Liking cljdoc? Tell your friends :D

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

0.3.0 - 2026-07-29

wrap-oauth2 ?return-to support: A safe same-origin path passed as ?return-to= on the launch URI is carried through the login in the session and takes precedence over :success-redirect-uri when the login completes. Unsafe values (absolute URLs, protocol-relative //host, backslashes, whitespace, control characters, over-long paths) are ignored
session/return-to-key: Session key holding the post-login redirect path
session/safe-return-path: Validates a redirect target as a safe same-origin path

wrap-oauth2 landing without tokens: The 401 response now clears OAuth2 flow state (access tokens, pending return-to) from the session instead of leaving it untouched

wrap-authenticate :allow-anonymous? option: Pass requests through with no identity when no strategy matches, enabling mixed public/authenticated routes
session-strategy :verify option: Optional fn to re-validate session identity per request; returning nil skips the strategy (stale session)
logout-handler :response-fn option: Zero-arg fn returning a custom Ring response instead of the default 302 redirect, enabling SPA clients to receive meaningful responses from fetch calls. Session is always cleared regardless

Strategy-based authentication: wrap-authenticate middleware tries strategies in order, first {:authenticated data} wins
Bearer token strategy: Extracts Authorization: Bearer header, hashes token (SHA-256), delegates verification to injected lookup function
Session strategy: Reads identity from Ring session for authenticated subsequent requests
OAuth2/OIDC login flow: wrap-oauth2 wraps ring-oauth2 with landing page interception and session creation
OIDC id_token decoding: decode-id-token utility for extracting JWT claims without signature verification
Magic link login flow: wrap-magic-link with HMAC-signed tokens, storage-backed single-use nonces, and constant-time comparison
Token utilities: generate-token (prefixed, URL-safe), hash-token (SHA-256), token-active? (expiry + revocation check)
SensitiveToken record: Custom print-method/print-dup/toString to prevent secret leakage in REPL and logs
Session helpers: POST-only logout-handler, session-timeout-handler with redirect hint
Role-based authorization: has-role? predicate on identity data
Config validation: Malli schemas for all middleware configs with validate-config for startup validation
Integration tests: Full flow tests for OAuth2+bearer, OAuth2-only, bearer-only, and magic-link scenarios

Can you improve this documentation?Edit on GitHub

cljdoc builds & hosts documentation for Clojure/Script libraries

Keyboard shortcuts