Changelog

3.11.3

• Feature/improvement: Added configurable issuer setting for JWT validation.

3.11.2

• Improvement: Support identity providers that omit algorithm parameter in JWKS (Microsoft Entra ID).

3.11.1

• Fix bug created in 3.11.0 release when comparing issuer to derived expected value.

3.11.0

SECURITY RELEASE

• Security: Added JWT signature verification using JWKS to prevent token forgery
• Security: Enhanced token claim validation (exp, aud, iss, iat, nonce)
• Security: Replaced weak state generation with cryptographically secure random_bytes()
• Security: Fixed open redirect vulnerability in authentication flow
• Security: Restricted SSL verification bypass to local development environments only
• Security: Added nonce protection to debug mode to prevent information disclosure
• Security: Added SSRF protection by default through use of wp_safe_remote_* functions
• Feature: Added JWKS endpoint configuration setting
• Feature: Added OpenID Connect discovery document support
• Feature: Added customizable login button text setting
• Improvement: Migrated to Composer-managed dependencies
• Fix: Corrected issuer validation to properly extract base URL from endpoints
• Fix: Identity token timestamp tracking

3.10.4

• Fix issue with finding users on multisite after switch to user options in place of user meta.
• Improvement: Retry logins for some IDP errors to bypass issue with Safari ITP. Also improves display of error messages that come from the IDP.

3.10.3

• Fix issue with log corruption causing fatal error.
• Fix: Fallback to a POST request for userinfo when GET fails.
• Fix: Improves multisite compatibility by switching to *_user_options() functions.
• Fix: Fix for WordPress user session length being very short when refresh tokens are enabled.

3.10.2

• Fix: @socialmedialabs – Regression affecting SSO Auto Login with url handling improvement changes.

3.10.1

• Chore: @daggerhart – Readme updates and clarifications.
• Chore: @daggerhart – Release workflow updates.
• Improved error handling for malformed urls.
• Fix: @JUVOJustin – Change request for userinfo to GET.
• Feature: @JUVOJustin – New filter for settings values openid-connect-generic-settings.
• Feature: @JUVOJustin – New filter for state values openid-connect-generic-new-state-value.

3.10.0

• Chore: @timnolte – Dependency updates.
• Fix: @drzraf – Prevents running the auth url filter twice.
• Fix: @timnolte – Updates the log cleanup handling to properly retain the configured number of log entries.
• Fix: @timnolte – Updates the log display output to reflect the log retention policy.
• Chore: @timnolte – Adds Unit Testing & New Local Development Environment.
• Feature: @timnolte – Updates logging to allow for tracking processing time.
• Feature: @menno-ll – Adds a remember me feature via a new filter.
• Improvement: @menno-ll – Updates WP Cookie Expiration to Same as Session Length.

3.9.1

• Improvement: @timnolte – Refactors Composer setup and GitHub Actions.
• Improvement: @timnolte – Bumps WordPress tested version compatibility.

3.9.0

• Feature: @matchaxnb – Added support for additional configuration constants.
• Feature: @schanzen – Added support for agregated claims.
• Fix: @rkcreation – Fixed access token not updating user metadata after login.
• Fix: @danc1248 – Fixed user creation issue on Multisite Networks.
• Feature: @RobjS – Added plugin singleton to support for more developer customization.
• Feature: @jkouris – Added action hook to allow custom handling of session expiration.
• Fix: @tommcc – Fixed admin CSS loading only on the plugin settings screen.
• Feature: @rkcreation – Added method to refresh the user claim.
• Feature: @Glowsome – Added acr_values support & verification checks that it when defined in options is honored.
• Fix: @timnolte – Fixed regression which caused improper fallback on missing claims.
• Fix: @slykar – Fixed missing query string handling in redirect URL.
• Fix: @timnolte – Fixed issue with some user linking and user creation handling.
• Improvement: @timnolte – Fixed plugin settings typos and screen formatting.
• Security: @timnolte – Updated build tooling security vulnerabilities.
• Improvement: @timnolte – Changed build tooling scripts.

3.8.5

• Fix: @timnolte – Fixed missing URL request validation before use & ensure proper current page URL is setup for Redirect Back.
• Fix: @timnolte – Fixed Redirect URL Logic to Handle Sub-directory Installs.
• Fix: @timnolte – Fixed issue with redirecting user back when the openid_connect_generic_auth_url shortcode is used.

3.8.4

• Fix: @timnolte – Fixed invalid State object access for redirection handling.
• Improvement: @timnolte – Fixed local wp-env Docker development environment.
• Improvement: @timnolte – Fixed Composer scripts for linting and static analysis.

3.8.3

• Fix: @timnolte – Fixed problems with proper redirect handling.
• Improvement: @timnolte – Changes redirect handling to use State instead of cookies.
• Improvement: @timnolte – Refactored additional code to meet coding standards.

3.8.2

• Fix: @timnolte – Fixed reported XSS vulnerability on WordPress login screen.

3.8.1

• Fix: @timnolte – Prevent SSO redirect on password protected posts.
• Fix: @timnolte – CI/CD build issues.
• Fix: @timnolte – Invalid redirect handling on logout for Auto Login setting.

3.8.0

• Feature: @timnolte – Ability to use 6 new constants for setting client configuration instead of storing in the DB.
• Improvement: @timnolte – Plugin development & contribution updates.
• Improvement: @timnolte – Refactored to meet WordPress coding standards.
• Improvement: @timnolte – Refactored to provide localization.

See the previous changelogs here