3.6.0 (2018-06-05)

Full Changelog

NOTES

• Passwordless was reconfigured completely to use the combined Lock library (currently hard-coded to 11.5). All current settings will be migrated to the new configuration so your login process should not change. Lock initiation has also been refactored to improve maintainability and adhere to WordPress standards.
• The Setup Wizard has been adjusted to more clearly explain the process and options available. This only affects new installations using the Setup Wizard for configuration.
• The settings page has been rearranged and improved overall. New settings descriptions have also been added along with links to documentation, where appropriate.
• State validation was added to both login flows; nonce validation was added to sites using Implicit flow.
• OIDC compliant Applications should now function as expected (though this setting is not yet activated by default on installation). OpenID Connect login is now possible by turning off the Client Credentials grant for your WordPress Application.
• Dashboard widgets have been removed. This can easily be added back as a plugin, if needed. Please contact support if you need assistance with this.
• A number of new hooks have been added, please see our docs page on extension for a complete inventory with examples. This includes the ability to support refresh tokens.
• Federated logout has been removed.

Closed issues

• Expose a configurable toggle that allows Users to state if federated logout should be used #471
• Updating to 3.5.2 - Fatal error: Uncaught Error: Cannot use object of type stdClass as array in /app/wp-content/plugins/auth0/lib/WP_Auth0_DBManager.php on line 225 #464
• Autoloader performance issue #461
• Bad request does not raise error #432
• Widget URL changes don't save when you are using passwordless #430
• Deprecate oauth/ro endpoint #410
• Handling errors #403
• Fallback /api/v2/users/{id} to /userinfo #401
• CORS errors #400
• Provide Resend verification email only for DB connections #345
• SSO disabled, Single Logout enabled causes users to get logged out automatically a few seconds after logging in #336
• French translation : html characters #309
• "Invalid authorization code": Access token is requested twice in a row, breaking the login flow #305
• Make state work after SSO login #302
• Is there a way to use Refresh Tokens and Wordpress? #296
• Only decode the payload before user profile fetch in login manager #283
• redirect callback errors #280
• Linked Users won't be able to login using implicit flow and pipeline 2 #272
• Normalize use of shortcode and widget #260
• Wrong z-index on modal error message in manual setup #252
• Logout does not work when Wordpress is locked down (private site) #39

Added

• Adding refresh token support; adjusting default scope #456 (joshcanhelp)
• Add code quality tools, improved composer.json #454 (joshcanhelp)
• Add /userinfo fallback during login #423 (joshcanhelp)
• State handling during login process for both types #406 (joshcanhelp)

Changed

• Change token exchange redirect URL to match what was sent for auth code #463 (joshcanhelp)
• Hide the signup tab if registrations are turned off #460 (joshcanhelp)
• New class for state handling; set cookie for implicit nonce #458 (joshcanhelp)
• Change auto-login action #449 (joshcanhelp)
• Require telemetry for API calls #441 (joshcanhelp)
• Change Appearance tab settings output #439 (joshcanhelp)
• Change Feature settings output #436 (joshcanhelp)
• Change Basic settings field display; better admin UX #433 (joshcanhelp)
• Change how Advanced admin settings fields are output #429 (joshcanhelp)
• Setting titles and option names #427 (joshcanhelp)
• Clean up admin notices #421 (joshcanhelp)
• Change asset enqueuing #419 (joshcanhelp)
• Improve WP_Auth0_Options #418 (joshcanhelp)

Deprecated

• Deprecate 2 lookup methods #446 (joshcanhelp)
• Deprecating wp-admin settings-related methods + classes #445 (joshcanhelp)
• Deprecating unused Lock Options classes and methods #444 (joshcanhelp)
• Deprecating admin_enqueue functions #443 (joshcanhelp)
• Deprecate oauth/ro endpoint #413 (joshcanhelp)

Removed

• Remove wp-admin click tracking #451 (joshcanhelp)
• Remove dashboard widgets #428 (joshcanhelp)
• Remove and migrate Passwordless setting #425 (joshcanhelp)
• Remove api_audience settings field #422 (joshcanhelp)
• Removing dashboard widgets #397 (joshcanhelp)

Fixed

• Correcting input field height on settings pages for IE #472 (joshcanhelp)
• Save sub or user_id if not provided; remove extemporaneous ID token attributes #469 (joshcanhelp)
• Improve Setup Wizard #468 (joshcanhelp)
• Fix install and DB update errors #467 (joshcanhelp)
• Fix SLO redirect, SLO on when SSO off, SSO setting not pushed to dashboard #466 (joshcanhelp)
• Fixed auto-loader to skip non-WP-Auth0 classes #465 (joshcanhelp)
• Fix empty path notice on initial setup #457 (joshcanhelp)
• Fix logout process #453 (joshcanhelp)
• Fix help tab text and settings tab UX #452 (joshcanhelp)
• Only show email verification resend for DB connections #447 (joshcanhelp)
• Fix Passwordless handling; update Lock instantiation #434 (joshcanhelp)
• Fix Implicit login handling #426 (joshcanhelp)
• Admin settings refactor - WP_Auth0_Admin_Generic #416 (joshcanhelp)
• Fix Login Process Error Handling #409 (joshcanhelp)