-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bump #165
Conversation
CHANGELOG.md
Outdated
### Security | ||
|
||
- Switched to using XChaCha20Poly1305 for the redis token cache encryption. | ||
|
||
This addresses a few medium severity security issues with the tokens | ||
This addresses a few medium severity security issues with the tokens. Note that |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Doesn't this imply a breaking change...?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I wouldn't say so. You can't use previous versions of the library alongside the new one, but you can upgrade without any changes on your end
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I see, although I agree with Simone's comment below
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
People might be scared about the token cache is incompatible with old versions of the library
is it worth it to explain that this will result only in more calls to auth0/okta?
@cottinisimone how do you feel about this? I tried rewording it a little |
No description provided.