Password Flow Support
The latest update introduces support for the password flow in addition to the existing implicit flow. With the implicit flow, users are redirected to the authentication server for login. The password flow, by contrast, requires users to submit their credentials directly into the client application, which then exchanges them for an access token. While this approach somewhat deviates from the core principles of OAuth 2, it remains a common choice for business applications where users are comfortable sharing their passwords with the client.
Discovery Document Integration
Configuring the library has become simpler thanks to its new ability to read the discovery document defined by OpenID Connect. This reduces the need for manual configuration by automatically fetching relevant endpoints and settings.
Refresh Token Handling
The library now supports the use of refresh tokens to obtain a new access token, which is particularly useful after an existing token expires. This mechanism enables sliding expiration for user sessions. Notably, the implicit flow forbids the use of refresh tokens by its design, so this functionality is available only when the password flow is employed.
Userinfo Endpoint Access
OpenID Connect specifies a userinfo endpoint that provides details about the currently authenticated user. Since the password flow does not issue an identity token, the library now allows querying this endpoint as an alternative way to retrieve user information.