There have been bugs filed in other libraries where rand.Read()
simply returns all 0s, instead use io.ReadFull to ensure that we get
the amount of bytes we want.
- Use io.ReadFull(rand.Reader, ...) instead of rand.Read() for getting
randomness from crypto/rand.
- Tried to be clear about OAuth2 vs OAuth in all places.
- Allow users to be locked from OAuth logins (if done manually for some
reason other than failed logins)
- Cleaned up some docs and wording around the previously very confusing
(now hopefully only somewhat confusing) oauth2 module.
- Add a new storer specifically for OAuth2 to enable clients to choose
regular database storing OR Oauth2 but not have to have both.
- Stop storing OAuth2 credentials in a combined form inside username.
- Add new events to capture OAuth events just like auth.
- Have pass-through parameters for OAuth init urls, this allows us to
pass additional behavior options (redirects and remember me) as well
as other things that should be present on the page that is redirected
to.
- Context.LoadUser is now OAuth aware.
- Remember's callbacks now include an OAuth check to see if a horribly
packed state variable contains a flag to say that we want to be
remembered.
- Change the OAuth2 Callback to use Attributes instead of that custom
struct to allow people to append whatever attributes they want into
the user that will be saved.
