v1.8.0
This release adds several security improvements to ActionAuth:
Password Security:
- Add configurable password complexity validation requiring uppercase, lowercase, numbers, and special characters
- Implement better password validation in registration and password reset flows
- Make complexity validation configurable but enabled by default
Session Management:
- Add session timeout functionality (default: 2 weeks)
- Add IP address and user-agent tracking for session security
- Implement suspicious activity detection for changed IP/user-agent
- Add secure cookie settings (HttpOnly, Secure, SameSite=Lax)
- Use HTTPS-only cookies in production environments
Rate Limiting:
- Implement protection against brute force attacks on login
- Add rate limiting on registration attempts
- Add rate limiting on password reset requests
- Add rate limiting on WebAuthn authentication
Environment Handling:
- Properly handle security features across development, test, and production environments
- Skip overly restrictive validations in test environment
- Improve default configurations for better security
Documentation:
- Add new Security Features section to README
- Document all security enhancements with examples
- Update configuration examples with security options
- Add security features to feature list
These changes significantly improve the security posture of ActionAuth without breaking compatibility with existing applications.