Skip to main content

TideCloak 0.14.34

Summary​

TideCloak 0.14.34 bundles the DPoP verification page (tide_dpop_auth.html) with @tidecloak/js and adds server integrations for serving it — a createDpopRoute helper for web frameworks like Next.js, a framework-neutral @tidecloak/js/dpop-server entry point, and a Vite plugin. Heimdall gains an approval-wait timeout fix and origin-mismatch diagnostics.

Key Features​

DPoP Verification Page Bundled : tide_dpop_auth.html now ships with @tidecloak/js. The page and its CSP are bundled at build time, with CSP hashes generated from the bundled file instead of being maintained manually. An initialization warning surfaces when the configured DPoP verification page is not being served — the check is non-blocking, uses a short timeout, and does not throw during initialization.

Server Integrations for DPoP Page : New createDpopRoute for serving the DPoP verification page from web frameworks such as Next.js. The framework-neutral @tidecloak/js/dpop-server entry point exposes the same implementation for other server environments. createDpopRoute now uses the shared dpop-server implementation under the hood.

Vite Plugin (@tidecloak/js/vite) : New Vite plugin serves tide_dpop_auth.html during vite dev and vite preview with the required headers. Static production deployments still need the required DPoP headers configured on the hosting platform.

Heimdall: Approval-Wait Timeout Fix : Approval waits now fail instead of hanging indefinitely when an enclave request or response does not complete. Narrowed to the approval-wait path only.

Heimdall: Origin-Mismatch Diagnostics : Added logging for messages dropped because of an origin mismatch, trimmed to a concise single-line log output.

IdP Extensions Null-Check Fix : Fixed a null check in the IdP extensions.

Enclave SRI : sha256-tnuER/kvEoqDv7Rsgx/Gp+11pryaxf46r686hXY/cbY=

Upgrade Notes​

  • DPoP setup flow simplified — the previous flow required manually encoding values and sourcing the page separately. Documentation now uses the verification page included with the package. Custom DPoP page setups should review the new pattern.
  • Vite users — install @tidecloak/js/vite to serve the DPoP page during vite dev and vite preview.
  • Static hosting note — production static deployments still need the DPoP headers configured on the hosting platform; the Vite plugin only covers dev and preview.

Detailed changelog​

For a granular per-repository breakdown of changes, see the detailed changelog.