      check alg/kid (4 tests in core).
    - handle/request_uri.c: brand-new request_uri tcase covers all
      three branches — missing parameter (400), cache miss (404),
      and the cache-hit happy path that primes the content handler
      and consumes the entry (3 tests).
    - proto/discovery.c: account-based and URL-based webfinger entry
      points driven against a known-closed loopback port via
      oidc_test_http_free_port — covers the @-split / apr_uri_parse
      stitching and the HTTP-failure return in the shared helper
      (2 tests in core). TLS-mocked JSON-parsing branches are still
      out of reach with the plaintext fixture.
    - oauth.c: Basic-scheme bearer extraction (success + no-colon),
      the OAuth-side redirect-URI dispatch (?jwks → OK, ?remove_at_cache
      → 404), and oidc_oauth_metadata_provider_retrieve against the
      loopback HTTP fixture for success and invalid-JSON-response
      (6 tests). Required two fixture fixes in test/stub.c:
      ap_getword_nulls was a no-op and ap_is_initial_req hard-coded
      to 0 — both now match Apache semantics.
- test: add a dispatch tcase to test_handle that drives
  oidc_handle_redirect_uri_request directly through six routing
  decisions (?jwks and ?dpop short-circuit to OK with r->user="",
  ?info on a session without a remote_user yields 401, unknown args
  fall through to the invalid-request 500, an empty args string
  routes to oidc_javascript_implicit, and a POST with ?logout=
  takes precedence over the POST authorization-response branch).
  The function is declared extern in the test file because it
  has no public header
- code: split src/metadata.c into per-domain files under src/metadata/
  (provider, conf, client, jwks, oauth, util) with shared constants and
  helper macros in metadata/internal.h; the conf_parse_* helpers are
  rewritten on top of new OIDC_METADATA_CONF_STR/INT/BOOL macros so each
  parsed field becomes a single line. Public API in metadata.h is
  unchanged. Adds unit-test coverage for oidc_metadata_conf_parse_* and
  the oidc_metadata_client_register POST payload to lock in behavior
  across the move
- ci: enable SonarQube analysis with code coverage for real, add a
  gcov reporting step (reports collected under gcov-reports/) and bump
  to sonar-scanner 8.1.0
- jose: avoid reading an uninitialized cjose_err when no compatible
  JWE decryption key is tried

05/25/2026
- code: hardening in various places
- strip_cookies: skip cookies that are only whitespace after the
  leading-space strip; a header like "foo=1; ; bar=2" otherwise had the
  empty middle token re-emitted verbatim, leaving a malformed segment
  in the forwarded Cookie header
- metrics: switch _oidc_metrics_thread_exit to a volatile apr_uint32_t
  accessed via apr_atomic_read32/set32; the flush worker reads it from
  a different thread than the cleanup / child-init writers, so a plain
  apr_byte_t allowed LTO to hoist the load out of the polling loop and
  strand the post-join cleanup that b66b54a0 added
- util: guard oidc_util_rand_int with a mod==0 short-circuit (avoids
  division by zero) and rejection-sample before reducing modulo so
  v % mod is uniformly distributed; the only caller passes 100
  (metrics jitter) so the prior bias was negligible, but the hazard
  is closed for any future caller
- userinfo: skip the DPoP-nonce retry path for non-DPoP token types;
  oidc_proto_userinfo_request only allocates response_hdrs on the DPoP
  branch, so a Bearer userinfo call against an OP that returned a JSON
  body of {"error":"use_dpop_nonce"} would dereference NULL inside
  apr_hash_get and crash the worker

05/23/2026
- test: large expansion of unit-test coverage
- security: do not log refresh tokens at warn/error levels; the verbose
  paths previously embedded the bearer-equivalent secret in messages
  routed to the Apache error log where it could persist in operator
  workflows and aggregation pipelines
- security: also strip CR when sanitizing outgoing header values; the
  previous LF-only filter still permitted CR-based header injection in
  environments that treat lone CRs as line terminators
- test: migrate the hand-rolled legacy test.c suite to per-module
  Check-based binaries and add a loopback HTTP server fixture so the
  http.c and proto/ tests can exercise the full libcurl path
  end-to-end; expose previously-static http.c helpers via a new
  http_int.h purely for unit-test access

05/22/2026
- security: guard the trailing-slash strip against an empty string to avoid an
  out-of-bounds read (and conditional 1-byte out-of-bounds write of a NUL);
  oidc_discovery_response_authenticate indexed issuer[-1] when an
  unauthenticated request supplied an empty "iss" parameter; the same
  [strlen-1] pattern is hardened in oidc_metadata_issuer_to_filename,
  oidc_discovery_target_link_uri_match and oidc_response_set_request_user

05/21/2026
- config: fix intermittent coredumps on per-request initialization under heavy load
  initialize the default pass_userinfo_as array and the cached A256GCM
  "dir" JWT header prefix once during post-config rather than lazily from the
  request path
  
05/20/2026
- security: cap zlib-inflated JWE payload size at 10MB in
  oidc_jose_zlib_uncompress to prevent decompression-bomb style memory
  exhaustion via crafted compressed JWTs
- security: restrict the session_management iframe's login_uri parameter to
  the current request host (restrict_to_host=TRUE); previously, when
  OIDCRedirectURLsAllowed was unset the URL host was not checked at all,
  allowing an open redirect via window.top.location.replace
- security: harden hostname suffix matching used for target_link_uri and cookie
  domain checks; the previous strcasestr-based pattern accepted hosts that
  share a suffix without a dot boundary (e.g. evil-example.com matching
  example.com); replace with a proper subdomain check
- security: HTML-escape the JSON session info embedded in the <pre> block of
  the OIDCInfoHook HTML response; JSON does not escape '<'/'>' so a claim
  containing </pre><script>...</script> rendered as live HTML
- security: JavaScript-escape origin, client_id, session_state and
  redirect_uri when embedding them in the RP session-management iframe;
  previously only login_uri was escaped, so an OP-supplied session_state
  containing a single quote could break out of the JS string literal
- security: reject JWT alg "none" (and a missing alg header) in
  oidc_proto_jwt_verify when no expected signing algorithm has been
  configured; cjose already failed key lookup for "none" but reject earlier
  to remove ambiguity and reduce alg-confusion surface
- code: HTML-escape the meta-refresh URL in the OIDCUnAuthzAction "302"
  branch of oidc_authz_24_unauthorized_user (companion to the same fix in
  the OIDC_UNAUTZ_AUTHENTICATE branch)
- code: guard against a NULL/empty path in oidc_session_management_iframe_rp;
  apr_uri_parse's return code is now checked and the strstr-based origin
  computation no longer dereferences a NULL result on OP metadata with no
  path
- code: validate format specifiers (only %% and exactly two %s) in
  oidc_util_html_send_in_template before passing the template through
  apr_psprintf so a stray %n in an admin-supplied template can't crash or
  corrupt memory
- code: detect RNG failure in oidc_util_rand_int; previously the return
  code of _oidc_util_rand was ignored and stack-derived bits could be
  returned on failure
- code: use OpenSSL CRYPTO_memcmp for at_hash/c_hash verification in
  oidc_proto_validate_hash to remove the timing side-channel on the
  failure path
- code: detect sscanf failures and reject odd-length input in
  oidc_cfg_parse_hex so a typo in a hex-encoded OIDCCryptoPassphrase
  doesn't silently weaken the derived key
- code: reject URLs longer than OIDC_MAX_URL_LENGTH in
  oidc_validate_redirect_url instead of silently truncating before the
  chars/host checks
- code: HTML-escape the on_load argument in oidc_util_html_send so a stray
  quote can't break out of the onload="..." attribute into surrounding
  markup
- code: clean up oidc_util_base64_decode (pointer-vs-int NULL check,
  error message typo) and document the signed-int return contract of
  oidc_util_base64url_decode
- code: document the NULL-NULL "not equal" semantics of _oidc_strcmp and
  _oidc_strnatcasecmp as load-bearing security behavior so a future
  cleanup doesn't relax it without auditing every caller
- code: fix strchr/strrchr compiler warnings

05/13/2026
- code: re-factor functions to reduce cognitive complexity
- security: fix 3 low-risk (insider-admin-based) security vulnerabilities
- code: add more unit tests for util and proto functions

04/24/2026
- proto: add scope=openid to the authorization request when passing a Request Object
  by reference (request_uri) as defined by spec; see #1385; thanks @gueuselambix and @hjmikkon

04/18/2026
- build: conditionally add --coverage to AM_LDFLAGS in Makefile.am

03/06/2026
- code: cast curl timeouts in options to long to avoid compiler warnings
- bump to 2.4.19.3dev

02/23/2026
- fix claims based authorization in OAuth 2.0 RS mode (AuthType oauth20 and AuthType auth-openidc)
  regression introduced in 2.4.19
- release 2.4.19.2

02/01/2026
- release 2.4.19.1

01/29/2026
- fix merging top-level configured OIDCCryptoPassphrase into vhosts that have not explicitly configured it
  regression introduced in 2.4.19

01/28/2026
- refresh: fix releasing the best effort distributed refresh lock immediately after refreshing
  the access token fails to avoid parallel requests queuing up and blocking threads; also
  avoid trying the same prevously failed refresh request again, at least for 30 seconds
- bump to 2.4.19.1rc0

01/03/2026
- test: fix long int test in test_util.c so that it fits within a 32bit long int size; see #1375; thanks @moschlar
- update copyright year to 2026

12/13/2025
- oauth: fix segfault when using OIDCOAuthVerifySharedKeys, regression since 2.4.16; closes #1373; thanks @contryboy

12/08/2025
- jwk: fix parsi8ng RSA JWKs with only an "x5c" parameter (i.e. no "n" and "e")
- bump to 2.4.19.1dev

12/01/2025
- release 2.4.19

11/23/2025
- init: refactor pconf pool memory allocation handling
  avoid increasing memory (pool) consumption over graceful restarts

11/19/2025
- request: set the OIDC_ERROR variables when PAR is configured but not enabled by the Provider

11/18/2025
- id_token: add "off" option to OIDCPassIDTokenAs so no claims from the ID token will be passed on
- passphrase: generate a crypto key when OIDCCryptoPassphrase is not set

11/17/2025
- metadata: avoid double-free when validation of provider metadata fails
- perf: store id_token/userinfo claims as JSON objects and avoid parsing/serializing overhead
  which results in up to 7% performance increase, depending on the number of claims stored
- session/cookie: save 20-40 bytes on the session and client-cookie size
  NB: the internal session format has changed and is backwards incompatible: existing sessions and cookies will be invalid
- response: avoid proto state memory leaks upon errors in response processing
- drop support for Apache 2.2
- bump to 2.4.19dev

11/14/2025
- test: add test/test_proto.c and migrate proto tests from test.c

11/12/2025
- test: add test/test_cache.c coverage tests

11/11/2025
- test: add test/test_http.c and migrate http accept tests there from test.c
- test: test/Makefile.am refactor check programs

11/07/2025
- cookie: support individual SameSite cookie settings on the session cookie, state cookie and Discovery CSRF
  cookie by adding 2 more arguments to OIDCCookieSameSite
- code: avoid compiler warnings on `curl_easy_setopt` in http.c
  http.c:612:16: warning: call to '_curl_easy_setopt_err_long' declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]
  
11/05/2025
- test: add jose.c coverage tests

10/24/2025
- code: refactor util/random.c

10/23/2025
- util/key.c: check for unsupported symmetric key hashing algorithms and avoid a memory leak in such cases
- test: add util/key.c coverage tests
- code: use const qualifier in apr_array_header_t operations

10/03/2025
- redis: use SET..EX %d instead of deprecated SETEX
- session: remove expired session from cache with `oidc_session_kill` instead of just clearing it
- bump to 2.4.18.2dev

10/01/2025
- release 2.4.18.1

09/29/2025
- refresh: turn debug printouts in config errors into warnings; see #1349; thanks@CrazyWolf13
- shm: use _oidc_strcpy instead of _oidc_strncpy to avoid segfaults on some platforms; see #1353
  regression since 2.4.16.7, found on Amazon Linux 2023

09/27/2025
- logout: when revoking tokens at the revocation endpoint with client_secret_jwt or
  private_key_jwt, use the revocation endpoint as "aud" value (instead of the token endpoint
  that was used before), unless environment variable OIDC_TOKEN_REVOCATION_AUD is set to
  "token" (or another literal aud value)

09/13/2025
- redis: apply global (server-wide) locking when system(!) environment variable
  OIDC_REDIS_MUTEX_GLOBAL is set, for backwards compatibility, through:
  PassEnv OIDC_REDIS_MUTEX_GLOBAL

09/12/2025
- test: add util/*.c coverage tests

08/31/2025
- pass JSON real claims without trailing zeros, use 8 digits precision instead of 6
- test: complete util/appinfo.c coverage
- oidc_util_base64_decode: check NULL inputs
- test: complete util/base64.c coverage

08/27/2025
- improve Redis (and Metrics) performance on process MPMs by using
  apr_thread_mutex_t (instead of apr_proc_mutex_t) for locking; see #1340

08/22/2025
- test: make test_cfg oidc_cmd_cache_memcache_ttl_set 180 work on Apache 2.2 
- bump to 2.4.18.1dev

08/21/2025
- add Valgrind target to Makefile and to Github Build action
- release 2.4.18

08/20/2025
- revise test/check and code coverage functions
- revise autoconf/automake, split over subdirs now
- add tests for memcache TTL
- fix check OIDC_CONFIG_POS_TIMEOUT_UNSET for memcache TTL getter; #1345
- bump to 2.4.18dev

08/18/2025
- fix parsing the value set via OIDCMemCacheConnectionsTTL and interpret it in
  seconds correctly now (instead of microseconds); see #1345; thanks @rpluem

08/15/2025
- use the server process pool for static variable allocation rather than the pconf pool
  to prevents possible segmentation faults after (graceful) restarting the same process
- bump to 2.4.17.3dev

07/28/2025
- release 2.4.17.2

07/23/2025
- fix regression in 2.4.17 for processing unauthenticated requests that generate HTML
  content, e.g. `OIDCProviderAuthRequestMethod POST` and `OIDCPreservePost On`
  when protected with `Require claim` statements rather than just `Require valid-user`.

07/15/2025
- support the use of Elliptic Curve keys for private_key_jwt authentication at
  the token- and introspection endpoints and make the signing algorithm configurable
  for both RSA en EC keys; closes #1336; thanks @rjr162
- bump to 2.4.17.2dev

06/25/2025
- allow to suppress warnings about (individual) X-Forwarded headers; see #1333
  through environment variable OIDC_CHECK_X_FORWARDED_HDR_LOG_DISABLE, e.g.:
    SetEnvIfExpr true OIDC_CHECK_X_FORWARDED_HDR_LOG_DISABLE=X-Forwarded-Proto

06/23/2025
- release 2.4.17.1

06/18/2025
- fix usage of OIDCSessionType client-cookie:persistent:store_id_token; see #1331; thanks @rgcv

05/27/2025
- fix usage of OIDCPreservePostTemplates, regression in 2.4.17; see #1325; thanks @perry19987
- javascript: use HTMLFormElement.prototype.submit.call(document.forms[0]) on all Javascript
  auto-submit POST forms to prevent browser Javascript error: "form.submit is not a function"
  which would occur when an element (i.e. the submit button) in a HTML form has a name or id 
  with a value "submit" and OIDCPreservePost is set to On
  affects:
    - OpenID Connect Implicit response type (OIDCResponseType id_token *)
    - Form Post response type (OIDCResponseMode form_post)
    - send authentication request via POST binding (OIDCProviderAuthRequestMethod POST)
    - preserving POST data (OIDCPreservePost On)
  see:
     https://trackjs.com/blog/when-form-submit-is-not-a-function/ 
     https://stackoverflow.com/questions/833032/submit-is-not-a-function-error-in-javascript
     https://www.geeksforgeeks.org/how-to-solve-submit-is-not-a-function-error-in-javascript/

05/22/2025
- metrics: avoid possible segfault after restart twice; thanks @atzm

05/17/2025
- code: refactor util.c into util/ directory

05/06/2025
- allow adding a prefix to the cache (section) key through environment variable OIDC_CACHE_PREFIX
- bump to 2.4.17.1dev

04/22/2025
- release 2.4.17

04/19/2025
- metadata: fix parsing the OPs `token_endpoint_auth_methods_supported` and avoid the log error:
    oidc_metadata_provider_parse: oidc_provider_token_endpoint_auth_set: invalid value
  and falling back to client_secret_basic after that; thanks François Kooman
- bump to 2.4.17rc2

04/17/2025
- bump to 2.4.17rc1

04/15/2025
- fix memory leaks when using provider specific client keys in a multi-provider setup
- bump to 2.4.17rc0

04/08/2025
- proto: pass the scope parameter as returned from the token endpoint in the OIDC_scope
  header/environment variable and make it available for `Require claim scope:` purposes
  if not available as a claim returned in the id_token or userinfo endpoint

04/07/2025
- allow for regular Apache processing (e.g. setting response/security headers)
  by deferring HTML/HTTP output generation to the content handler (instead of user id check handler)
  for the following use cases:
  - OIDCProviderAuthRequestMethod POST
  - OIDCPreservePost On (both internal and template-based)
  - POST page for the implicit grant type
  - Request URI handler
  - internally generated POST logout page
  - session management RP iframe
  - session management logout HTML top-window redirect page
- bump to 2.4.17dev

04/02/2025
- fix protected content leakage when using OIDCProviderAuthRequestMethod POST, see:
    https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-59jp-rwph-878r
- release 2.4.16.11

03/21/2025
- core: complete case-insensitive protocol/hostname/domain-name comparisons
- release 2.4.16.10

03/20/2025
- core: compare hostnames and domains in a case insensitive way in:
    oidc_request_check_cookie_domain
    oidc_util_cookie_domain_valid
    oidc_validate_redirect_url
    oidc_cfg_parse_is_valid_url_scheme
    oidc_discovery_target_link_uri_match
- cookie: fix oidc_util_cookie_domain_valid so that it checks the incoming request against OIDCCookieDomain
  rather than the OIDCRedirectURI and displays the correct error message if they don't match
- bump to 2.4.16.10dev

03/19/2025
- release 2.4.16.9

03/18/2025
- cookie: use case insensitive hostname/domain comparison in oidc_check_cookie_domain
- authz: remove the Location header from HTML based step up authentication redirects
  as it may conflict with its HTTP 200 status code and confuse middle boxes
- metrics: avoid double-free on shutdown by not calling pthread_exit; fixes #1207; thanks @studersi
- metrics: upon exit, do write cached metrics into shared memory before exiting
- bump to 2.4.16.9dev

02/17/2025
- release 2.4.16.8

02/13/2025
- metrics: add support for claim value counters in OIDCMetricsData
- metrics: do not reset Prometheus counters by default, only when explicitly specified
- metrics: reset to 0 in case of an integer overflow
- bump to 2.4.16.8rc0

01/29/2025
- add OIDCProfile to configure OpenID Connect profile behaviours for, so far "FAPI20" only, which configures:
  Authentication Request method, DPoP, PKCE, ID token aud values requirements
  token endpoint JWT authentication "aud" values, "iss" parameter requirement in authentication reponses
- release 2.4.16.7

01/24/2025
- fix OIDCProviderRevocationEndpoint when not setting it to ""; see #1301; thanks @tarteens

01/19/2025
- jose: prevent memory leaks when zlib compressing (deflate) fails in oidc_jose_zlib_compress

01/02/2025
- add a configuration check for public/private keys when using DPoP; closes #1293; thanks @ahus1
- update copyright year to 2025

12/17/2024
- code: address SonarQube warnings in src/cache/*.c

12/16/2024
- http: report errors when curl_easy_setopt fails and improve macro usage
- address warnings from static code analysis tool Coverity
  - code: declare enum members as int so they can be set to OIDC_CONFIG_POS_INT_UNSET without warning
  - code: declare memcache members as int so they can be set to OIDC_CONFIG_POS_INT_UNSET without warning
  - code: declare introspection_endpoint_method member as int so it can be set to OIDC_CONFIG_POS_INT_UNSET without warning
  - code: check return value of oidc_get_provider_from_session and oidc_refresh_token_grant in logout.c
  - code: avoid potential crash on non-conformant literal IPv6 adresses in oidc_util_current_url_host
  - code: apply boundary checks on oidc_metrics_shm_size and use a global static for performance reasons

12/15/2024
- add Coverity Github action

12/13/2024
- address warnings from static code analysis tool Coverity
  - code: avoid potentional memory leak on cURL handle if curl_easy_escape/curl_easy_unescape fails
  - code: correct the check for the optional token_type parameter returned from a token endpoint request
  - code: initialize oidc_jose_error_t err variable in oidc_util_create_symmetric_key
  - code: refactor oidc_util_port_from_host and avoid potential crash on non-conformant literal IPv6 addresses
  - code: add and use _oidc_strncpy for section key string copy in shm.c
  - code: correct check for private key return value from oidc_proto_jwt_create_from_first_pkey
    and avoid NULL pointer dereferencing when no private keys have been configured
  - code: correct check for *static_template_content in oidc_util_html_send_in_template in util.c

12/11/2024
- address warnings from static code analysis tool SonarQube
  - code: loop over authz arrays with index instead of pointer
  - code: avoid embedding defines in macro arguments
  - code: avoid cast warnings
  - code: add comment to empty functions
  - code: remove any side effects from right hand operands of logical && operator

12/10/2024
- github: add SonarQube analysis to Github workflows
- address warnings from static code analysis tool SonarQube
  - code: use snprintf instead of sprintf
  - code: move _snprintf define to const.h
  - bump to 2.4.16.7dev

12/09/2024
- release 2.4.16.6

12/05/2024
- metadata: fix caching of JWKs from jwks_uri when using the default expiry setting (i.e. not using OIDCJWKSRefreshInterval)
  and avoid fetching JWKs from the jwks_uri for each user login; also addresses Redis cache
  error entries the log [ERR invalid expire time in 'setex' command]
- avoid segfault and improve error reporting in case apr_temp_dir_get fails when a temp directory cannot be found
  on the system upon initalizing cache mutexes and file cache; see #1288; thanks @ErmakovDmitriy

11/21/2024
- add option to set local address for outgoing HTTP requests; see #1283; thanks @studersi
  using e.g. SetEnvIfExpr true OIDC_CURL_INTERFACE=192.168.10.2
- try and address metris cleanup segmentation fault on shutdown; see #1207
  by not flushing metrics to the shared memory segment upon exit

11/14/2024
- allow specific settings Strict|Lax|None|Disabled for OIDCCookieSameSite in addition to On(=Lax)|Off(=None)
  - fix: default behaviour Lax
  - fix: apply OIDCCookieSameSite Off/None properly to state cookies instead of always setting Lax
  - re-introduces the option to configure a Strict SameSite session cookie policy, which will turn the initial
    Lax session cookie - set upon receving the response to the Redirect URI - into a Strict session cookie
    immediately after the first application request
  - allows for a "Disabled" value that does not set any SameSite flag on the cookies, in which case a browser
    falls back to its default browser behaviour (which should be Lax by spec)

11/07/2024
- info: fix requests to the info hook with extend_session=false; see #1279; thanks @fnieri-cdp
  - properly reflect the (unmodified) inactivity timeout in the response ("timeout")
  - avoid refreshing an access token (since the session is not saved)
  - avoid refreshing claims from the user info endpoint, and possibly refreshing the access token

10/23/2024
- metadata: allow plain HTTP URLs in metadata elements `jwks_uri` and `signed_jwks_uri`
  to ensure backwards compatibility with <=2.4.15.7 and to support private/test deployments

10/22/2024
- address warnings from static code analysis tool CodeChecker
- bump to 2.4.16.6dev

10/16/2024
- release 2.4.16.5

10/04/2024
- ensure backwards compatibility with versions <2.4.16.x when a JSON array of string values
  is provided in the "aud" claim of the ID token; required by (at least) Oracle IDCS
  see #1272 and #1273; thanks @lufik and @tydalforce
- add OIDCIDTokenAudValues configuration primitive that allows for explicit (and exhaustive)
  configuration of the list of accepted values in the "aud" claim of the ID token
  e.g. as required for passing FAPI 2 conformance testing
- bump to 2.4.16.5rc0

09/29/2024
- release 2.4.16.4

09/27/2024
- correct usage of free() for json_dumps return values instead of cjose_get_dealloc()()
- use compact encoding and preserve order where appropriate for most calls to json_dumps
- replace json_dumps/free combos with oidc_util_encode_json
- refactor oidc_jwk_to_json
- bump to 2.4.16.4rc3

09/26/2024
- fix oidc_jwk_copy wrt. "x5t", which broke private_key_jwt authentication to Azure AD since 2.4.13
  see #1269; thanks @uoe-pjackson
- bump to 2.4.16.4rc2

09/21/2024
- refactor state and userinfo

09/11/2024
- change warnings about not passing unknown claim types into debug messages; see #1263; thanks @nclarkau
- bump to 2.4.16.4rc1

09/09/2024
- fix accepting custom cookie names in OIDCOAuthAcceptTokenAs cookie:<name>; see #1261; thanks @bbartke
- bump to 2.4.16.4rc0
- improve basic authentication parsing when using OIDCOAuthAcceptTokenAs basic

09/06/2024
- allow overriding globally set OIDCCacheType back to shm in vhosts
- correct typo in child initialization routines when using multiple vhosts; closes #1208; thanks @studersi
  this fixes possible segmentation faults when using Redis and Metrics settings in vhosts
- release 2.4.16.3

09/05/2024
- fix OIDCCacheShmMax min/max settings; see #1260; thanks @bbartke
- bump to 2.4.16.3dev

08/30/2024
- release 2.4.16.2

08/29/2024
- fix setting OIDCPKCEMethod none; closes #1256; thanks @eoliphan

08/28/2024
- re-introduce OIDCSessionMaxDuration 0; see #1252
- bump to 2.4.16.2dev
- add some resilience when both Forwarded and X-Forwarded-* are configured
- fix disabled OIDCStateCookiePrefix command; closes #1254; thanks @damisanet
- remove support for OIDCHTMLErrorTemplate, deprecated since 2.4.14

08/26/2024
- fix parsing OIDCXForwardedHeaders; closes #1250; thanks @maltesmann
- release 2.4.16.1

08/23/2024
- release 2.4.16

07/03/2024
- cfg/provider: use oidc_jwk_list_copy when merging client_keys

06/18/2024
- memcache: correct dead server check on APR_NOTFOUND; see #1230; thanks @rpluem-vf

06/08/2024
- support DPoP nonces to the userinfo endpoint

06/07/2024
- return response headers from outgoing HTTP requests to callers
- support DPoP nonces to the token endpoint

06/06/2024
- add OIDCDPoPMode [off|optional|required] primitive
- store the token_type in the session

06/05/2024
- add "nbf" claim in the Request Object as per https://openid.net/specs/openid-financial-api-part-2-1_0-final.html#rfc.section.5.2.2

06/04/2024
- add (client) support for RFC 9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)
- replace multi-provider .conf "issuer_specific_redirect_uri" boolean with "response_require_iss" boolean
- tighten up the "aud" claim validation in ID tokens
- add support for the FAPI 2.0 Security Profile https://openid.net/specs/fapi-2_0-security-profile-ID2.html

05/30/2024
- add support for RFC 9126 OAuth 2.0 Pushed Authorization Requests

04/23/2024
- disable support for the RSA PKCS v1.5 JWE encryption algorithm as it is deemed unsafe
  due to the Marvin attack and is removed from libcjose as well

04/05/2024
- add debug printout for OIDCUnAuthAction expression evaluation

04/03/2024
- when an expression is configured for OIDCUnAuthAction (i.e. in the 2nd argument), also apply
  it to OIDCUnAutzAction so that it can be used to enable step-up authentication for SPAs with
  non-conformant browsers (some versions of Safari) and in (potentially insecure) iframes
  see #1205; thanks @ryanwilliamnicholls
  
04/02/2024
- major rewrite of config primitive handling:
  - split out over different files, use header files consistently
  - encapsulate config record with getters/setters
  - allow overriding defined global configuration primitives to their default value on the individual vhost level
  - apply input/boundary checking on all configuration values, shared with provider metadata parsing
  - various fixes to applying default config values and allowing primitives in vhost/directory scopes
- return HTTTP 502 when refreshing acces token or userinfo fails (default: "502_on_error")
- use a singleton token refresh mutex
- add support for OIDCOAuthIntrospectionEndpointKeyPassword
- bump to 2.4.16dev

04/01/2024
- release 2.4.15.7

03/29/2024
- fix OIDCUserInfoRefreshInterval, interval seconds would be interpreted as microseconds

03/14/2024
- fix userinfo refresh interval parsing; closes #1200; thanks @HolgerHees
  avoid refreshing userinfo on each request until access token expiry
- store interval as JSON integer in session
- use SameSite=Lax when OIDCCookieSameSite is On (also by default) instead of
  Strict as overriding from Lax to Strict does not work reliably anymore (Chrome)
- release 2.4.15.6

03/13/2024
- fix compilation without libhiredis; closes #1195 ; thanks @HolgerHees
  conditionally define oidc_set_redis_connect_timeout
- fix `OIDCPassClaimsAs environment` bug introduced in 2.4.15.4; see #1196; thanks @HolgerHees
- release 2.4.15.5

03/12/2024
- release 2.4.15.4
- fix setting the default PCKE method to "none" in a multi-provider setup
- bump to 2.4.15.5dev

03/11/2024
- avoid warning about setting a self-provided default value in the provider config

03/07/2024
- OIDCProviderSignedJwksUri: accept verification key set formatted as either JWK or JWKS
  see #1191; thanks @psteniusubi
- properly handle parse errors in Require claim integer statements

03/06/2024
- add support for JSON real and null value matching in Require claim statements
- fix evaluation Require statements for nested array claims
- refactor handle/authz.c

03/04/2024
- refactor integer and timestamp handling
- fix default HTTP short retry interval setting
- accept 0 in OIDCUserInfoRefreshInterval
- userinfo refresh: don't try to refresh the access token and retry when a connectivity error has occurred
- logout: don't try to revoke tokens on post-access-token-refresh or post-userinfo-refresh-errors logouts

03/01/2024
- accept strings as well as integers in the "expires_in" claim from the token endpoint
- fix for "expires_in" string values returned from the token endpoint that would be interpreted as 0
  this fixes using OIDCRefreshAccessTokenBeforeExpiry or OIDCUserInfoRefreshInterval with (older)
  Azure AD configs that would result in a token refresh on every request since 2.4.15 or a 401 in 2.4.14.4
- fix setting the "exp" claim in userinfo signed JWTs (exp would be now+0) when no expires_in is returned
  by the OP
- fix signed JWT caching when ttl set to 0 or "" which should apply the exp claim as the cache ttl

02/29/2024
- hash the cache key if it is larger than 512 bytes so large cache key entries (i.e. for JWT tokens)
  are no longer a problem in unencrypted SHM cache configs, i.e. the default shared memory cache setup;
  see issues/discussions on "could not construct cache key since key size is too large"
  this is relevant for OAuth 2.0 RS configs with JWT access tokens and OpenID Connect RP
  configs where OIDCRefreshAccessTokenBeforeExpiry/OIDCUserInfoRefreshInterval is set and
  a JWT refresh token is returned
- fix debug printout of cache key in oidc_cache_get

02/28/2024
- optimize performance by skipping JSON processing when `OIDCPassClaimsAs none` is set

02/25/2024
- implement oidc_util_apr_hash_clear so clearing hashtables works with older versions of libapr 
- refactor/extract HTTP functions

02/22/2024
- enable TCP keepalive on Redis connections by default
  and make it configurable in `OIDCRedisCacheConnectTimeout <connect-timeout> [0|<keep-alive-interval>]`
- refactor Redis connect routines

02/21/2024
- OIDCProviderSignedJwksUri: make exp claim optional in signed jwks; see #1182; thanks @psteniusubi
  interop with OpenID Federation specification https://openid.net/specs/openid-federation-1_0-32.html#section-5.2.1 

02/15/2024
- refactor zlib compression routines and add error checks
- bump to 2.4.15.4dev

02/13/2024
- release 2.4.15.3

02/12/2024
- set Redis default retry interval time to 300 milliseconds (instead of 0.5ms) and make it configurable
- rewrite handling of parallel refresh token grant requests
  - temporarily cache the results of the refresh token grant for other (almost) parallel callers
  - fixes handing on the same server, and improves clustered handling through a best-effort distributed cached lock
  - improves handling of non-rollover refresh tokens since it avoids unnecessary repeated calls to
    the token endpoint, unnecessary token issuance and possibly corruption because different tokens  "live"
    temporarily in the same (conceptual) session in parallel before the session is stored (and the last one wins)
- bump to 2.4.15.3dev

02/06/2024
- CVE-2024-24814: prevent DoS when `OIDCSessionType client-cookie` is set and a crafted Cookie header is supplied
  https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-hxr6-w4gc-7vvv
- release 2.4.15.2

01/31/2024
- avoid crash when Forwarded is not present but OIDCXForwardedHeaders is configured for it; see #1171; thanks @daviddpd
- bump to 2.4.15.2dev

01/30/2024
- release 2.4.15.1

01/22/2024
- refactor metrics and fix Prometheus output overlap; closes #1161; see #1162 and #1160; thanks @studersi
- bump to 2.4.15.1rc0

01/17/2024
- use `apr_file_rename` in file cache backend to fix issue with renaming files on windows

01/09/2024
- release 2.4.15

12/29/2023
- fix Redis connnect retries and make it configurable through environment variable OIDC_REDIS_MAX_TRIES
- bump to 2.4.15rc14

12/28/2023
- set memory alignment of shm cache structs to 64 bytes; see #1067
  should fix running on Raspberry PI / ARMv7 32 bits (arm32v7)
- make sure the shm cache entry size is a multiple of 8 bytes, see #1067; thanks @sanzinger
- bump to 2.4.15rc13

12/22/2023
- generate 20-byte lowercase hexadecimal session identifiers

12/20/2023
- generate or propagate traceparent header using OIDCTraceParent; closes #1152; thanks @studersi
- include hostname,port and process id in User-Agent header on outgoing requests
- bump to 2.4.15rc12

12/19/2023
- metrics update:
  - rename "requests" class to "provider"
  - don't include label name in metric name
  - add HTTP response code and connectivity counters
  - reset counters in shared memory rather than removing
  - performance
- bump to 2.4.15rc11

12/18/2023
- metrics refactoring and extension
- bump to 2.4.15rc10

12/15/2023
- add (and fix) more metrics, including provider requests, authorization and cache
- bump to 2.4.15rc9

12/14/2023
- add metrics collection capability, configured with OIDCMetricsData and retrieved through OIDCMetricsPublish
- bump to 2.4.15rc8

11/30/2023
- fix SSL server certificate validation when revoking tokens
  apply `OIDCSSLValidateServer` setting rather than `OIDCOAuthSSLValidateServer` in `oidc_revoke_tokens`
  see https://github.com/OpenIDC/mod_auth_openidc/discussions/1141; thanks @mschmidt72
- bump to 2.4.15rc7

11/27/2023
- use clang-format-17 for code formatting and reformat all code

11/23/2023
- add iat and exp claims to request object; closes #1137
- bump to 2.4.15rc6

11/22/2023
- populate User-Agent header in outgoing HTTP requests with mod_auth_openidc, libcurl and OpenSSL
  version information and log it for debugging purposes
- bump to 2.4.15rc5

11/08/2023
- improve error message in case of curl timeouts
- bump to 2.4.15rc4

11/02/2023
- apply ISO-8859-1 ("latin1") as default encoding mechanism for claim values passed in headers and environment
  variables to comply with https://www.rfc-editor.org/rfc/rfc5987; see #957; use "OIDCPassClaimsAs <any> none"
  for backwards compatibility
- bump to 2.4.15rc3

11/01/2023
- avoid warnings on cache misses (regression introduced in 2.4.15rc1)
- bump to 2.4.15rc2

10/31/2023
- add capability to seamlessly rollover OIDCCryptoPassphrase using a (temporary) 2nd value that holds the old one
- bump to 2.4.15rc1
- remove obsolete support for Token Binding https://www.rfc-editor.org/rfc/rfc8471.html (id_token, access_token, session cookie)
- use only the User-Agent header as input for the state browser fingerprinting by default (no X-Forwarded-For)
  as cloud environments increasingly use dynamic proxy IPs in front
- use PKCE S256 by default; disable by configuring "OIDCPKCEMethod none"
- use SameSite cookies Strict by default; disable by configuring "OIDCCookieSameSite Off"
 
10/30/2023
- do not apply logout_on_error and authenticate_on_error when a parallel refresh token request is detected
  see https://github.com/OpenIDC/mod_auth_openidc/discussions/1132; thanks @esunke
- restore backwards compatibility wrt. allowing parallel refresh token requests by default, and add an
  option to prevent that (i.e. in case of rolling refresh tokens) using envvar OIDC_PARALLEL_REFRESH_NOT_ALLOWED
- return HTTP 500 on token refresh errors instead of HTTP 401
- retry failed outgoing HTTP requests and add options to configure it in OIDCHTTPTimeoutLong/OIDCHTTPTimeoutShort
- bump to 2.4.15rc0
  
10/12/2023
- release 2.4.14.4

10/11/2023
- improve behaviour when parallel refresh token grant requests occur on the same Apache server/host
  and rolling refresh tokens are issued; synchronize using a global refresh token lock and avoid
  corrupting the session by storing/overwriting an expired refresh token
- bump to 2.4.14.4rc6

09/22/2023
- performance: store userinfo refresh interval in session to avoid parsing JSON on each request
- fix memory leak in oidc_refresh_token_grant: free the parsed id_token that is returned
- bump to 2.4.14.4rc5

09/20/2023
- performance: skip re-validating cached provider metadata
- performance: use process based locking instead of global locking for Redis caching
- avoid potential process lifetime memory leak when mutex lock/unlock fails

09/19/2023
- fix performance issue with latin1 encoding when using OIDCPassClaimsAs <any> latin1
- add options for authentication to OIDCOutgoingProxy; thanks @drzraf
  see https://github.com/OpenIDC/mod_auth_openidc/discussions/1107
- add support for custom preserve/restore POST data templates with OIDCPreservePostTemplates
  to be used when OIDCPreservePost is set to On; the hard-coded internal templates are added to
  the test directory as an example; closes #195 (yeah...); thanks @kerrermanisNL and @spiazzi
- bump to 2.4.14.4rc3

09/14/2023
- fix `OIDCRefreshAccessTokenBeforeExpiry` when using it with `logout_on_error` or `authenticate_on_error`
  see #1111; thanks @brandonk10
- bump to 2.4.14.4rc0

09/05/2023
- release 2.4.14.3

08/25/2023
- add support for adding extra parameters to the Logout Request to the OP with OIDCLogoutRequestParams
  see: https://github.com/OpenIDC/mod_auth_openidc/discussions/1096
- bump to 2.4.14.3rc7

08/13/2023
- increase performance of JQ filtering by caching JQ filtering results
  default cache ttl is 10 min, configured through environment variable OIDC_JQ_FILTER_CACHE_TTL
- bump to 2.4.14.3rc5

07/25/2023
- support "authenticate_on_error" 2nd parameter value in OIDCRefreshAccessTokenBeforeExpiry 
  to reauthenticate the user when refreshing the access token fails
  see: https://github.com/OpenIDC/mod_auth_openidc/discussions/1084; thanks @xrammit
- add logout_on_error and authenticate_on_error 2nd parameter option to OIDCUserInfoRefreshInterval
- bump to 2.4.14.3rc4

07/18/2023
- allow relative values in OIDCDefaultURL and OIDCDefaultLoggedOutURL
- bump to 2.4.14.3rc3

07/14/2023
- fix session updates on userinfo requests; see https://github.com/OpenIDC/mod_auth_openidc/discussions/1077
  this bug was introduced in v2.4.11 with d9fff154ee6ee8a7e4e969dd6a68cbaf18354598
- bump to 2.4.14.3rc2

07/12/2023
- add a sanity alg/enc check on self-encrypted AES GCM JWTs
- add `OIDCPassAccessToken Off` option to disable (the default of) passing the access token and its expiry
  in the OIDC_access_token/OIDC_access_token_expires header/environment variables; thanks @mattias-asander
- bump to 2.4.14.3rc1

06/05/2023
- avoid using encryption keys as signing keys for request objects and private_key_jwt token endpoint auth
- log the first Redis error as a warning before retrying
- release 2.4.14.2

05/30/2023
- revert all 401/403/302/stepup behaviour to <= 2.4.13.2
- bump to 2.4.14.2rc1

05/25/2023
- add support for extend_session=false query parameter to the info hook
  to avoid extending the session on calls to the info hook
- bump to 2.4.14.2rc0

05/24/2023
- fix RequireAny behaviour on 401/403/302: revert 9d6192b2ab0716d8f7d2a29754a80b6ab1e804eb for non-stepup authentication cases
- make OIDCUnautzAction 302|auth (i.e. step up authentication) work with multiple/complex Require expressions e.g. RequireAny
- release 2.4.14.1

05/17/2023
- fix refreshing claims from the userinfo endpoint when no id_token claims are stored in the session
- fix memory leak when refreshing claims from the userinfo endpoint
- bump to 2.4.14.1rc0
- fix docs on OIDCUnAutzAction 403 in auth_openidc.conf because we no longer rely on Apache 2.4's AuthzSendForbiddenOnFailure On to return 403

05/15/2023
- release 2.4.14

05/05/2023
- add exec support to OIDCClientSecret; see #1056; thanks @sealor

05/04/2023
- cater for libapr/libapr-util version 1.2.x
- bump to 2.4.14rc13

04/27/2023
- increase default OIDCCacheShmMax to 10000

04/25/2023
- add options to avoid revoking tokens before logout
  as some OPs may kill their SSO session that would make subsequent logout fail;
  configure an empty string in OIDCProviderRevocationEndpoint or set the
  OIDC_DONT_REVOKE_TOKENS_BEFORE_LOGOUT environment variable
- bump to 2.4.14rc12

04/24/2023
- preserve linefeeds in text areas with OIDCPreservePost On
  by changing the order of the "type=hidden" in the restore Javascript page
  see: https://github.com/OpenIDC/mod_auth_openidc/discussions/717
  thanks @paulQdata and @jansmets

04/23/2023
- add environment variable OIDC_DONT_STORE_ID_TOKEN_CLAIMS_IN_SESSION option to not store
  the claims in the id_token in the session, to avoid storing claims that are not used anyway
  and/or overlap with userinfo claims
- bump to 2.4.14rc11

04/21/2023
- use compressed serialized JSON for encrypted cache entries instead of signed JWTs, reducing cache entry size
- refactor (internal) encrypted JWTs handling
  - remove support for obsoleted internal signed JWTs
  - add resilience for corrupted metadata and jwks_uri cache entries

04/20/2023
- allow defining OIDCPassIDTokenAs on a per-location/directory level; also fixes resetting back to "claims" in vhosts
- turn of caching by default for `OIDCPassUserInfoAs signed_jwt`
- use compressed serialized JSON for encrypted state and session cookies, reducing their size; thanks @hihellobolke
- bump to 2.4.14rc10

04/19/2023
- add support for using Elliptic Curve keys with `OIDCPassUserInfoAs signed_jwt`
- bump to 2.4.14rc9

04/18/2023
- support calling the refresh token grant before doing RP-initiated logout
  when the environment variable OIDC_REFRESH_TOKENS_BEFORE_LOGOUT is set
  may be used to supply a (fresh or non-cached) id_token_hint logout request parameter
- add support for returning the serialized id_token as id_token_hint from the info hook
- fix crash when using a multi-provider setup and Provider has signed_jwks_uri set but
  the conf file does not define signed_jwks_uri_key
- correct return value from oidc_cache_shm_destroy to avoid misleading
  "cache destroy function failed" error messages
- bump to 2.4.14rc8

04/16/2023
- OIDCUnAutzAction auth for stepup authentication now immediately returns a 302 instead
  of a 200 HTML page with a meta refresh tag and a Location header
- also fix OIDCUnAutzAction 403 so it does not rely on AuthzSendForbiddenOnFailure
- bump to 2.4.14rc7

04/13/2023
- fix session cookie decompression error with OIDCSessionType client-cookie; closes #1046; thanks @oss-aimoto
  this would occur when the uncompressed JWT is larger than 4 times the compressed JWT
    oidc_util_jwt_verify: parsing JWT failed: [src/jose.c:901: oidc_jose_zlib_uncompress]: inflate failed
    oidc_session_decode: could not verify secure JWT: cache value possibly corrupted
  https://github.com/OpenIDC/mod_auth_openidc/pull/1047
- add option to strip the AES GCM header from encrypted state/session JWTs with env var OIDC_JWT_STRIP_HDR=true
- bump to 2.4.14rc6

04/11/2023
- add caching of signed userinfo JWTs; default cache time is set to the "exp" claim, can be configured/disabled with:
    SetEnvIfExpr true "OIDC_USERINFO_SIGNED_JWT_CACHE_TTL=0" 
  be careful when setting "jti", "nbf", "iat" and" "exp" claims in the OIDCUserInfoClaimsExpr filter since they may
  overload the cache with entries per-user/per-timestamp if the result differs from the previous request
- bump to 2.4.14rc5

04/11/2023
- add OIDCFilterClaimsExpr that allows for processing claims in the both the id_token and claims from the
  userinfo endpoint before storing them in the session, after applying (optional) blacklisting/whitelisting
  on the toplevel keys; only available when compiled/linked with libjq
- fix memory access error using default value for OIDCPassUserInfoAs
- bump to 2.4.14rc4

04/10/2023
- add support for OIDCUserInfoClaimsExpr that allows for processing claims returned from the userinfo
  endpoint with a JQ-based expression before propagating them according to OIDCPassUserInfoAs claims|json|signed_jwt
  (ie. does not work for "OIDCPassUserInfoAs jwt"), and is only available when compiled/linked with libjq
- allow OIDCPassUserInfoAs directive in Location/Directory contexts  
- fix memory leak when using JQ-based expressions in "Require claims_expr"
- bump to 2.4.14rc3

04/09/2023
- make sure mod_auth_openidc runs before mod_proxy so calls to the redirect URI are never proxied
  and no separate Location directive or ProxyPass exception for OIDCRedirectURI is required (anymore)
- handle discovery in the content handler so regular Apache processing applies to the HTTP/HTML response
- bump to 2.4.14rc2

04/09/2023
- return 40x instead of 200 on all (authorization) error responses
- correct backwards compatibility with <2.4.14 for state mismatch/timeout handling
- bump to 2.4.14rc1

04/07/2023
- deprecate OIDCHTMLErrorTemplate and rely on standard Apache error handling capabilities by default
  environment variable strings REDIRECT_OIDC_ERROR and REDIRECT_OIDC_ERROR_DESC are available in ErrorDocument
  backwards compatibility is retained by setting "OIDCHTMLErrorTemplate deprecated"
- bump to 2.4.14rc0

04/07/2023
- add support for passing on claims resolved from the userinfo endpoint in a JWT signed by
  mod_auth_openidc using `OIDCPassUserInfoAs signed_jwt[:<name>]`  with the keys configured
  in OIDCPrivateKeyFiles/OIDCPublicKeyFiles
- add support for overriding the default header/environment variable names in
  `OIDCPassUserInfoAs json:<name>` (default: "OIDC_userinfo_json")
  and
  `OIDCPassUserInfoAs jwt:<name>` (default: "OIDC_userinfo_jwt")
- bump to 2.4.13.3rc3

04/06/2023
- merge client_signing_keys and client_encryption_keys into client_keys
  since we detect the usage type correctly now
- bump to 2.4.13.3rc2

04/04/2023
- support configuration of dedicated signing and encryption keys in the primitives:
  OIDCPublicKeyFiles, OIDCPrivateKeyFiles, OIDCProviderVerifyCertFiles, OIDCOAuthVerifySharedKeys and OIDCOAuthVerifyCertFiles
  by using the prefix "sig:" or "enc:" in the value; using this in OIDCPublicKeyFiles also
  publishes separate "use: sig" and/or "use: enc" keys on the client jwks_uri <redirect_uri>?jwks=rsa
- fix: don't immediately refresh of JWKs from (signed)_jwks_uri if "kid" was not set in JWT, but try the cache first
- fix: properly respect "use" attribute (sig/enc) in signing, verification and encryption
- bump to 2.4.13.3rc1

04/03/2023
- generate Elliptic Curve "kid" using curve identifier with htonl in network byte order
  so "make check" works on big endian platforms
- include openssl/err.h in config.c to avoid compiler warning with OpenSSL 1.0.x
- bump to 2.4.13.3rc0

04/03/2023
- release 2.4.13.2

04/01/2023
- allow target_link_uri's without a path in 3rd-party-init SSO with a multi-provider setup
- correct error log in target_link_uri matching

03/28/2023
- CVE-2023-28625: prevent core dump when OIDCStripCookies is set and a crafted Cookie header is supplied
  https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr
- replace apr_strnatcmp/strcmp with _oidc_strcmp and replace strncmp with _oidc_strncmp
- handle OpenSSL initialization in new oidc_pre_config_init function:
  this allows omitting "kid" in OIDCPublicKeyFiles (ao.) when linked against OpenSSL 1.0.x

03/27/2023
- fix code scanning alerts
- bump to 2.4.13.2rc2
  
03/24/2023
- add support for Elliptic Curve signing/encryption keys in addtion to RSA keys,
  i.e. client keys configured in OIDCPrivateKeyFiles/OIDCPublicKeyFiles, published on OIDCClientJwksUri
  and used in private_key_jwt authentication, encrypted id_token's, request objects/uri's,
  but also statically configured provider keys in OIDCOAuthVerifyCertFiles and OIDCProviderVerifyCertFiles
- refactor Docker tests make targets; add test/Makefile
- bump to 2.4.13.2rc1

03/24/2023
- record authorization errors in environment variable OIDC_AUTHZ_ERROR
  so its value can be used in logs e.g. with HTTP 401 responses:
    LogFormat "%h %l %u %t %U %401{OIDC_AUTHZ_ERROR}e %>s %b" combined
- log authorization errors with oidc_debug instead of oidc_info
- bump to 2.4.13.2rc0

03/10/2023
- fix oidc_jwk_list_copy and usage of OIDCProviderVerifyCertFiles
- release 2.4.13.1

03/10/2023
- shm cache: increase default maximum number of active sessions from 500 to 2000
- shm cache: allow configuration of max 1Mb of session data for a single session
- use deep-copy and cleanup functions for server and provider configs; fixes overriding server-level keys in vhost configs
- release 2.4.13

03/09/2023
- add support for OP "signed_jwks_uri" with "OIDCProviderSignedJwksUri <uri> <jwk>"
- don't pull JWKs when the id_token was signed with a symmetric key
- don't immediately refresh of JWKs from (signed)_jwks_uri if "kid" was not set in JWT, but try the cache first
- warn about incorrect configurations not setting OIDCCryptoPassphrase; see https://github.com/OpenIDC/mod_auth_openidc/discussions/1030
- bump to 2.4.13rc5

03/08/2023
- move repo to OpenIDC github organization

03/02/2023
- allow setting minumum and maximum versions of TLS used in HTTPs calls via libcurl environment
  variable CURLOPT_SSL_OPTIONS e.g.:
  SetEnvIfExpr true "CURLOPT_SSL_OPTIONS=CURL_SSLVERSION_TLSv1_3 CURL_SSLVERSION_MAX_TLSv1_3" ; bump to 2.4.13rc3
- bump to 2.4.13rc3

03/01/2023
- revert accidentally removed libbrotli code in jose.c
- bump to 2.4.13rc2

02/19/2023
- add optional - compilation time support - for brotli compression of session and state cookies

02/17/2023
- avoid (small) memory leak when using OpenSSL 3.x when setting public/private keys
  (over graceful restarts) in the config and/or importing JWKs with x5c specs
- compress session and state cookies; add zlib as a dependency
- bump to 2.4.13rc0

01/27/2023
- increase maximum allowed size of HTTP responses (e.g. from token endpoint) to 10Mb; see #998; thanks @mikehearn
- do a sanity check on the individual size of claim values stored in the session, warn about blacklisting if > 8Kb
- bump to 2.4.12.4rc2

01/23/2023
- release 2.4.12.3

01/20/2023
- add OIDCProviderVerifyCertFiles option to statically configure ID token validation keys; see #989; thanks @madsfreek
- fix bug in OIDCOAuthVerifyCertFiles where cert(s) would be cast to apr_hash_t instead of apr_array_header_t; see #990; thanks @bommo1
- bump to 2.4.12.3rc0

12/28/2022
- update sample/test Dockerfile to Ubuntu Jammy

12/13/2022
- CVE-2022-23527: prevent open redirect in default setup when OIDCRedirectURLsAllowed is not configured
  see: https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-q6f2-285m-gr53
- release 2.4.12.2

12/08/2022
- simplify redis context code
- bump to 2.4.12.2rc1

11/18/2022
- allow overriding the type of lock used at compile time with OIDC_LOCK
- bump to 2.4.12.2rc0

11/15/2022
- release 2.4.12.1

11/13/2022
- switch to using apr_generate_random_bytes instead of apr_uuid_get to generate session identifiers
  so there's no longer a (rather implicit) dependency on a libapr that is compiled againt libuuid
  on Linux platforms; see #431, #603 and #694; thanks @amitnarang28
- cache file backend fix: delete the correct file upon logout; closes #955; thanks @damisanet
- bump to 2.4.12.1rc5

11/08/2022
- add option to use ISO-8859-1 encoding for propagated claim values by adding
  "latin1" option to OIDCPassClaimsAs <> latin1; see #957; thanks @nvchaudhari1991
  Note that the encoding - including the existing "base64url" - apply to both header and
  environment variables as well now.
- bump to 2.4.12.1rc4

10/26/2022
- OIDCProviderMetadataRefreshInterval was interpreted in microseconds instead
  of the documented and intended seconds; setting in to seconds would effectively
  turn of caching and pull the configuration document on each request
- bump to 2.4.12.1rc3

10/25/2022
- define APLOG_TRACE1 if it does not exist
- bump to 2.4.12.1rc2

10/20/2022
- CI: add memory and semaphore checks on various distro's
- correct ap_hook_insert_filter function signature in stub.c, part 3; see #784
- fix printout of cache mutex errors in cache/common.c
- prefer APR_LOCK_POSIXSEM over APR_LOCK_DEFAULT in apr_global_mutex_create
  which is apparently required for (some) ARM based builds (and CI)
- bump to 2.4.12.1rc1
- fix potential memory leak in proto.c when oidc_util_create_symmetric_key fails
- fix potential memory leak in proto.c when oidc_proto_validate_access_token fails (at_hash validation)

10/19/2022
- fix cleanup of semaphores on graceful restarts; see #522, closes #458
  simplify mutex/shm cleanup without semaphores because we track the parent process anyway; 
- bump to 2.4.12.1rc0

10/17/2022
- release 2.4.12

10/15/2022
- add option to set a username for Redis authentication via OIDCRedisCacheUsername
- bump to 2.4.11.4rc7

10/14/2022
- set minimum number of default memcache threads to 0 to retain backwards compatibility
  see #916
- support OIDCSessionInactivityTimeout values greater than 30 days when using Memcache
  see #936, thanks @takesson
- bump to 2.4.11.4rc6

10/03/2022
- add -fPIC to test and test-cmd compilation; see #925
- bump to 2.4.11.4rc5

09/23/2022
- allow for step-up discovery with an external URL using HTML refresh 
  fixes behaviour on CentOS 7/8 when combined with ProxyPass
- bump to 2.4.11.4rc4

09/12/2022
- add options to retrieve the configuration document only or pull keys from the JWKS URI;
  for certification purposes
- check ID token signed response algorithm on backchannel logout_token and retrieve its
  configuration value from the client metadata file; for certification purposes
- register request_object_signing_alg in dynamic client registration when using request_uri;
  for certification purposes
- bump to 2.4.11.4rc3

09/08/2022
- store access token obtained from backchannel in session over the one returned
  in the frontchannel for "code token" and "code id_token token" flows; for 
  certification purposes
- apply exact length matching for at_hash and c_hash validation; for certification purposes
- increase size of the output buffer when using libpcre2 for substitution; closes #915
- bump to 2.4.11.4rc2
- allow setting connection pool parameters for Memcache server connections;
  see #916; thanks @rpluem-vf

08/24/2022
- avoid using $< in Makefile
- allow storing the id_token in a client-cookie based session; see #812 and #888
- bump to 2.4.11.4rc1

08/22/2022
- add oidc_util_strcasestr
- bump to 2.4.11.4rc0

08/22/2022
- release 2.4.11.3

08/15/2022
- avoid memory leak when using PCRE2 regular expressions with array matching; closes #902; thanks @smanolache
- avoid memory leak when cjose_jws_get_plaintext fails; closes #903; thanks @smanolache
- bump to 2.4.11.3rc4

05/20/2022
- fix handling of IPv6 based logout URLs; thanks @@codemaker219
- bump to 2.4.11.3rc1

05/16/2022
- Use optionally provided sid and iss request parameters during front channel
  logout; see #855; thanks @rpluem-vf

05/06/2022
- support Forwarded header in addition to X-Forwarded-*; see #853; thanks @studersi
- bump to 2.4.11.3rc0

05/05/2022
- release 2.4.11.2

05/04/2022
- add support for Apache expressions in OIDCPathAuthRequestParams and OIDCPathScope; see #594
- bump to 2.4.11.2rc2

04/22/2022
- add no Cache-Control headers to logout request response; see #846; thanks @blackwhiser1
- bump to 2.4.11.2rc1

04/06/2022
- don't strip the header from encrypted JWTs as future versions of cjose may use compact
  encoding for JWEs; this slightly increases state cookie size, by-value session cookies
  and encrypted cache contents again at the benefit of forward cjose compatibility
- bump to 2.4.11.2rc0

03/29/2022
- release 2.4.11.1

03/28/2022
- correct registration_endpoint_json naming in auth_openidc.conf documentation 

03/21/2022
- fix OIDCUnAuthAction pass, see #790
- bump to 2.4.11.1rc5

03/18/2022
- fix make check; add @smanolache to the AUTHORS file
- bump to 2.4.11.1rc4

03/17/2022
- fix memory leaks over graceful restarts: use s->process->pconf pool instead of
  the s->process->pool in oidc_slog and oidc_cache_shm_cfg_create
  closes #823 and #824; thanks @smanolache

03/14/2022
- fix temporary cache file naming; see #777

03/08/2022
- fix a 2nd race condition in the file cache backend; see #777; thanks @dbakker and @blackwhiser1
- bump to 2.4.11.1rc3

03/04/2022
- add support for OpenSSL 3.0
- remove test-cmd jwk2cert command
- bump to 2.4.11.1rc2

02/28/2022
- add a check to make sure URLs do not contain unencoded Unicode characters; see #796; thanks @cnico
- bump to 2.4.11.1rc1

02/27/2022
- document Apache 2.4 behavior on OIDCUnAutzAction 403; see #795; thanks @candlerb

02/04/2022
- correct ap_hook_insert_filter function signature in stub.c, part 2; closes #784; thanks @stroeder

02/03/2022
- add Valgrind Github action
- warn about mismatch between incoming X-Forwarded-* headers and OIDCXForwardedHeaders configuration
- avoid using %llu print formatter and switch to %lu for unsigned long so it works cross platform
- bump to 2.4.11.1rc0

01/26/2022
- improve handling session duration expiry when combined with OIDCUnAuthAction or Discovery
  also clear r->user in oidc_session_kill for such cases; see #778
- release 2.4.11

01/24/2022
- fix race condition in file cache backend reading truncated files under load; see #777; thanks @dbakker
- bump to 2.4.11rc7

01/23/2022
- fix regular expressions in Require statements
- bump to 2.4.11rc6

01/22/2022
- no longer defer Discovery to the content handler to allow RequireAll and Require not directives
  see #770; closes #775; thanks @rajeevn1
- bump to 2.4.11rc5

01/17/2022
- terminate on startup when the crypto passphrase generated by "exec:" is empty; see #767
- bump to 2.4.11rc4

01/15/2022
- correct printout of session id and remote user tuple for new sessions
- avoid debug printout of payload as header when the latter is stripped

01/14/2022
- fix: avoid crash when using pcre2 for claims matching: don't pass NULL for errorstr
- add administrative session revocation capability <redirect_uri>?revoke_session=<uuid>
- bump to 2.4.11rc3

01/12/2022
- add AM_PROG_CC_C_O to configure.ac (at least for RHEL 7.7); see #765; thanks @bitmagewb
- include <openssl/bn.h> in jose.c to compile with OpenSSL 1.0.x
- fix parameters to get_current_url in oidc_handle_unauthorized_user22
- bump to 2.4.11rc2

01/06/2022
- improve detection of suspicious redirect URLs; add test list
- bump to 2.4.11rc1

12/24/2021
- make interpretation of X-Forwarded-* headers configurable, defaulting to none
  so mod_auth_openidc running behind a reverse proxy that sets X-Forwarded-* headers
  needs explicit configuration of OIDCXForwardedHeaders
- bump to 2.4.11rc0

12/21/2021
- add "x5t" to JWT header in private_key_jwt client assertions; for interop with Azure AD
- add CI Github workflow over Travis
- bump to 2.4.10.1rc4

12/16/2021
- make X-Frame-Options header returned on OIDC front-channel logout requests configurable
  through OIDCLogoutXFrameOptions; closes #464
- bump to 2.4.10.1rc3

12/15/2021
- remove typedef for oidc_pcre to avoid compiler errors

12/02/2021
- add support for libpcre2; see #740
- bump to 2.4.10.1rc2

12/01/2021
- allow authorization on info requests, see #746
- bump to 2.4.10rc1

11/28/2021
- install taking into account DESTDIR; see #674; thanks @alerque

11/11/2021
- correct ap_hook_insert_filter function signature in stub.c; closes #732; thanks @stroeder
- bump to 2.4.10.1rc0

11/10/2021
- release 2.4.10

11/03/2021
- add redirect/text options to OIDCUnAutzAction; see #715; thanks @chrisinmtown
- bump to 2.4.10rc1

11/02/2021
- add check for Sec-Fetch-Dest header != "document" value to auto-detect requests that are not
  capable of handling an authentication round trip to the Provider;
  see https://github.com/zmartzone/mod_auth_openidc/discussions/714; thanks @studersi
- bump to 2.4.10rc0

10/28/2021
- use apxs to link the module in Makefile.am
- bump to 2.4.9.5rc8

10/27/2021
- fix regexp substition crash using OIDCRemoteUserClaim; thanks @nneul; closes #720
- backport ap_get_exec_line, supporting the "exec:" option in OIDCCryptoPassphrase
- add check for Sec-Fetch-Mode header != "navigate" value to auto-detect XML HTTP Requests
- bump to 2.4.9.5rc7

10/22/2021
- complete usage of autoconf/automake; see #674
- bump to 2.4.9.5rc4

10/20/2021
- fix parallel builds (on Debian) for now
- bump to 2.4.9.5rc1

10/19/2021
- log require claims failure on info level
- bump to 2.4.9.5rc0

09/09/2021
- fix memory leak when parsing JWT access token fails (in RS mode)

09/07/2021
- reorganize Redis code for extensibility

09/03/2021
- return HTTP 200 for OPTIONS requests in auth-openidc mixed mode
- don't apply claims based authorization for OPTIONS requests
  so paths protected with Require claim directives will now also
  return HTTP 200 for OPTIONS requests
- fix typo in 2.2 authorization routine

09/03/2021
- don't apply authz in discovery process; fixes 2.4.9.3
- apply OIDCRedirectURLsAllowed setting to target_link_uri; closes #672; thanks @Meheni
- release 2.4.9.4

08/26/2021
- don't apply authz to the redirect URI; fixes ac5686495a51bc93e257e42bfdc9c9c46252feb1
- bump to 2.4.9.3

08/20/2021
- fix graceful restart (regression); see #458; thanks @Foxite
- bump to 2.4.9.2

08/18/2021
- preserve session cookie in the event of a cache backend failure
- update the id_token in the session cache if one is provided while refreshing the access token

08/13/2021
- fix retried Redis commands after a reconnect; thanks @iainh
- release 2.4.9.1

07/22/2021
- use redisvCommand to avoid crash with crafted key when using Redis without encryption; thanks @thomas-chauchefoin-sonarsource
- replace potentially harmful backslashes with forward slashes when validating redirection URLs; thanks @thomas-chauchefoin-sonarsource
- release 2.4.9
- don't use DEFAULT_LIMIT_REQUEST_LINE constant; since it does not exist in Apache 2.2.x

07/15/2021
- verify that "alg" is not none in logout_token explicitly
- make session not found on backchannel logout produce a log warning instead of error
- don't clear POST params authn on token revocation; thanks @iainh
- bump to 2.4.9rc0

07/02/2021
- handle discovery in the content handler
- return OK in the content handler for calls to the redirect URI and when preserving POST data

06/25/2021
- avoid XSS vulnerability when using OIDCPreservePost On and supplying URLs that contain single quotes
  thanks @oss-aimoto

06/21/2021
- strip A256GCM JWT header from encrypted JWTS used for state cookies, cache encryption and by-value session cookies
  resulting in smaller cookies and reduced cache content size

06/10/2021
- use encrypted JWTs for storing encrypted cache contents and avoid using static AAD/IV; thanks @niebardzo
- bump to 2.4.9-dev

06/04/2021
- fix a problem where the host and port are calculated incorrectly, when you use literal ipv6 address.

06/02/2021
- do not send state timeout HTML document when OIDCDefaultURL is set; this can be overridden by using e.g.:
  SetEnvIfExpr true OIDC_NO_DEFAULT_URL_ON_STATE_TIMEOUT=true 
- release 2.4.8.4

06/01/2021
- avoid Apache 2.4 appending 400/302(200/404) HTML document text to state timeout HTML info page
  see also f5959d767b0eec4856d561cbaa6d2262a52da551 and #484; at least Debian Buster was affected
- release 2.4.8.3

05/18/2021
- make error "session corrupted: no issuer found in session" a warning only so a logout call for a
  non-existing session no longer produces error messages

05/08/2021
- store timestamps in session in seconds to avoid string conversion problems on some (libapr-1)
  platform build/run combinations, causing "maximum session duration exceeded" errors
- bump to 2.4.8.2

05/07/2021
- add OIDCClientTokenEndpointKeyPassword option to allow the use of an encrypted private key
- release 2.4.8.1

04/30/2021
- fix potential crash when Content-Type is not set in POST requests; thanks Tatsuhiko Yasumatsu of JPCERT/CC
- release 2.4.8

04/21/2021
- on OAuth 2.0 RS token scope/claim 401 error, add environment variable for usage with mod_headers,
  instead of adding a header ourselves; see #572; usage, e.g;
    Header always append WWW-Authenticate %{OIDC_OAUTH_BEARER_SCOPE_ERROR}e "expr=(%{REQUEST_STATUS} == 401) && (-n reqenv('OIDC_OAUTH_BEARER_SCOPE_ERROR'))"
- bump to 2.4.8-dev

04/13/2021
- add OIDCRedisCacheConnectTimeout and OIDCRedisCacheTimeout options to configure Redis timeouts
- bump to 2.4.7.2

04/12/2021
- fix memory leaks when caching fails
- bump to 2.4.7.1

04/04/2021
- improve documentation on OIDCPreservePost
- release 2.4.7

04/01/2021
- bump to 2.4.7rc1

02/16/2021
- remove session from cache before clearing it.

02/12/2021
- add maximum session lifetime (exp), inactivity timeout (timeout) and remote_user to OIDCInfoHook
- bump to 2.4.7-dev

02/08/2021
- return 400 instead of 500 when state cookie matching fails
- release 2.4.6

02/03/2021
- avoid displaying the client_secret in debug logs

01/28/2021
- avoid segmentation fault when hitting an endpoint configured with AuthType openid-connect
  in an OAuth 2.0 only setup; see #529

01/23/2021
- fix semaphore cleanup on graceful restarts; see #522

01/12/2021
- fix inconsistent public/private keys loading order; closes #515

12/17/2020
- remove support for https://tools.ietf.org/html/draft-bradley-oauth-jwt-encoded-state

12/10/2020
- add "base64url" option to OIDCPassClaimsAs primitive; closes #417

12/09/2020
- add Redis database selection option with OIDCRedisCacheDatabase; closes #423
- optimize Redis AUTH execution once per connection

12/07/2020
- don't set SameSite=None on cookies when on plain http

12/03/2020
- add environment variable to control libcURL CURLOPT_SSL_OPTIONS behaviors
  e.g.: SetEnvIfExpr true CURLOPT_SSL_OPTIONS=CURLSSLOPT_NO_REVOKE

11/23/2020
- release 2.4.5
- make sure the module compiles with Apache 2.2 for passphrase exec:
- bump to 2.4.6-dev

11/19/2020
- ensure that "sub" is returned from the userinfo endpoint following https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse
  prevents potential ID spoofing; thanks Christian Fries of Ruhr-University Bochum
- don't printout JSON errors about NULL characters in error log; thanks Christian Fries of Ruhr-University Bochum
- restrict printout of JSON parsing errors to 4096 bytes; thanks Christian Fries of Ruhr-University Bochum
- bump to 2.4.5rc6

11/5/2020
- fix content processing for info and JWKs handler so mod_headers etc. works; closes #497
- bump to 2.4.5rc5

11/2/2020
- improve sanity checking on Redis reply
- bump to 2.4.5rc4

10/30/2020
- disable caching token introspection results by setting OIDCOAuthTokenIntrospectionInterval to -1; thanks @wadahiro
- bump to 2.4.5rc3

10/27/2020
- config check on OIDCCryptoPassphrase in OAuth 2.0 RS setup with cache encryption enabled
- bump to 2.4.5rc2

10/22/2020
- hash define expression option to OIDCUnAuthAction so it compiles for Apache 2.2; fixes 1461634
- bump to 2.4.5rc1
- add exec support to OIDCCryptoPassphrase
 
10/19/2020
- delete stale session cookies that aren't in the cache
- allow OIDCDiscoverURL to be a relative URL

10/08/2020
- add OIDCCABundlePath for configuring path to curl CA bundle

09/22/2020
- avoid Apache 2.4 appending 401 HTML document text to step-up authentication HTML refresh page; closes #484
- bump to 2.4.5rc0

09/21/2020
- populate AUTH_TYPE when performing authentication; thanks @spanglerco

09/19/2020
- enable authentication of sub-requests when the main request doesn't require
  authentication; thanks @spanglerco

09/03/2020
- add SameSite attribute on cookie clearance / logout; thanks @v0gler
- bump to 2.4.4.1

09/01/2020
- forward port Tufin patches
- always set session cookie same site policy to Lax
- disable cookie domain check
- unset host headers for metadata URL retrieval
- bump to 2.4.4-tufin

09/01/2020
- avoid GCC 9 compiler warnings
- release 2.4.4

08/28/2020
- allow Content-Type check on backchannel logout to have postfixes (utf-8 etc)
- terminate backchannel logout with DONE instead of OK to avoid authz error 500
- bump to 2.4.4rc8

08/18/2020
- add recommended cache headers on backchannel logout response
  https://openid.net/specs/openid-connect-backchannel-1_0.html#rfc.section.2.8
- bump to 2.4.4rc7

08/10/2020
- add new OIDCStateCookiePrefix primitive for the state cookie prefix

08/01/2020
- add conditional expression to OIDCUnAuthAction; see #479; thanks @raro42 and @marcstern
- bump to 2.4.4rc6

07/31/2020
- reverse order of creating HTML response and adding session cookie; thanks @deisser
- bump to 2.4.4rc5

07/30/2020
- fix doubled Set-Cookie behaviour when using `client-cookie`, calling the session info hook
  and writing out a session update (twice); thanks @deisser
- bump to 2.4.4rc4

07/27/2020
- prevent XSS and open redirect on OIDC session managemement OP iframe with OIDCRedirectURLsAllowed
  thanks Andrew Brady
- bump to 2.4.4rc3

07/22/2020
- delete state cookie when it cannot be decoded/decrypted
- bump to 2.4.4rc2

07/03/2020
- fix for loop initial declarations to not require c99 for compilation (RHEL 6)
- add ap_expr.h include in stub.c (RHEL 6)
- bump to 2.4.4rc1

06/30/2020
- add grant_types to dynamic client registration request
- don't send access_token in user info request when method is set to POST; conform OIDC test suite 4.0.5
- bump to 2.4.4rc0

06/10/2020
- prevent open redirect on refresh token requests
  add new OIDCRedirectURLsAllowed primitive to handle post logout and refresh-return-to validation
  addresses #453; closes #466
- release 2.4.3

06/09/2020
- fix complex expressions crash when compiled from source with libjq; closes #472
  thanks vincentscharf0803
  introduced by OIDCStateInputHeaders addition in 2.4.3rc0
- bump to 2.4.3rc1

05/11/2020
- added OIDCValidateIssuer to allow for disabling of issuer matching.  helps to support multi-tenant applications.

05/02/2020
- when stripping cookies, add a space between cookies in the resulting header (required by RFC 6265)
- move oidc_parse_config inside MODULE_MAGIC_NUMBER_MAJOR to make sure the module compiles with Apache 2.0

04/25/2020
- add OIDCStateInputHeaders that allows configuring the header values used to calculate the fingerprint of the state during authentication
- bump to 2.4.3rc0

03/25/2020
- oops: fix json_deep_copy of claims
- release 2.4.2.1

03/24/2020
- fix memory leak in OAuth 2.0 JWT validation; closes #470; thanks Conrad Thukral
- fix configured private/public key cleanup on process exit

03/21/2020
- allow for expressions in Require statements, see #469; thanks @wwaaron
  also see: https://github.com/zmartzone/mod_auth_openidc/wiki/Authorization#expressions-in-require-statements
- bump to 2.4.2rc5

03/19/2020
- always refresh keys from jwks_uri when there is no kid in the JWT header
- bump to 2.4.2rc4

03/15/2020
- destroy shared memory segments only in parent process; see #458
- bump to 2.4.2rc3

03/10/2020
- fix memory leaks introduced by #457
- bump to 2.4.2rc2

02/19/2020
- if content was already returned via html/http send then don't return 500
  but send 200 to avoid extraneous internal error document text to be sent
  on some Apache 2.4.x versions e.g. CentOS 7
- bump to 2.4.2rc1

02/03/2020
- if OIDCPublicKeyFiles contains a certificate, the corresponding x5c, x5t and x5t#256 
  parameters will be added to the generated jwkset available at "<redirect_uri>?jwks=rsa"
  thanks @absynth76
- fix: also add SameSite=None to by-value session cookies
- bump to 2.4.2rc0

01/30/2020
- try to fix graceful restart crash; see #458
- release 2.4.1

01/29/2020
- always add a SameSite value to the Set-Cookie header to satisfy upcoming Chrome/Firefox changes
  this can be overridden by using, e.g.:
    SetEnvIf User-Agent ".*IOS.*" OIDC_SET_COOKIE_APPEND=;
- release 2.4.1rc6

01/22/2020
- URL encode logout url in session management JS; thanks Paolo Battino
- bump to 2.4.1rc5

01/15/2020
- add value of OIDC_SET_COOKIE_APPEND env var to Set-Cookie headers
  useful for handling changing/upcoming SameSite behaviors across different browsers, e.g.:
    SetEnvIf User-Agent ".*IOS.*" OIDC_SET_COOKIE_APPEND=SameSite=None
- bump to 2.4.1rc4

01/08/2020
- support 407 option on OIDCUnAuthAction

12/09/2019
- fix parsing of values from metadata files when the default is non-NULL (e.g. UNSET)
- enforce OIDCIDTokenSignedResponseAlg and OIDCUserInfoSignedResponseAlg; see #435
- bump to 2.4.1rc2
- support login with OIDC session management; address #456
- bump to 2.4.1rc3

12/05/2019
- add the possibility to use a public key instead of a certificate for OIDCPublicKeyFiles parameter
- added an alpine dockerfile =~ 20MB container size

12/04/2019
- return 200 OK for backchannel logout if session not found
- bump to 2.4.1rc1

11/19/2019
- make cleaning of expired state cookies log with a warning rather than an error; thanks Pavel Drobov
- bump to 2.4.1rc0

10/03/2019
- improve validation of the post-logout URL parameter on logout; thanks AIMOTO Norihito; closes #449
- release 2.4.0.3
- clear any existing chunked cookies when setting a non-chunked cookie; prevents login loops in some scenarios

08/28/2019
- fixes #447 #441 : changed storing POST params from localStorage to
  sessionStorage due to some issue of losing data in localStorage in Firefox
  (private mode) 

08/22/2019
- release 2.4.0

08/16/2019
- revert 3d95b4a3fbc493c6acc745626ac33143eb4968bf: don't return early from the content handler

08/15/2019
- be smart about picking the token endpoint authentication method when not configured explicitly:
  don't choose the first one published by the OP but prefer client_secret_basic if that is listed as well
  see: panva/node-oidc-provider#514; thanks @richard-drummond and @panva
- bump to 2.4.0rc24

08/12/2019
- fix not clearing claims in session when setting claims to null; closes #445; thanks @FilipVujicic

08/12/2019
- fix JWT decryption crashing on non-null terminated input
- bump to 2.4.0rc23

08/09/2019
- add logout_on_error option to OIDCRefreshAccessTokenBeforeExpiry to kill the session when
  refreshing an access token fails; thanks @rickyepoderi
- bump to 2.4.0rc22

08/08/2019
- no longer use the fixup handler for environment variable setting but do it as part of the authn handler
- bump to 2.4.0rc21

08/04/2019
- avoid decoding non-form-encoded POST data; closes #443
- bump to 2.4.0rc20

08/02/2019
- return DONE from the content handler early to prevent triggering other content handlers
- fix `OIDCOAuthAcceptTokenAs post` so POST data is propagated and not lost; see #443
- bump to 2.4.0rc19

07/10/2019
- fix RSA JWK "x5c" parsing issue (e.g. when parsing "n" fails): explicitly set the "kid" into to JWK
- bump to 2.4.0rc18

06/19/2019
- fix regression bug that includes a HTTP 500 message after rendering content
- bump to 2.4.0rc17

06/14/2019
- fix regression bug when no per-provider keys have been configured and private_key_jwt is used
- bump to 2.4.0rc15

06/06/2019
- use per-provider signing keys in private_key_jwt authentication towards token endpoint
- bump to 2.4.0rc14

06/05/2019
- avoid passing empty key set for JWT decryption (solve but introduced in 2.4.0rc12)
- bump to 2.4.0rc13

06/03/2019
- enable per-provider signing and encryption keys; limitations:
  - for request object signing and id_token decryption only
  - take the first configured key, no kid specification
  - no publishing of key information on client endpoints
  - no userinfo JWT decryption
  - no composite claims decryption
  - no backchannel logout with encrypted logout token (inherent)
- bump to 2.4.0rc12

05/31/2019
- make sure the content handler is called for every request to the configured Redirect URI so all
  Apache processing is executed (e.g. setting headers with mod_headers) before returning the response
  thanks Don Sengpiehl (NB: this may affect browser behavior and backwards compatibility)
- add ability to view session info in HTML via the session info hook: <redirect_uri)?info=html
- bump to 2.4.0rc11

05/24/2019
- fix oidc_proto_html_post auto-post-submit so it no longer results in duplicate parentheses
  closes #440; thanks @gobreak
- bump to 2.4.0rc10

05/21/2019
- log the original URL for expired state cookies, useful for debugging SPA/JS issues

05/17/2019
- allow removing an access token from the cache ("remove_at_cache") when running in OAuth 2.0 RS mode only
- support refresh and access tokens revocation from an RFC 7009 endpoint upon OIDC session logout
- bump to 2.4.0rc9

05/03/2019
- fix (cached) parsing of OIDCOAuthServerMetadataURL; thanks Lance Fannin
- bump to 2.4.0rc5

05/02/2019
- correct caching for OIDCOAuthServerMetadataURL
- bump to 2.4.0rc4

04/21/2019
- remove option to skip scrubbing request headers (thus avoiding potentionally insecure setups)
- bump to 2.4.0rc3

04/19/2019
- add USE_URANDOM compile time option to use /dev/urandom explicitly for non-blocking random number generation
  configure with APXS2_OPTS="-DUSE_URANDOM"
- bump to 2.4.0rc2

04/15/2019
- add debug logs in oidc_proto_generate_random_string
- URL-encode client_id/client_secret when using client_secret_basic according to: https://tools.ietf.org/html/rfc6749#section-2.3.1
- bump to 2.4.0rc1

04/09/2019
- deprecate the OAuth 2.0 Resource Server functionality
- bump to 2.4.0rc0

03/13/2019
- release 2.3.11

02/26/2019
- add session expiry to session info hook response (and change inactivity timeout key)
- bump to 2.3.11rc2

02/25/2019
- add option to dynamically pass query parameters to the authorization request; closes #401
- bump to 2.3.11rc1

01/31/2019
- support conditional compilation of memcache support
- bump to 2.3.11rc0

01/22/2019
- fix XSS vulnerability CSNC-2019-001 wrt. poll parameter in OIDC Session Management RP iframe; thanks Mischa Bachmann
- release 2.3.10.2

01/16/2019
- fix bug in current URL detection where query parameters would be duplicated; see #420; thanks @jreynaert
- release 2.3.10.1

12/31/2018
- fix warning printout in oidc_delete_oldest_state_cookies
- release 2.3.10

12/16/2018
- fix encryption buffer tag length mismatch

12/06/2018
- retain the unparsed URL path in current/original URL determination, and thereby preserve
  and support URL-encoded characters in paths when redirecting back to the original URL
- add state to code exchange token requests only in multi-provider setups; see #402
- optionally delete the oldest state cookie(s); see #399
- bump to 2.3.10rc3

11/29/2018
- add support for refreshing an access token associated with an OIDC session using OIDCRefreshAccessTokenBeforeExpiry
- bump to 2.3.10rc0

11/15/2018
- release 2.3.9

11/13/2018
- fix parsing of cookie name in OIDCOAuthAcceptTokenAs when the cookie option is not listed last 
- bump to 2.3.9rc7

11/12/2018
- fix OAuth 2.0 RS config check when OIDCOAuthServerMetadataURL is set; thanks @psteniusubi
- bump to 2.3.9rc6

10/24/2018
- add support for draft https://www.ietf.org/id/draft-ietf-oauth-mtls-12.txt:
  OAuth 2.0 Mutual TLS Client Certificate Bound Access Tokens
  when running as an OAuth 2.0 RS, validating cnf["x5t#S256"] claims.
- bump to 2.3.9rc5

10/17/2018
- ignore/trim spaces in X-Forwarded-* headers
- deal with forwarding proxy setups; see #395 ; thanks @archzone
- bump to 2.3.9rc4

10/02/2018
- improve OIDC backchannel logout based on config/Discover
  - add OIDCProviderBackChannelLogoutSupported config primitive
  - parse/interpret `backchannel_logout_supported` in Discovery document
- add `id_token_token_binding_cnf`: `tbh` to dynamic client registration metadata
- bump to 2.3.9rc3

10/01/2018
- support backchannel logout according to: https://openid.net/specs/openid-connect-backchannel-1_0.html
- bump to 2.3.9rc2

10/01/2018
- add test-cmd command to generate hashes base64urlencoded inputs (cnf/tbh claims)

09/30/2018
- support Token Binding for Access Tokens according to: https://tools.ietf.org/html/draft-ietf-oauth-token-binding
- bump to 2.3.9rc1

09/16/2018
- support nested arrays in Require claim authorization evaluation; see #392; thanks @hpbieker
- bump to 2.3.9rc0

09/12/2018
- fix return result FALSE when JWT payload parsing fails; see #389; thanks @amdonov
- release 2.3.8

08/30/2018
- add LGTM code quality badges, see #385; thanks @xcorail
- fix 3 LGTM alerts

08/23/2018
- improve auto-detection of XMLHttpRequests via Accept header; see #331
- bump to 2.3.8rc5

08/15/2018
- initialize test_proto_authorization_request properly; see #382; thanks @jdennis
- add sanity check on provider->auth_request_method; closes #382; thanks @jdennis
- bump to 2.3.8rc4

08/14/2018
- allow usage with LibreSSL; closes #380; thanks @hihellobolke
- bump to 2.3.8rc3

08/04/2018
- don't return content with 503 since it will turn the HTTP status code into a 200; see #331
- bump to 2.3.8rc2

08/03/2018
- add option to set an upper limit to the number of concurrent state cookies via OIDCStateMaxNumberOfCookies; see #331
- make the default maximum number of parallel state cookies 7 instead of unlimited; see #331
- bump to 2.3.8rc1

07/30/2018
- fix using access token as endpoint auth method in introspection calls; closes #377; thanks @skauffmann

07/25/2018
- fix reading access_token form POST parameters when combined with `AuthType auth-openidc`; see #376; thanks Nicolas Salerno
- bump to 2.3.8rc0

07/06/2018
- abort when string length for remote user name substitution is larger than 255 characters
- release 2.3.7

07/04/2018
- fix Redis concurrency issue when used with multiple vhosts
- bump to 2.3.7rc4 and 2.3.7rc5

06/29/2018
- add support for authorization server metadata with OIDCOAuthServerMetadataURL as in RFC 8414
- bump to 2.3.7rc3

06/23/2018
- refactor session object creation
- bump to 2.3.7rc2

06/22/2018
- clear session cookie and contents if cache corruption is detected
- bump to 2.3.7rc0
- use apr_pstrdup when setting r->user
- reserve 255 characters in remote username substition instead of 50
- bump to 2.3.7rc1

06/15/2018
- add check to detect session cache corruption for server-based caches and cached static metadata
- release 2.3.6

05/29/2018
- avoid using pipelining for Redis
- bump to 2.3.6rc4

05/28/2018
- send Basic header in OAuth www-authenticate response if that's the only accepted method; thanks @puiterwijk

05/28/2018
- refactor Redis cache backend to solve issues on AUTH errors: a) memory leak and b) redisGetReply lagging behind
- adjust copyright year/org
- bump to 2.3.6rc3

05/23/2018
- fix buffer overflow in shm cache key set strcpy; thanks @kyprizel
- bump to 2.3.6rc2

05/22/2018
- turn missing session_state from warning into a debug statement
- fix missing "return" on error return from the OP; see #345; thanks @gergan
- bump to 2.3.6rc1

05/19/2018
- explicitly set encryption kid so we're compatible with cjose >= 0.6.0
- bump to 2.3.6rc0

05/18/2018
- fix encoding of preserved POST data; see #338; thanks @timpuri
- avoid buffer overflow in shm cache key construction; thanks @kyprizel
- release 2.3.5

05/08/2018
- compile with with Libressl; closes #358; thanks @hihellobolke
- bump to 2.3.5rc0

04/27/2018
- avoid crash when a relative logout URL parameter is passed in; thanks Vivien Delenne 
- release 2.3.4

03/22/2018
- interpret X-Forwarded-Host when doing XSRF protection on the after-logout URL; see #341; thanks @pepe79
- bump to 2.3.4rc4

02/06/2018
- add support for passing an access token in a HTTP Basic authentication password; thanks @puiterwijk
- bump to 2.3.4rc3

01/26/2018
- send session management Javascript logging to debug; thanks @kerrermanisNL

01/25/2018
- add Cache-Control no-cache header to authorization requests to avoid replays of state/nonce; see #321
- bump to 2.3.4rc2

01/23/2018
- add explicit endpoint authentication method "bearer_access_token"

12/29/2017
- correct documentation on kid usage for OIDCOAuthVerifyCertFiles; closes #318

12/21/2017
- fix compiler warnings for OpenSSL 1.1.x
- bump to 2.3.4rc1

11/21/2017
- fix bug where endpoint authentication method "private_key_jwt" would not co-exist with "none"
- bump to 2.3.4rc0

11/16/2017
- add support for passing userinfo as a JSON object or JWT; see #311
- release 2.3.3

11/13/2017
- add support for authentication to the introspection endpoint with a bearer token using OIDCOAuthIntrospectionClientAuthBearerToken; thanks @cristichiru
- bump to 2.3.3rc3

11/08/2017
- address a number of static code analysis issues
- bump to 2.3.3rc2

10/10/2017
- avoid crash when no scheme is set on OIDCProviderMetadataURL; closes #303; thanks @iconoeugen
- bump to 2.3.3rc1

10/6/2017
- avoid crash when no OIDCOAuthClientID is set for remote access token validation
- don't enforce "iat" slack checks on locally validaed JWT access tokens
- bump to 2.3.3rc0

09/18/2017
- release 2.3.2

09/11/2017
- fix "graceful" restart for shm/redis cache backends; see #296
- bump to 2.3.2rc8

09/05/2017
- optionally remove request object parameters from the authorization request URL with "copy_and_remove_from_request"; see #294
- bump to 2.3.2rc7

08/29/2017
- properly support JSON boolean values in metadata .conf files
- add regex substitution for *RemoteUserClaim; thanks @hihellobolke
- bump to 2.3.2rc6

08/27/2017
- add issuer specific redirect URI option ("issuer_specific_redirect_uri") for multi-provider setups to mitigate IDP mixup
- bump to 2.3.2rc5

08/20/2017
- fix public clients; add endpoint authentication method "none"
- bump to 2.3.2rc4

08/02/2017
- update experimental token binding support to https://tools.ietf.org/html/draft-ietf-tokbind-ttrp-01
  and use header names prefixed with "Sec-"; depends on mod_token_binding >= 0.3.4 now
- bump to 2.3.2rc3

08/01/2017
- don't abort when mutex operations fail
- printout textual descriptions of errors returned by mutex operations
- bump to 2.3.2rc2

07/28/2017
- fix issue with the combination of shared memory (shm) cache and using encryption (OIDCCacheEncrypt On)
  where the cache value would be corrupted after the first (successful) retrieval
- bump to 2.3.2rc1

07/27/2017
- support paths that are relative to the Apache root dir for:
  OIDCHTMLErrorTemplate, OIDCPublicKeyFiles, OIDCPrivateKeyFiles,
  OIDCOAuthVerifyCertFiles, OIDCClientTokenEndpointCert, OIDCClientTokenEndpointKey,
  OIDCOAuthIntrospectionEndpointCert and OIDCOAuthIntrospectionEndpointKey
- bump to 2.3.2rc0

07/19/2017
- handle multiple values in X-Forwarded-* headers as to better support chains of reverse proxies in front of mod_auth_openidc
- log request headers in oidc_util_hdr_in_get
- release 2.3.1

07/13/2017
- remove A128GCM/A192GCM from the supported algorithms in docs/auth_openidc.conf
  because cjose doesn't support A128GCM and A192GCM (yet)
- bump to 2.3.1rc5

07/09/2017
- refactor oidc_get_current_url_port so that it assumes the default port when
  X-Forwarded-Proto has been set; closes #282 and may address #278
- bump to 2.3.1rc4

07/07/2017
- use the defined name (`Provided-Token-Binding-ID`) for the provided token binding ID HTTP header
  see: https://tools.ietf.org/html/draft-campbell-tokbind-ttrp-00#section-2.1
  depends on mod_token_binding >= 0.3.0 now
- bump to 2.3.1rc3

06/29/2017
- support sending the authentication request via HTTP POST through HTML/Javascript autosubmit
- bump to 2.3.1rc2

06/28/2017
- support private_key_jwt and client_secret_jwt as client authentication methods for token introspection
- bump to 2.3.1rc1

06/22/2017
- fix bug where token_endpoint_auth set to private_key_jwt would fail to provide the credential if client_secret wasn't set
- bump to 2.3.1rc0

06/13/2017
- release 2.3.0

06/07/2017
- fix file cache backend: allow caching of non-filename friendly keys such as configuration URLs and JWKs URIs
- enable JQ-based claims expression matching when compiled from source with --with-jq=<dir>, e.g.:
  Require claims_expr '.aud == "ac_oic_client" and (.scope | index("profile") != null)'
- normalize cache backend logging
- bump to 2.3.0rc3

06/06/2017
- avoid cleaning our own state cookie twice when it is expired
- bump to 2.3.0rc2

06/02/2017
- refactor remote user handling so it allows for postfixing with the issuer value after applying the regex
- bump to 2.3.0rc1

05/31/2017
- add support for custom actions to take after authorization fails with OIDCUnAutzAction
  this enables stepup authentication scenarios when combined with the following:
- add OIDCPathAuthRequestParams that is configurable on a per-path basis and use OIDCAuthRequestParams for the static per-provider value
- add OIDCPathScope that is configurable on a per-path basis and concatenate with OIDCScope as static per-provider value
- support 3rd-party-init-SSO with additional authentication request params when a single static provider has been configured
- add support for an empty OIDCClaimPrefix; can be used with OIDCWhiteListedClaims to protect selected headers
- bump to 2.3.0rc0

05/30/2017
- support sending Authorization Request as "request" object in addition to "request_uri"; thanks @suttod
- support nested claim matching in Require directives; thanks @suttod
- support explicitly setting the "kid" of the private key in OIDCPrivateKeyFiles; thanks @suttod

05/25/2017
- fix cache fallback so it happens (when enabled) only after failure

05/19/2017
- make OIDCStripCookies work on AuthType oauth20 paths; closes #273; thanks Michele Danieli
- bump to 2.2.1rc6

05/18/2017
- fix parse function of OIDCRequestObject configuration option; thanks @suttod 

05/17/2017
- avoid crash when the X-Forwarded-Proto header is not correctly set by a reverse proxy in front of mod_auth_openidc

05/14/2017
- support JWT verification against multiple keys with no provided kid by looping over the provided keys with cjose 0.5.0
- remove OIDC RP certification files; moved to separate repository

05/04/2017
- improve documentation for OIDCCryptoPassphrase; closes #268

04/30/2017
- fix wrong return value for cache_file_set in the file cache backend (OIDCCacheType file); thanks Ernani Joppert Pontes Martins
- bump to 2.2.1rc5

04/29/2017
- correctly log success/failure in cache_file_set
- avoid decoding a JSON object and logging an error when the input is NULL
  e.g. when claims have not been resolved because userinfo endpoint is not set

04/20/2017
- support relative RedirectURIs; closes #200; thanks @moschlar
- don't assume that having OIDCCryptPassphrase set means we should validate the config for
  openid-connect since it can now also be used to encrypt (auth20) cache entries
- bump to 2.2.1rc4

04/08/2017
- fix potential crash on prefork process exit when used with Redis cache backend (3x)
- bump to 2.2.1rc3

04/06/2017
- change warn log about missing token binding ID to debug log

04/05/2017
- allow for high session inactivity timeout max value
- improve error message in oidc_util_http_send when ap_pass_brigade fails and mention possible interference with mod_deflate
- bump to 2.2.1rc0

03/30/2017
- merge feature branch back to master:
  - better support for Single Page Applications, see:
    https://github.com/zmartzone/mod_auth_openidc/wiki/Single-Page-Applications
    - add session info hook that is configurable through OIDCInfoHook
    - add "AuthType auth-openidc" option that allows both "oauth20" and "openid-connect" on the same path
  - add encryption for all cache entries instead of just session data through OIDCCacheEncrypt
  - add cookie SameSite flag/policy through OIDCCookieSameSite
  - return HTTP 200 on OPTIONS requests to (unauthenticated) "oauth20" paths
  - add fallback to a by-value session cookie if the primary session cache fails with OIDCSessionCacheFallbackToCookie
  - add support for black- and/or white-listing claims with OIDCBlackListedClaims and OIDCWhiteListedClaims
  - add prototype token binding support in conjunction with:
    https://github.com/zmartzone/mod_token_binding:
    - for state & session cookies, see:
      https://github.com/TokenBinding/Internet-Drafts
    - for ID tokens with OpenID Connect Token Bound Authentication support, see:
      http://openid.net/specs/openid-connect-token-bound-authentication-1_0.html
    - for Authorization Codes with OAuth 2.0 Token Binding for Authorization Codes, see:
       https://tools.ietf.org/html/draft-ietf-oauth-token-binding
  - refactoring:
    - refactor session state, proto state and headers into getters/setters functions
    - refactor PKCE support
  - fix removing session state from cache on logout
  - fix clearing chunked session cookies on logout; closes #246; thanks @Jharmuth
- release 2.2.0

02/20/2017
- security fix: scrub headers for "AuthType oauth20"
- release 2.1.6 

02/15/2017
- improve logging of session max duration and session inactivity timeout
- refactor so that the call to the refresh hook also resets the session inactivity timeout and passes tokens down

02/14/2017
- treat only "X-Requested-With: XMLHttpRequest" header as a non-browser client; closes #228 ; thanks @mguillem
- improve error message on state timeout; closes #226; thanks @security4java

02/09/2017
- correctly parse "kid" in OIDCPublicKeyFiles and OIDCOAuthVerifyCertFiles; thanks Alessandro Papacci
- bump to 2.1.6rc2

02/07/2017
- fix parsing of mandatory/optional attribute in OIDCOAuthTokenExpiryClaim; closes #225; thanks Alessandro Papacci
- bump to 2.1.6rc1

02/06/2017
- improve logging around the availability of session management; closes #223

02/02/2017
- interpret OIDCUnAuthAction also when the maximum session duration has been exceeded; see #220
- bump to 2.1.6rc0

01/30/2017
- security fix: scrub headers when `OIDCUnAuthAction pass` is used for an unauthenticated user
- release 2.1.5

01/29/2017
- fix error message about passing id_token with session type client-cookie; mentioned in #220
- bump to 2.1.5rc0

01/25/2017
- release 2.1.4

01/18/2017
- don't echo the query parameters on the error page when an invalid request is made to the Redirect URI; closes #212; thanks @LukasReschke

01/14/2017
- use dynamic memory buffer for writing HTTP call responses; solves curl/mpm-event interference; see #207
- bump to 2.1.4rc1

01/10/2017
- don't crash when data is POST-ed to the redirect URL, it has just 1 POST parameter and it is not "response_mode"

01/2/2017
- remove trailing linebreaks from input in test-cmd tool
- bump copyright year to 2017

12/14/2016
- support Libre SSL, see #205, thanks @AliceWonderMiscreations
- update OIDC logout support to Front-Channel Logout 1.0 draft 01: http://openid.net/specs/openid-connect-frontchannel-1_0.html
- bump to 2.1.4rc0

12/13/2016
- release 2.1.3

12/12/2016
- don't rollover session id's and keep the same session cookie name for cache storage over session updates
- bump to 2.1.3rc0

11/19/2016
- release 2.1.2

11/18/2016
- fix crash when searching for keys with a kid, there's no initial match and x5t values exist for the non-matching keys; closes #196

11/9/2016
- remove stale claims from session when refreshing them from the userinfo endpoint fails; addresses #194
- release 2.1.1

11/8/2016
- log readable error messages when memcache operations fail

11/6/2016
- fix memory leak when skipping jwks_uri keys with a non-matching "use" value

11/4/2016
- always restore id_token/claims on sub-requests so e.g. listing claims-protected subdirectories will work
- remove obsolete functions for storing the session in the request state
- bump to 2.1.1rc0

11/3/2016
- remove obsolete sessions from session cache; thanks @stevedave

11/1/2016
- release version 2.1.0

10/28/2016
- don't include encryption keys from the jwks_uri when verifying a JWT and no kid has been specified
- fix memory leaks in composite claim handling

10/27/2016
- handle aggregated and distributed claims from the userinfo endpoint
- only pick private_key_jwt token endpoint authentication if a private key is configured; closes #189
- bump to 2.0.1rc7

10/24/2016
- add OpenID Connect RP certification test script
- handle non-integer exp/iat timestamps; closes #187; thanks @drdivano

10/21/2016
- bugfix: first truncate files before writing them
- support refreshing provider metadata based on timestamp and OIDCProviderMetadataRefreshInterval

10/20/2016
- bugfix: correctly truncate encryption keys derived from client secret for algorithms that require a key size < 256 bits
- add test/test-cmd tool
- bugfix: return error on session cache failures; closes #185; thanks @solsson
- bump to 2.0.1rc6

10/18/2016
- bugfix: JWTs with a header that doesn't specify a `kid` that would not validate when used with more than 1 key; closes #184; thanks @solsson
- bump to 2.0.1rc5

10/13/2016
- urlencode provider URL cache key to fix file cache backend issue; closes #179, thanks @djahandarie

10/9/2016
- fix null pointer segfault in debug printout in oidc_util_read_form_encoded_params
- fix OIDCOAuthAcceptTokenAs parsing flaw introduced in 2.0.0rc5
- bump to 2.0.1rc4

10/2/2016
- support presenting the access token to the userinfo endpoint in a POST parameter
- bump to 2.0.1rc3

9/30/2016
- support WebFinger Discovery with URL-style user identifiers

9/28/2016
- fix memory leak in oidc_jwk_to_json
- add "remove_at_cache" hook; addresses #177
- bump to 2.0.1rc2

9/27/2016
- add support for Request URI with signed and/or encrypted Request Objects
- bump to 2.0.1rc1

9/22/2016
- refuse webfinger responses with an href value that is not on secure https
- add userinfo JWT response verification and decryption

9/20/2016
- log the JWT header before optional decryption is applied

9/19/2016
- check that a sub claim returned from the userinfo endpoint matches the one in the id_token
- fix issue in oidc_metadata_parse_url so that static default would not be honored
  - this only affected server-wide OIDCClientJwksUri usage in dynamic client registration
- non-functional changes for OIDC RP certification:
  - explicitly log the client authentication method when calling the token endpoint
  - log the keys that are included for token verification
- bump to 2.0.1rc0

9/9/2016
- fix overriding provider token endpoint auth with static config when not set in .conf file
- don't add our own cookies to the incoming headers
- allow stripping cookies from the Cookie header sent to the application/backend with OIDCStripCookies
- release 2.0.0

9/5/2016
- encapsulate (sub-)directory config handling and fix merging so values can be set back to default values in subdirs
- bump to 2.0.0rc5

9/2/2016
- fix JWK creation when no client secret is set e.g. in Implicit flows; closes #168; thanks @asc1
- bump to 2.0.0rc4

9/1/2016
- fix HTML decoding of OIDCPreservePost data; closes #165
- limit max POST data size to 1Mb
- allow chunked data in POST handling; revise handler
- change preserve POST JSON data format to urlencoded for performance reasons

8/31/2016
- allow setting the token endpoint authentication method in the .conf file (for dynamic client registration that sets the .client)

8/30/2016
- pass refresh token in header/environment variable with OIDCPassRefreshToken; thanks Amit Joshi
- fix front-channel img-style logout with newer versions of PingFederate that don't send an Accept: image/png header

8/29/2016
- preserve POST data across authentication requests and discovery with OIDCPreservePost
- bump to 2.0.0rc3

8/24/2016
- fix parsing of OIDCOAuthAcceptTokenAs to accept options following ":"
- bump to 2.0.0rc2

8/5/2016
- delete the debian directory
- rename OIDCOAuthTokenEndpointCert/Key to OIDCOAuthIntrospectionEndpointCert/Key
- pre-release 2.0.0rc1

7/30/2016
- encrypt state/session JWT cookies and session JWT cache values for non-shm storages

7/29/2016
- use cjose - https://github.com/cisco/cjose (master) - for JOSE functions
- use stricter input parsing functions for configuration values
- bump to 2.0.0rc0

7/21/2016
- support TLS client authentication to token and introspection endpoints
- bump to 1.9.0rc3

7/19/2016
- add support for chunked session cookies; closes #153; thanks @glatzert 
- bump to 1.9.0rc2

7/9/2016
- fix Elliptic Curve signature verification for corrupted input
- support OpenSSL 1.1.x
- bump to 1.9.0rc1

7/5/2016
- use AUTHZ_DENIED instead of HTTP_UNAUTHORIZED in oidc_authz_checker; closes #151; thanks @gwollman
- use signed JWTs for state/session cookies
- achieve smaller client-cookie sizes for regular cases; no id_token is stored in the session:
  - (optional) id_token_hint no longer available in session management calls (logout/prompt=none) with "OIDCSessionType client-cookie"
  - "OIDCPassIDTokenAs serialized" is not available with "OIDCSessionType client-cookie"
- bump to 1.9.0rc0

6/27/2016
- use EVP_CIPHER_CTX_new to avoid compilation errors with OpenSSL 1.1.0
- release 1.8.10

6/22/2016
- don't use local port setting for current URL determination when X-Forwarded-Host has been set
- bump to 1.8.10rc4

6/20/2016
- fix memory leak in OAuth access token introspection result caching (introduced only in 1.8.10rc0)
- fix setting private_key_jwt or client_secret_jwt with OIDCProviderTokenEndpointAuth
- bump to 1.8.10rc3

6/19/2016
- allow setting OIDCRemoteUserClaim with values obtained from the userinfo endpoint; thanks @steve-dave
- fix OIDCUnAuthAction pass mode for Apache 2.4 and in case `Require claim` primitives used for 2.4 and 2.2; thanks @steve-dave
- bump to 1.8.10rc2

6/15/2016
- add support for JWT based client authentication to the token endpoint (client_secret_jwt, private_key_jwt)
- bump to 1.8.10rc1

6/9/2016
- add per-path configurable token introspection result cache expiry with OIDCOAuthTokenIntrospectionInterval
- bump to 1.8.10rc0

6/5/2016
- release 1.8.9

5/9/2016
- support 410 option on OIDCUnAuthAction; closes #141
- bump to 1.8.9rc6

5/1/2016
- avoid segmentation fault on invalid OIDC configuration when OIDCRedirectURI is not set; fixes #138; thanks @brianwcook
- bump to 1.8.9rc5

4/18/2016
- fix get_current_url (proxy) case where r->parsed_uri.path would be null

4/13/2016
- improve X-Forwarded-Host handling over Host in a) port detection and b) remove port from host value
- bump to 1.8.9rc4

4/10/2016
- do not require OIDCClientSecret in configs; allows for Implicit grant without setting a dummy client secret; closes #130
- allow for public clients calling the token endpoint
- bump to 1.8.9rc3

4/9/2016
- ensure that claims from id_token are available for authz also when OIDCPassIDTokenAs does not contain "claims"; closes #129
- bump to 1.8.9rc2

4/3/2016
- return WWW-Authenticate header and error messages on OAuth paths where access is not granted; closes #124; thanks @spinto
- bump to 1.8.9rc1

4/1/2016
- apr_jwe_decrypt_content_aesgcm() null terminate string, #128, thanks @jdennis
- bump to 1.8.9rc0

3/10/2016
- release 1.8.8

3/7/2016
- issue a warning if the "openid" scope is not requested

3/6/2016
- sanitize the OIDCAuthNHeader value before setting the header; thanks @rfk
- bump to 1.8.8rc7

3/5/2016
- log exact version of OpenSSL and EC/GCM/Redis support
- tidy up auth_openidc.conf docs
- bump to 1.8.8rc6

2/26/2016
- add option to refresh claims from the userinfo endpoint using OIDCUserInfoRefreshInterval; see #119
- merge id_token claims in to the set of claims used for authorization for Apache >=2.4; see #120
- bump to 1.8.8rc5

2/23/2016
- make state cookie a session cookie and clean expired cookies on entry (merge of fix-firefox-cookie-storage)
- fix HTML error template initialization in vhosts
- bump to 1.8.8rc4

2/22/2016
- don't authenticate (redirect/state) when X-Requested-With header exists; as suggested in #113
- bump to 1.8.8rc3

2/18/2016
- pass plain state to the token endpoint on code flows: https://tools.ietf.org/html/draft-jones-oauth-mix-up-mitigation-01
- fix loose (prefix-only) matching of cookie names
- allow passing OAuth bearer token as a cookie (OIDCOAuthAcceptTokenAs extension for PingAccess)
- bump to 1.8.8rc2

2/11/2016
- include token_endpoint_auth_method in dynamic client registration request, set to selected method from provider

2/10/2016
- Elliptic Curve support now requires OpenSSL 1.0.1 detection
- bump to 1.8.8rc1

1/14/2016
- add support for passing in OAuth bearer tokens as one or more of: header, post param or query param (OIDCOAuthAcceptTokenAs)
- bump to 1.8.8rc0

1/8/2016
- release 1.8.7

1/7/2016
- update copyright year

12/17/2015
- enforce strict matching of issuer in Discovery document against the originally requested issuer
- check iss/client_id if present in an authentication response
- push a hash of state to the token endpoint on code flows
- bump to 1.8.7rc4

12/9/2015
- improve debug logging around session management capabilities (i.e. enabled/disabled)
- return 404 for op/rp iframes if session management is not enabled
- bump to 1.8.7rc3

12/4/2015
- add support for RFC 7636 PKCE plain & S256 https://tools.ietf.org/html/rfc7636
- bump to 1.8.7rc2

12/3/2015
- fix crash when using a custom error template and the error description is NULL
- fix crash when target_link_uri is not a valid URI or parts are empty
- fix memory corruption when using custom html template across different server requests; closes #106
- bump to 1.8.7rc1

11/18/2015
- fix compiler warning on double sizeof call; close #103; thanks to @dcb314
- bump to 1.8.7rc0

10/26/2015
- add option to make session cookie persistent; closes #97
- release 1.8.6

10/19/2015
- add support for applying a custom HTML error template with OIDCHTMLErrorTemplate
- bump to 1.8.6rc3

10/12/2015
- check the cookie domain that the session was created for against the configured domain
- log a warning if the Set-Cookie value length is greater than 4093 bytes
- include and prioritize the X-Forwarded-Host header in hostname determination
- allow for missing Host header i.e. HTTP 1.0
- return DONE instead of HTTP_UNAUTHORIZED with Discovery page (prevent double HTML in HTTP 1.0)
- use apr_strnatcmp instead of strcmp in util.c and mod_auth_openidc.c
- bump to 1.8.6rc2

10/9/2015
- support subdomain cookies in OIDCCookieDomain checks; PR #96, thanks @pfiled
- bump to 1.8.6rc1

10/6/2015
- add key identifier ("kid") option to `OIDCOAuthVerifySharedKeys`, `OIDCOAuthVerifyCertFiles` and `OIDCPublicKeyFiles` configs
- bump to 1.8.6rc0

9/21/2015
- support (non-sid-based) HTTP logout: http://openid.net/specs/openid-connect-logout-1_0.html
- release 1.8.5

9/16/2015
- improve logging on provider/client/conf metadata parsing failures; closes #94
- bump to 1.8.5rc7

9/9/2015
- fix parsing of OIDCOAuthTokenExpiryClaim, thanks to @bester #90
- bump to 1.8.5rc6

9/4/2015
- add CSRF protection to external Discovery as well
- allow browser back after authorization response, see #89
- handle invalid (expired) authorization response state by sending the user to OIDCDefaultURL, see #86
- bump to 1.8.5rc5

8/26/2015
- add CSRF protection to Discovery
- bump to 1.8.5rc4

8/19/2015
- support encrypted JWTs using A192KW for key encryption and A192CBC-HS384 for content encryption
- bump to 1.8.5rc3

8/15/2015
- support encrypted JWTs using RSA-OAEP for key encryption and A128GCM,A192GCM,A256GCM for content encryption
- bump to 1.8.5rc2

8/4/2015
- support for OIDCUnAuthAction: how to act on unauthenticated requests (OIDCReturn401 is deprecated)
- bump to 1.8.5rc1

7/15/2015
- add authentication option for Redis server with OIDCRedisCachePassword
- bump to 1.8.5rc0

7/3/2015
- allow for compilation on Windows using VS 2013
- bump to 1.8.4

6/30/2015
- improve memcache logging: don't report cache misses as an error, thanks to @scottdear
- work around JSON timestamp print modifier issue (%lld) on some platforms, thanks to @ralphvanetten
- bump to 1.8.4rc3

6/24/2015
- support passing claims as environment variables (OIDCPassClaimsAs)
- bump to 1.8.4rc1

6/22/2015
- correct debug printout in oidc_util_read_form_encoded_params

6/20/2015
- avoid double free of JWT after parsing errors have been encountered
- bump to 1.8.4rc0

6/19/2015
- make public keys for encrypted access tokens available in OAuth-only configurations; fixes #74
- remove exceptions for accounts.google.com since Google is OpenID Connect compliant now
- release 1.8.3

6/15/2015
- add a complete JWT sample that includes validation of "exp" and "iat" to the test suite

6/10/2015
- allow JSON string values for the "active" claim in access token validation responses
- bump to 1.8.3rc4

6/7/2015
- improve error logging on non-supported JWT signing/encryption algorithms
- bump to 1.8.3rc3

5/31/2015
- merge id_token ("iss"!) and user info claims for authz processing
- bump to 1.8.3rc2

5/29/2015
- fix hash comparison when padded, thanks to @steverc as mentioned in #65
- fix post-logout URL being set to SSO URL
- add post-logout URL validation, thanks to @davidbernick
- bump to 1.8.3rc1

5/18/2015
- fix OpenSSL version detection for Elliptic Curve support in apr_jwt_signature_to_jwk_type: include opensslv.h
- fix hash length calculation for Elliptic Curve algorithms
- release 1.8.2

5/5/2015
- release 1.8.1

4/21/2015
- allow setting OIDCDiscoverURL inside of Directory and Location directives as well
- bump to 1.8.1rc5

4/20/2015
- allow setting OIDCCookie outside of Directory and Location directives as well
- bump to 1.8.1rc4

4/17/2015
- add support for applying regular expressions to OIDCRemoteUserClaim and OIDCOAuthRemoteUserClaim
- bump to 1.8.1rc3

4/12/2015
- make token expiry parsing of introspection result configurable (OIDCOAuthTokenExpiryClaim)
- increase SHM cache key size from 255 to 512 (allows for JWT access tokens cache keys for introspection result)
- bump to 1.8.1rc2

4/1/2015
- avoid timing attacks on symmetric key signature/hash comparisons as pointed out by @timmclean
- bump to 1.8.1rc1

3/19/2015
- merge #57: fix build with OpenSSL <1.0 re. apr_jws_signature_is_ec (thanks to @szakharchenko)

2/26/2015
- release 1.8.0

2/23/2015
- avoid including line feeds in header values (thanks to @forkbomber and @ekanthi)
- bump to 1.8.0rc5

2/16/2015
- fix free() crash on simple-valued error printouts
- fix returning keys without a "kid"
- fix searching for keys with a "x5t" thumbprint
- refactor response type handling; more strict matching of requested response type
- make compiled in Redis support optional
- fix oauth.introspection_endpoint_method in initialization
- bump to 1.8.0rc4

2/15/2015
- add support for configurable introspection HTTP method (OIDCOAuthIntrospectionEndpointMethod)
- add preliminary support for GET-style logout
- bump to 1.8.0rc2

2/12/2015
- add support for configuration of maximum session duration
- bump to 1.8.0rc1

2/9/2015
- check JWT signature against all configured keys (jwks_uri) if no "kid" is provided, not just the first one
- revise JOSE JWS handling part 2
- complete support for local JWT access token validation
- bump to 1.8.0rc0

2/5/2015
- fix symmetric key decryption of JWTs (A128CBC-HS256/A256CBC-HS512)
- sha256 client secrets before using them as symmetric keys for decryption
- extended decryption test coverage; avoid double printouts on error
- refactor JWT header parsing
- simplify JWK URI refresh handling
- release 1.7.3

2/4/2015
- revise JOSE JWK handling part 1
- change change target_uri parameter name to target_link_uri following draft-bradley-oauth-jwt-encoded-state-03
- extended tests with stubs
- refactor JWT validation (iss, exp, iat)
- fix memory leak with RSA key conversion in apr_jwk.c - apr_jwk_rsa_bio_to_key
- bump to 1.7.3rc4

1/25/2015
- Allow {... "error": null ...} in JSON responses. (@fatlotus)

1/22/2015
- fix configuration validation check where no config would be checked if OIDCProviderIssuer is set
  but both OIDRedirectURI and OIDCCryptoPassphrase are not set
- add preliminary support for local JWT access token validation
- bump to 1.7.3rc1
- sanitize set cookie syntax (get rid of extraneous ";")

1/21/2015
- add support for OIDCOAuthIntrospectionTokenParamName (incl. Google OAuth 2.0 access token validation)
- add a sample OAuth 2.0 config for Google access tokens to README.md
- release 1.7.2

- add APXS2_OPTS to configure.ac to accommodate RPM builds
- bump to 1.7.3rc0
- fix JWT timestamp (iat/exp) initialization issue
- fix README.md on Google's scope required for returning the "hd" claim

1/14/2015
- add Apache function stubs to enable extending the scope of tests
- add tests for oidc_proto_validate_access_token and oidc_proto_validate_code
- bump to 1.7.2rc3

1/12/2015
- improve accuracy of expired/invalid session handling

1/11/2015
- add error type and return values to JOSE functions
- fix return result on error in function that decrypts CEK
- bump to 1.7.2rc2

1/1/2015
- update copyright to 2015
- use json_int_t (seconds) for "exp" and "iat" fields, instead of apr_time_t (microseconds) 
- correct expiry debug printout
- bump to 1.7.2rc1

12/15/2014
- fix Redis reconnect behavior: avoid keep reconnecting after first failure
- bump to 1.7.2rc0

12/12/2014
- support passing cookies specified in OIDCPassCookies from browser on to OP/AS calls (for loadbalancing purposes)
- release 1.7.1
- document OIDCPassCookies in auth_openidc.conf

12/10/2014
- reconnect to the Redis server after I/O failure as raised in #43
- bump to 1.7.1rc4

12/8/2014
- return http 500 when detecting requests that will loop on return
- bump to 1.7.1rc3

12/3/2014
- require the expiring access_token on the refresh hook for XSRF protection
- pass error codes back to the caller when the refresh hook fails
- bump to 1.7.1rc2

12/2/2014
- improve handling of non-string (=non-compliant) error responses

11/26/2014
- make shared memory cache entry max size configurable through OIDCCacheShmEntrySizeMax
- add OIDCReturn401 configuration primitive
- bump to 1.7.1rc1

11/11/2014
- allow OIDCRedirectURI's with an empty path and fix crash; thanks to @CedricCabessa

11/9/2014
- support for adding configurable JSON parameters to Dynamic Client Registration requests

11/5/2014
- release 1.7.0

10/30/2014
- correct expires_in conversion
- first stab at HTML templating and make all html HTML 4.01 Strict compliant
- bump to 1.7.0rc4

10/29/2014
- document refresh flow

10/28/2014
- scrub all OIDC_ headers
- add support for the refresh_token flow + hook
- pass the expires_in as an absolute timestamp in OIDC_access_token_expires
- use a global mutex for the Redis cache
- bump to 1.7.0rc3

10/27/2014
- generalize support for OAuth 2.0 token introspection and conform to:
  https://tools.ietf.org/html/draft-ietf-oauth-introspection-00

10/26/2014
- support regular expressions in Require statements

10/24/2014
- add support for Redis cache backend; there's a dependency on hiredis headers/library now

10/21/2014
- refactor nonce generation and remove base64url padding from value

10/13/2014
- add libssl-dev to Debian control build dependencies
- release 1.6.0

10/6/2014
- apply html encoding to error display
- bump version number to 1.6.0rc4

10/2/2014
- avoid crash when downloading metadata from OIDCProviderMetadataURL fails
- set OIDCProviderMetadataURL retrieval interval to 24 hours
- return error on configurations mixing OIDCProviderMetadataURL and OIDCMetadataDir
- bump version number to 1.6.0rc3

10/1/2014
- support provider configuration from a metadata URL (OIDCProviderMetadataURL)
- bump version number to 1.6.0rc2

9/30/2014
- be less strict about issuer validation in metadata
- refactor metadata.c
- improve logging about userinfo endpoint

9/29/2014
- refactor cache so it is partitioned in to sections (i.e. avoid future key collisions)

9/25/2014
- add support for "x5c" JWK representation
- return JWKS on jwks_uri with content-type "application/json"

9/17/2014
- remove support for the X-Frame-Options as it is not needed in 302s
- create and use log macros that printout function name

9/16/2014
- support for passing runtime determined authentication request parameters in the discovery response
- include name/version in logs and bump to 1.6.0rc1
- don't use the X-Frame-Options by default

9/13/2014
- add support for the X-Frame-Options header as recommended by the spec

9/12/2014
- set expiry on state cookies; don't clear session cookie after cache miss or corruption
- fix JSON array memory leak in oauth.c

9/10/2014
- merge #34 (g10f), fix session management Javascript bug

9/3/2014
- improve error handling on hitting the redirect URI directly
- fix set_slot functions for algorithm/url used as default for dynamic registration
- rewording of auth_openidc.conf docs on JWK settings

9/1/2014
- add session management based on http://openid.net/specs/openid-connect-session-1_0.html (draft 21)

8/29/2014
- add configuration option to POST extra parameters to the token endpoint

8/26/2014
- correct cookie_path comparison
- release 1.5.5

8/20/2014
- correctly error out on flows where no id_token was provided ("token")

8/19/2014
- fix debug printout on open redirect prevention
- cleanup in-memory crypto context on shutdown
- use default of "/" for OIDCCookiePath to simplify quickstart/simple deployments
- disable OIDCMetadataDir in sample/default config file
- clear session cookie after cache miss or corruption

8/18/2014
- add HttpOnly flag to cookies by default; can be disabled by config

8/14/2014
- support for passing the id_token in multiple formats (claims|payload|serialized)
- release 1.5.4

8/13/2014
- pass the access_token in OIDC_access_token header to the application

8/9/2014
- merge #21 (Latinovic) to close #18 (big endian JWE issue)
- merge #20 (wadahiro), support for "none" JWT signing algorithm

8/1/2014
- fix cache initialization/destroy leak
- release 1.5.3

7/26/2014
- refactor http code; cleanup JSON encoding in client registration
- refactor padding handling in base64url encoding/decoding

7/20/2014
- check for open redirect on passed target_link_uri
- prevent JWE timing attacks on CEK; add JWE test
- include client_id and scope values in resolved access_token

7/1/2014
- pass JSON objects in app HTTP headers as plain JSON
- correct printout in id_token hash comparisons
- add more tests
- release 1.5.2

6/12/2014
- support third-party-initiated login as defined in the spec
- release 1.5.1
- fix PF OAuth 2.0 RS functionality after upgrading to jansson

6/6/2014
- more changes for Debian packaging (1.5-3)

6/5/2014
- do not set Secure cookies for plain HTTP
- add warning/errors when configured hosts/domains do not match
- release 1.5
- changes for Debian packaging

6/4/2014
- fix passing integer claims on non-Mac OS X systems
- fix claims-based authorization with integer values (@martinsrom)
- fix getting the id_token from request state and error logging
- add AUTHORS file with credits
- migrate README to Markdown README.md

6/3/2014
- change JSON parser from https://github.com/moriyoshi/apr-json to http://www.digip.org/jansson/

6/2/2014
- handle X-Forwarded-Proto/X-Forwarded-Port when running behind a proxy/load-balancer
- release version 1.4

6/1/2014
- compile with OpenSSL <1.0 and but then disable Elliptic Curve verification
- fix jwks_uri setting in nested vhosts
- use OpenSSL_add_all_digests in initialization and EVP_cleanup on shutdown

5/31/2014
- README additions/improvements

5/29/2014
- correct big endian detection
- allow for key identification in JWKs based on thumbprint (x5t)

5/24/2014
- add cache destroy function and destroy shm cache resources on shutdown

5/23/2014
- doc corrections to auth_openidc.conf

5/22/2014
- add implementation of OP-initiated-SSO based on:
  http://tools.ietf.org/html/draft-bradley-oauth-jwt-encoded-state-01
- fix nonce caching for replay prevention

5/21/2014
- correct README on enabling Google+ APIs before applying the sample Google configs
- fix AuthNHeader setting and allow server-wide config too
- avoid segfault on corrupted/non- JSON/JWT input

5/20/2014
- fix URL assembly when running on non-standard port
- release 1.3

5/17/2014
- support outgoing proxy using OIDCOutgoingProxy
- correct sample configs in documentation for missing OIDCCookiePath
- support OIDCCookiePath in server-wide config as well

5/13/2014
- support configurable (custom) query parameters in the authorization request

5/12/2014
- support encrypted JWTs using A128KW and A256KW for the Content Encryption Key
- support A256CBC-HS512 encrypted JWTs
- support custom client JWKs URI

5/8/2014
- support encrypted JWTs using RSA1_5 and A128CBC-HS256

5/2/2014
- do not use ap_get_remote_host for browser fingerprinting

5/1/2014
- split out custom client config into separate <issuer>.conf file
- allow to override client_contact, client_name and registration_token in .conf file
- remove OIDCRegistrationToken command for the static OP config

4/29/2014
- support JWT verification of ES256, ES384 and ES512 algorithms

4/28/2014
- support configurable response_mode (fragment, query or form_post)
- use nonce in all flows except for OP Google and flows "code" or "code token"

4/26/2014
- make client secret optional (support self-issued OP)

4/25/2014
- support Hybrid flows

4/24/2014
- fix using Bearer token Authorization header on JSON POST calls
- support using a Bearer token on client registration calls

4/22/2014
- match request and response type 
- check at_hash value on "token id_token" implicit flow
- use shared memory caching by default
- release 1.2

4/19/2014
- store response_type in state and make state a JSON object

4/18/2014
- support RSASSA-PSS token signing algorithms (PS256,PS384,PS512)

4/17/2014
- improve session inactivity timeout handling

4/16/2014
- set REMOTE_USER and HTTP headers on OAuth 2.0 protected paths

4/15/2014
- add session inactivity timeout
- register all supported response_types during client registration and try
  to pick the one that matches the configured default
- use long timeouts on JWK retrieval calls
- allow for non-null but empty query parameters on implicit authorization response
- simplify azp/aud and nonce handling
- change session_type naming (to "server-cache"/"client-cookie")

4/14/2014
- factor out JOSE related code

4/3/2014
- add configurable claim name for the REMOTE_USER variable, optionally postfixed with the  url-encoded
  issuer value; the default for the remote username is "sub@" now, makeing it unique across OPs
- some refactoring of id_token validation functions
- add INSTALL, move auth_openidc.conf to main directory
- release 1.1

3/28/2014
- fix Require claim name mismatch for Apache 2.4
- fix hmac method/printout naming artifacts from earlier
auto-search-and-replace
- release v1.0.1

3/27/2014
- initial import named mod_auth_openidc
- updated README
- fix debian/changelog
