Skip to content

Release v2.17.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Aug 05:27
v2.17.0
33cb40e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

Every OIDC handshake (Microsoft, Google) failed with "Correlation failed" and looped back to provider selection, because the handler's default form_post response mode returns the authorization code in a cross-site POST — which browsers never attach the SameSite=Lax correlation cookie to. This surfaced hardest in the credential-link flow (Cratis/StudioIssues#104), where the failure additionally landed on the sign-in selection page, offering to replace the very session the link was preserving. The link flow is now also embeddable in the product's modal iframe, with the provider leg in its own top-level window.

Added

  • ResponseMode setting per OIDC provider (Query default, FormPost for providers that mandate it, such as Apple) — choosing FormPost switches that provider's handshake cookies to SameSite=None; Secure
  • Embeddable credential-link flow: /.cratis/link serves a provider-selection page for the product to frame, /.cratis/link/complete ends a successful link, and the pages report the outcome over a BroadcastChannel and an origin-checked postMessage to the embedding page
  • Link:EmbedAncestors setting naming the origins allowed to frame the link pages (self for the proxy's own origin); when empty — the default — the link pages send frame-ancestors 'none' and X-Frame-Options: DENY
  • link-select-provider.html and link-complete.html well-known pages, deployment-replaceable like every other page

Changed

  • OIDC providers request the code flow's standard query response mode, so the provider callback is a top-level GET the SameSite=Lax handshake cookies accompany (Cratis/StudioIssues#104)
  • A credential link with no (or an invalid) returnUrl ends on the flow's own completion page instead of the application root
  • Sign-in selection pages (provider selection, its SPA, invitation selection) always refuse framing
  • The selection SPA served at /.cratis/select-provider now matches the static selection pages' design instead of its own dark theme (Cratis/StudioIssues#104)
  • A challenge navigation identified as framed (Sec-Fetch-Dest) is answered with the link selection page instead of a redirect the external identity provider would refuse to render framed

Fixed

  • OIDC sign-ins and credential links no longer fail with "Correlation failed" and loop through provider selection (Cratis/StudioIssues#104)
  • A failed link challenge ends on the link-failed page instead of the sign-in selection page, which offered full sign-ins that would replace the preserved session (Cratis/StudioIssues#104)

🤖 Generated with Claude Code

Assets 2
Loading