oauth2-mock-server

# Changelog All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/). ## [8.1.0](https://github.com/axa-group/oauth2-mock-server/compare/v8.0.1...v8.1.0) — 2025-06-06 ### Added - Export `HttpServer` and `OAuth2Service` (reported in [#344](https://github.com/axa-group/oauth2-mock-server/issues/344) by [jraoult](https://github.com/jraoult)) ### Changed - Update dependencies ## [8.0.1](https://github.com/axa-group/oauth2-mock-server/compare/v8.0.0...v8.0.1) — 2025-05-28 ### Fixed - Fix crash when running `npx oauth2-mock-server --help` (reported in [#337](https://github.com/axa-group/oauth2-mock-server/issues/337) by [robcresswell](https://github.com/robcresswell)) ## [8.0.0](https://github.com/axa-group/oauth2-mock-server/compare/v7.2.1...v8.0.0) — 2025-05-18 ### Fixed - Fix wrong typescript annotation (by [sviande](https://github.com/sviande) in [#313](https://github.com/axa-group/oauth2-mock-server/pull/313)) ### Changed - **Breaking:** No longer support Node.js 18 - Switched to "Universal" ESM. CommonJS `require()` usage pattern still supported for Nodejs ^20.19 & ^22.12 - Add support for Node.js 24 - Update dependencies ## [7.2.1](https://github.com/axa-group/oauth2-mock-server/compare/v7.2.0...v7.2.1) — 2025-04-30 ### Fixed - Fix paths of well known endpoints when issuer ends with a forward slash (reported in [#331](https://github.com/axa-group/oauth2-mock-server/issues/331) by [kikisaeba](https://github.com/kikisaeba)) ### Changed - Update dependencies ## [7.2.0](https://github.com/axa-group/oauth2-mock-server/compare/v7.1.2...v7.2.0) — 2024-11-25 ### Added - Include scope in token for authorization_code and refresh_token grants (by [PetrasJaug](https://github.com/PetrasJaug)) - Add PKCE support (by [tanettrimas](https://github.com/tanettrimas)) ### Changed - Update dependencies ## [7.1.2](https://github.com/axa-group/oauth2-mock-server/compare/v7.1.1...v7.1.2) — 2024-05-21 ### Changed - Add support for Node.js 22 (by [sheinbergon](https://github.com/sheinbergon)) ## [7.1.1](https://github.com/axa-group/oauth2-mock-server/compare/v7.1.0...v7.1.1) — 2023-10-24 ### Fixed - Be a better citizen in an ECMAScript modules world ## [7.1.0](https://github.com/axa-group/oauth2-mock-server/compare/v7.0.0...v7.1.0) — 2023-10-23 ### Added - Add support for "aud" claim in "client_credentials" grants (by [kadams54](https://github.com/kadams54)) ### Changed - Update dependencies ## [7.0.0](https://github.com/axa-group/oauth2-mock-server/compare/v6.0.1...v7.0.0) — 2023-10-04 ### Changed - **Breaking:** No longer support Node.js 16 ## [6.0.1](https://github.com/axa-group/oauth2-mock-server/compare/v6.0.0...v6.0.1) — 2023-10-03 ### Security - Update dependencies to fix: - [CVE-2022-25883](https://github.com/advisories/GHSA-c2qf-rxjj-qqgw) - [CVE-2023-26115](https://github.com/advisories/GHSA-j8xg-fqg3-53r7) - [CVE-2023-43646](https://github.com/advisories/GHSA-4q6p-r6v2-jvc5) ## [6.0.0](https://github.com/axa-group/oauth2-mock-server/compare/v5.0.2...v6.0.0) — 2023-06-19 ### Changed - **Breaking:** No longer support Node.js 14 - Fix authorize endpoint compliance (remove scope requirement, make state optional) (by [jirutka](https://github.com/jirutka)) - Add support for Node.js 20 - Update dependencies ## [5.0.2](https://github.com/axa-group/oauth2-mock-server/compare/v5.0.1...v5.0.2) — 2023-02-20 ### Security - Update dependencies to fix: - [CVE-2022-46175](https://github.com/advisories/GHSA-9c47-m6qq-7p4h) - [CVE-2022-24999](https://github.com/advisories/GHSA-hrpp-h998-j3pp) - [CVE-2022-25901](https://github.com/advisories/GHSA-h452-7996-h45h) ## [5.0.1](https://github.com/axa-group/oauth2-mock-server/compare/v5.0.0...v5.0.1) — 2022-10-04 ### Security - Update dependencies to fix: - [CVE-2022-36083](https://github.com/panva/jose/security/advisories/GHSA-jv3g-j58f-9mq9) ## [5.0.0](https://github.com/axa-group/oauth2-mock-server/compare/v4.3.2...v5.0.0) — 2022-06-27 ### Changed - **Breaking:** No longer support Node.js 12 - Add support for Node.js 18 ## [4.3.2](https://github.com/axa-group/oauth2-mock-server/compare/v4.3.1...v4.3.2) — 2022-06-27 ### Changed - Update dependencies ## [4.3.1](https://github.com/axa-group/oauth2-mock-server/compare/v4.3.0...v4.3.1) — 2022-03-29 ### Security - Update dependencies to fix: - [CVE-2021-44906](https://github.com/advisories/GHSA-xvch-5gv4-984h) ## [4.3.0](https://github.com/axa-group/oauth2-mock-server/compare/v4.2.0...v4.3.0) — 2022-02-01 ### Added - Support the token introspection endpoint (by [cfman](https://github.com/cfman)) ## [4.2.0](https://github.com/axa-group/oauth2-mock-server/compare/v4.1.1...v4.2.0) — 2022-01-28 ### Added - Add support for custom endpoint pathnames (by [roskh](https://github.com/roskh)) - Teach `/token` endpoint to support JSON content type (by [roskh](https://github.com/roskh)) ## [4.1.1](https://github.com/axa-group/oauth2-mock-server/compare/v4.1.0...v4.1.1) — 2021-11-18 ### Fixed - Fix regression: Prevent unhandled rejected promises when incorrectly invoking the /token endpoint ## [4.1.0](https://github.com/axa-group/oauth2-mock-server/compare/v4.0.0...v4.1.0) — 2021-11-15 ### Added - HTTPS support (by [lbestftr](https://github.com/lbestftr)) ## [4.0.0](https://github.com/axa-group/oauth2-mock-server/compare/v3.2.0...v4.0.0) — 2021-10-25 ### Added - Add `/endsession` endpoint (by [AndTem](https://github.com/AndTem)) - Support `EdDSA` algorithm ### Removed - **Breaking:** Drop support for Node.js 10 - No longer accepts PEM encoded keys - No longer supports generating unsigned JWTs ### Changed - **Breaking:** Reworked exposed API. Please refer to the [migration guide](./MIGRATION.md) for more information. - Add support for Node.js 16 ## [3.2.0](https://github.com/axa-group/oauth2-mock-server/compare/v3.1.0...v3.2.0) — 2021-08-03 ### Added - Add `subject_types_supported` OpenID Provider Metadata field (by [jjbooth74](https://github.com/jjbooth74)) ## [3.1.0](https://github.com/axa-group/oauth2-mock-server/compare/v3.0.3...v3.1.0) — 2020-11-30 ### Added - Add authorize redirect event (by [markwallsgrove](https://github.com/markwallsgrove)) ## [3.0.3](https://github.com/axa-group/oauth2-mock-server/compare/v3.0.2...v3.0.3) — 2020-11-12 ### Fixed - Fix regression: When adding a key to the KeyStore, do not normalize key "use" value to "sig" when already defined ## [3.0.2](https://github.com/axa-group/oauth2-mock-server/compare/v3.0.1...v3.0.2) — 2020-10-29 ### Added - Support Nodejs 14.15 LTS ## [3.0.1](https://github.com/axa-group/oauth2-mock-server/compare/v3.0.0...v3.0.1) — 2020-10-23 ### Fixed - Include missing files on pack/publish ## [3.0.0](https://github.com/axa-group/oauth2-mock-server/compare/v2.0.0...v3.0.0) — 2020-10-22 ### Added - TypeScript type definitions ([#48](https://github.com/axa-group/oauth2-mock-server/pull/48)) ### Changed - Straightened definitions of optional parameters: `null` is no longer considered as a non valued parameter value; `undefined` bears that meaning. ## [2.0.0](https://github.com/axa-group/oauth2-mock-server/compare/v1.5.1...v2.0.0) — 2020-10-01 ### Added - Honor OpenID Connect `nonce` ([#34](https://github.com/axa-group/oauth2-mock-server/pull/34) by [@HASHIMOTO-Takafumi](https://github.com/HASHIMOTO-Takafumi)) ### Removed - No longer support Node 8 ## [1.5.1](https://github.com/axa-group/oauth2-mock-server/compare/v1.5.0...v1.5.1) — 2020-04-06 ### Security - Update `npm` dependencies to fix: - [CVE-2020-7598](https://github.com/advisories/GHSA-vh95-rmgr-6w4m) ## [1.5.0](https://github.com/axa-group/oauth2-mock-server/compare/v1.4.0...v1.5.0) — 2020-01-23 ### Added - Add HTTP request object to `OAuth2Service`'s events - Add `beforeTokenSigning` event to `OAuth2Service` ## [1.4.0](https://github.com/axa-group/oauth2-mock-server/compare/v1.3.3...v1.4.0) — 2020-01-15 ### Security - Update `npm` dependencies to fix: - [NPM Security Advisory 1164](https://www.npmjs.com/advisories/1164) - [NPM Security Advisory 1300](https://www.npmjs.com/advisories/1300) - [NPM Security Advisory 1316](https://www.npmjs.com/advisories/1316) - [NPM Security Advisory 1324](https://www.npmjs.com/advisories/1324) - [NPM Security Advisory 1325](https://www.npmjs.com/advisories/1325) ### Fixed - Add missing `aud` claim under Authorization Code Flow ### Added - Add CORS support ## [1.3.3](https://github.com/axa-group/oauth2-mock-server/compare/v1.3.2...v1.3.3) — 2019-09-25 ### Security - Update `npm` dependencies to fix: - [CVE-2019-15657](https://nvd.nist.gov/vuln/detail/CVE-2019-15657) - [CVE-2019-10746](https://nvd.nist.gov/vuln/detail/CVE-2019-10746) - [CVE-2019-10747](https://nvd.nist.gov/vuln/detail/CVE-2019-10747) ### Changed - Update license's legal entity. ## [1.3.2](https://github.com/axa-group/oauth2-mock-server/compare/v1.3.1...v1.3.2) — 2019-08-09 ### Security - Update `npm` dependencies to fix: - [CVE-2019-10744](https://github.com/lodash/lodash/pull/4336) ## [1.3.1](https://github.com/axa-group/oauth2-mock-server/compare/v1.3.0...v1.3.1) — 2019-06-07 ### Security - Update `npm` dependencies to fix: - [WS-2019-0032](https://github.com/nodeca/js-yaml/issues/475) - [WS-2019-0063](https://github.com/nodeca/js-yaml/pull/480) - [WS-2019-0064](https://github.com/wycats/handlebars.js/compare/v4.1.1...v4.1.2) ## [1.3.0](https://github.com/axa-group/oauth2-mock-server/compare/v1.2.0...v1.3.0) — 2019-06-03 ### Added - Add revocation endpoint ## [1.2.0](https://github.com/axa-group/oauth2-mock-server/compare/v1.1.0...v1.2.0) — 2019-03-19 ### Added - Add Authorization code grant - Add Refresh token grant - Add Userinfo endpoint ### Security - Update `npm` dependencies to fix [CVE-2018-16469](https://nvd.nist.gov/vuln/detail/CVE-2018-16469) ## [1.1.0](https://github.com/axa-group/oauth2-mock-server/compare/v1.0.0...v1.1.0) — 2018-08-02 ### Added - Add Resource Owner Password Credentials grant ### Fixed - Add missing cache control headers on `/token` responses ## 1.0.0 — 2018-08-01 Initial release.