Changelog to release 3.1.0:

OAuth2.0 Provider - Features

• Add reqval.fill_id_token with technicals OIDC fields into id_token #660: OIDC add support of nonce, c_hash, at_hash fields
  • New RequestValidator.fill_id_token method
  • Deprecated RequestValidator.get_id_token method
• Oidc userinfo #677: OIDC add UserInfo endpoint
  • New RequestValidator.get_userinfo_claims method

OAuth2.0 Provider - Security

• Security data leak to logs #665: Enhance data leak to logs
  • New default to not expose request content in logs
  • New function oauthlib.set_debug(True)
• Client_secret and code_verifier (PKCE) should be transmitted securely #666: Disabling query parameters for POST requests

OAuth2.0 Provider - Bugfixes

• OAuthlib API is not returning PKCE new values #670: Fix validate_authorization_request to return the new PKCE fields
• token_type should be case insensitive #674: Fix token_type to be case-insensitive (bearer and Bearer)

OAuth2.0 Client - Bugfixes

• parse_authorization_code_response has no error checking #290: Fix Authorization Code's errors processing
• Improve BackendApplicationClient class #603: BackendApplication.Client.prepare_request_body use the "scope" argument as intended.
• Null value in expires_in field not handled correctly #672: Fix edge case when expires_in=Null

OAuth1.0 Client

• Add case-insensitive headers to oauth1 BaseEndpoint #669: Add case-insensitive headers to oauth1 BaseEndpoint