v10.3.0

Bump version 10.2.1 → 10.3.0

Improvements

• Ensure the reset password token can be used only once.
• Change JWT access token structure to use standard sub claim instead of user_id.
  • ⚠ Existing JWT will be invalidated
• Change verify and reset password tokens structure to use standard sub claim instead of user_id.

v10.2.1

Bump version 10.2.0 → 10.2.1

Improvements

• Bump httpx-oauth >=0.4,<0.11
  • With httpx-oauth >= 0.10, the OAuth2 client may be not able to return an email address depending on the OAuth Provider. In this case, the error OAUTH_NOT_AVAILABLE_EMAIL is raised during /callback. [Documentation]
• Enable Python 3.11 support in CI

v10.2.0

Bump version 10.1.5 → 10.2.0

New features

• Trigger custom logic after user login with on_after_login. [Documentation] Thanks @antont 🎉

Improvements

• Bump dependencies:
  • email-validator >=1.1.0,<1.4
  • pyjwt[crypto] ==2.5.0
• Use Hatch for environment and package management

v10.1.5

Improvements

• Bump dependencies:
  • makefun >=1.11.2,<2.0.0
  • httpx-oauth >=0.4,<0.8

v10.1.4

Bug fixes

• Rollback CookieTransport changes (77d0077) to temporary fix #1048. Thanks @davidbrochart 🎉

v10.1.3

Security fixes

• RedisStrategy: add a prefix to keys to avoid an enumeration attack. [Read more] Thanks @flipee 🎉

v10.1.2

Bug fixes

• Return a proper 204 empty response on successful login for CookieTransport. Thanks @caniko 🎉

v10.1.1

Bug fixes

• Fix get_oauth_associate_router import to keep OAuth dependencies optional. Thanks @schwannden 🎉

v10.1.0

New features and improvements

• Account e-mail association when authenticating with OAuth is now disabled by default for security reasons. It can be re-enabled on the router using the associate_by_email flag. [Documentation]
• New router to associate an OAuth account with an authenticated user account. [Documentation]
• New hooks on_before_delete and on_after_delete. [Documentation] Thanks @schwannden 🎉
• Bump dependencies:
  • httpx-oauth >=0.4,<=0.7 Thanks @carloe 🎉

v10.0.7

Improvements

• FastAPI dependency is now unconstrained, meaning FastAPI Users will always be installable with the latest version of FastAPI. Thanks @austinorr 🎉
• Optional Redis dependency now uses the main redis package, as async support has been merged into it. Thanks @applied-mathematician 🎉