@okta/[email protected]

#690

Features

• OktaCallbackComponent will catch and display exceptions thrown from handleAuthentication()
• onAuthRequired callbacks will now receive the Angular injector as the 2nd parameter. This change allows logic using any services available within your application.

Bug Fixes

• Saved URI is now stored in sessionStorage instead of localStorage. This fixes an issue which can occur when multiple instances of the app are loading at the same time.
• OktaCallbackComponent uses window.location.replace() to complete the login flow after handleAuthentication completes. This fixes an issue where the user could navigate back to the callback hander.

Breaking Changes

• Signature for onAuthRequired callback functions has changed. Callbacks will receive the OktaAuthService as the first argument, and the Angular Injector as the second argument.
• Static initializer OktaAuthModule.initAuth() has been removed. OKTA_CONFIG should be provided directly by your module.
• getFromUri now returns an absolute URI as a string
• setFromUri takes a string. If it is a relative path, it will be converted to an absolute URI before being saved.
• Legacy config formats are no longer supported. See Configuration Reference for supported values.
• The pkce option now defaults to true, using the Authorization Code w/PKCE flow
  • Those using the (previous default) Implicit Flow should pass pkce: false to their config
  • See the @okta/okta-auth-js README regarding PKCE OAuth2 Flow for PKCE requirements
    • Which include the Application settings in the Okta Admin Dashboard allowing for PKCE

Other

• Upgrades @okta/okta-auth-js to version 3.0.0