Skip to content

3.3.0

Choose a tag to compare

View all tags
@madeyoga madeyoga released this 11 Oct 17:09
v3.3.0
e95a711
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

AuthEndpoints

Email-code sign-in is off until EmailCode.Enabled is true, or until you call AddEmailCodeEndpoints and MapEmailCodeEndpoints. The facade then maps POST {IdentityPath}/emailCode/send and POST {IdentityPath}/emailCode/verify. Neither route uses antiforgery. Send uses AuthEndpoints.EmailCode.Send. Verify uses AuthEndpoints.Login.

Call modelBuilder.UseEmailCodes() and migrate. The table is AuthEndpoints.AuthEndpointsEmailCodes. MapEmailCodeEndpoints throws if that entity is missing from the model.

Send returns 200 with { "expiresInSeconds", "resendAfterSeconds" } for a valid address, including when the address is unknown, the account cannot receive a code, the cooldown or per-address cap applies, the sender throws, or a deadlock or serialization failure still fails after one retry. An invalid address is 400. Verify of a wrong, expired, or exhausted code is 401 with detail Invalid or expired code. A user who has two-factor authentication on must send a TOTP code or a recovery code when RequireTwoFactor is true (the default).

AllowSignUp and MagicLink.Enabled default to false. With sign-up on, a correct code for an unknown address creates one confirmed user with that email as the user name and no password. With the magic link on, the message LinkUrl defaults to LinkUri + "#token=" + token, and verify accepts { "token" } instead of an email and a code.

Outside Development, startup fails until a real IEmailCodeSender<TUser> is registered, unless RequireSenderOutsideDevelopment is false. POST /emailCode/send awaits the sender, so queue the message and return.

Upgrading from 3.2.x

  • Email-code routes are not mapped unless you opt in. Existing password, passkey, JWT, and OAuth sign-in is unchanged.
  • Hosts that opt in call UseEmailCodes() and apply a migration before MapEmailCodeEndpoints.
  • Register IEmailCodeSender<TUser> outside Development. IEmailSender<TUser> does not send the code.
  • Jwt.Enabled does not select JwtEmailCodeSignInCompleter<TUser>. Register it with AddEmailCodeSignInCompleter when verify should issue a Simple JWT.

Packages

  • AuthEndpoints 3.3.0
  • AuthEndpoints.External.OAuth 3.0.0-preview.5
  • AuthEndpoints.OAuth.GitHub and AuthEndpoints.OAuth.Google unchanged at 3.0.0-preview.4

Links

Assets 2
Loading