2.4.0-rc.16

First RC containing the full 2.4.0 pre-release security audit. rc.15 was tagged but never produced an image — its build was cancelled, and it was cut from a commit predating the audit work — so this is the first usable RC of that work.

Security

The 22-finding pre-release audit (#748, #751) and the phone-only account fixes (#753).

Highlights:

• nOAuth defense — a social login whose provider does not attest the email address no longer signs into an existing account.
• OAuth state bound to the initiating browser — closes a login-CSRF hole where an attacker's harvested code+state could log a victim into the attacker's account.
• Authorization code bound to the authenticated client (RFC 6749 §4.1.3).
• Delegated FGA fails closed — an agent-acting-for-user check against a model with no type agent now denies instead of silently authorizing as the user alone.
• Access/refresh tokens hashed at rest in the session store, with dual-read so no live session drops on deploy.
• at_hash/c_hash now match the token's alg instead of being hard-coded to SHA-256.
• Signup no longer leaks account existence; wildcard CORS no longer sends Allow-Credentials; bcrypt cost raised to 12.

Breaking changes

• --enable-email-verification with no SMTP now fails at boot. Every recovery route ends at the same mailbox, so without a mail path a user is created unverified and can never recover. Set --smtp-host, --smtp-port and --smtp-sender-email — all three — or disable verification.
• _delete_user / DeleteUser take id, not email. A phone-only account has no email and could not be deleted at all. Proto field 1 is reserved rather than reused, so an old client fails loudly instead of having its email decode as an id on a delete.
• Delegated FGA against a model with no type agent is denied. Add type agent, or set --fga-allow-unconstrained-agents while migrating.
• Wildcard CORS no longer sends Allow-Credentials.
• bcrypt cost 12 for new hashes — write-side only; existing hashes keep verifying.
• --app-cookie-same-site is now validated at boot; an unrecognised value exits instead of silently falling back to lax.

New flags

Flag	Default	Purpose
--oauth-allow-unverified-provider-email	false	Compatibility escape hatch for the nOAuth defense. Narrowed, not a full opt-out.
--microsoft-allowed-tenants	(empty)	Entra tenants allowed when --microsoft-tenant-id is a multi-tenant alias.
--fga-allow-unconstrained-agents	false	Restores pre-2.4.0 delegated-FGA behaviour while migrating a model.

Bug fixes

• Clicking the emailed verification link no longer leaves the account permanently "not verified" when MFA setup interrupts session issuance — most visibly on passkey login.
• TOTP enrolment works for phone-only accounts (was AccountName must be set).
• Deleting an account no longer deletes a different account's OTP row via an empty-string match.

SDKs

• authorizer-js 4.0.0-rc.0, authorizer-react 2.2.0-rc.7 (both on the rc dist-tag)
• authorizer-proto-go v0.2.0-rc.1, authorizer-proto 0.2.0rc1

Upgrading

Read the email verification contract before upgrading if you use Microsoft login.