Added

• SDK-3717 Add cookie prop to support more express-session stores #395 (adamjmcgrath)

Added

• SDK-3503 Add *_jwt token endpoint auth methods #376 (adamjmcgrath)

Fixed

• discovery errors should be handled in express middleware #371 (adamjmcgrath)
• Allow periods in cookie name #350 (moberegger)

Security

• URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect GHSA-7p99-3798-f85c

Fixed

• transactionCookie configuration should be optional #338 (BitPatty)

Added

• SDK-3109 Add ability to pass custom logout params #329 (adamjmcgrath)
• SDK-3111 Add Oauth error props to http error when available #328 (adamjmcgrath)
• SDK-3110 Allow customising the UA header in client reqs #327 (adamjmcgrath)
• allow configuration of same site attribute on auth_verification cookie #323 (BitPatty)

Changed

• Looser cookie name validation #330 (adamjmcgrath)

Added

• Add cross domain iframe support for modern browsers #317 (adamjmcgrath)

Security

• Session fixation fix CVE-2021-41246

Fixed

• Fix refresh signature in ts defs #294 (adamjmcgrath)

Fixed

• Fix cookie chunking #275 (adamjmcgrath)

Added

• Add custom session id generation #252 (nholik)
• Add httpTimeout Option #251 (jmacvey)

Fixed

• Chunked cookies should not exceed browser max #237 (davidpatrick)