Skip to content

v2.3.0

Choose a tag to compare

View all tags
@ovx ovx released this 20 Jul 05:45
v2.3.0
f18decf

Added

  • verifyServer() — verify a payload remotely via ALTCHA Sentinel's POST /v1/verify/signature API instead of checking the HMAC signature locally. Supports timeouts, retries (fixed/exponential backoff), custom fetch, and abort via AbortController.
  • All framework plugins (Express, Fastify, NestJS, Next.js, Nuxt/H3, SvelteKit, Hono) now accept a verifyServer option. When set, Sentinel-issued payloads are verified remotely through the existing verifyHandler/middleware — no custom routing needed.

Changed

  • hmacSignatureSecret, deriveKey, and createChallengeParameters are now optional on framework plugin options. A pure Sentinel-remote setup can be as small as create({ verifyServer: { url, secret } }) — no secret/deriveKey required. Calling challengeHandler without deriveKey/createChallengeParameters now fails with a clear configuration error instead of a confusing runtime failure.
Assets 2
Loading