Release v2.14.0
Summary
Hardens the sign-in and logout chain after a production incident where failed Microsoft/Google logins surfaced as blank pages and sessions kept being proxied without identity headers.
Added
- Failed remote sign-ins (correlation failure, invalid OAuth state, provider errors, cancelled consent) now redirect to the provider-selection page with a
reasonquery parameter (remote-failure/access-denied) instead of surfacing as a blank 500 error page; the bundled selection pages show a matching message - A guard in front of the reverse proxy that terminates an authenticated session that cannot be turned into a forwardable identity — the browser is sent to provider selection with
reason=invalid-session, API callers get401— instead of proxying the request without identity headers - A
Failed Sign-insdocumentation page covering thereasoncontract, handshake-cookie hygiene, and the forwardable-identity guard
Changed
- A single-provider deployment serves the selection page instead of auto-challenging when a sign-in failure reason is present, so a persistent failure cannot become a redirect loop
- Every provider callback — failed or successful — now sweeps leftover
.AspNetCore.Correlation.*/.AspNetCore.OpenIdConnect.Nonce.*handshake cookies, including legacy callback-path-scoped ones the logout endpoint can never reach, so one sign-in attempt heals a poisoned browser - The provider-selection page carries the explicit
returnUrlforward when served on its own path instead of looping back into itself after sign-in
Fixed
- Canonical OIDC sessions are resolved against the scheme that authenticated the request instead of the identity's
AuthenticationTypes.Federationauthentication type — previously every proxied request on such a session went out without identity headers, leaving the application blank after a seemingly successful login - Logout documentation now lists the complete set of cookies actually cleared, including
.cratis-identity-authorization,.cratis-invite-state, and the transient handshake cookies