Release v2.41.0

Added

• RefreshTokenFamilyLifetime per service under ClientCredentials (default 30 days, must be greater than zero) sets one absolute deadline for a chain of refreshed tokens. Refreshing never extends it and access tokens never outlive it.
• A confirmation page (link-confirm.html) that a navigation to /.cratis/link/{scheme} now shows. Its form posts back with an antiforgery token.

Changed

• Starting a credential link now requires a confirmed POST with a valid antiforgery token; methods other than GET and POST get 405. The link callback is refused when the account or provider differs from the one that confirmed the link, or when the session is missing, unless the provider is configured with ResponseMode: FormPost and answers with a form post, which is matched through the protected flow state.
• Refresh tokens issued by earlier versions keep working until their own expiry. During a rolling upgrade, replicas still on the earlier version reject new refresh tokens, so clients may need to request a new token with their credentials.