Skip to content

v4.0.0

Choose a tag to compare

View all tags
@cursor cursor released this 15 Oct 07:03
v4.0.0
2f59136
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

AuthEndpoints, External.OAuth, GitHub, and Google

4.0.0 ships AuthEndpoints, the AuthEndpoints.External.OAuth forwarding shim, AuthEndpoints.OAuth.GitHub, and AuthEndpoints.OAuth.Google together. The shim and the provider packages depend on AuthEndpoints with the range [4.0.0, 5.0.0).

AddPasswordAuth and MapPasswordAuth are the new password facade. Cookie is the default session. Set Session = AuthEndpointsSession.Jwt for JWT. Identity bearer stays on AddAuthEndpoints. AddAuthEndpoints and MapAuthEndpoints stay the 3.4.1 facade: same options, same routes, not obsolete. They do not gain 4.0-only behaviour except opt-in JWT body transport, the unknown-email hash verify on POST /create, an absolute refresh lifetime, and a lost concurrent refresh that revokes the family.

New building blocks:

  • One sign-in completer, selected with AuthEndpointsSession or a completer name. The 3.x per-method completers are obsolete and still run when a host registers one and the map passes no session.
  • Email-code step-up on POST /confirmIdentity/emailCode/send for users with no password, authenticator, or passkey. External logins do not block it. UseEmailCodes() hosts add a migration for the Purpose column before deploying.
  • JWT RefreshTokenTransport.Body for clients with no cookie jar. Both transports enforce an absolute lifetime, and a lost concurrent refresh revokes the family. Hashed tokens, rotation, reuse that revokes the family, the security-stamp bind, and logout revoke are unchanged. UseRefreshToken() hosts add a migration for AbsoluteExpiresAt.
  • POST /manage/password sets a first password. MapAuthEndpoints does not map it.
  • Forgot-password, resend, email-code send, and passkey registration options return the same response for known and unknown emails. Register already returned an empty 200 for a taken email. 4.0 notifies that owner and runs the same class of work for an unknown email on those routes.

MapGitHubAuthEndpoints and MapGoogleAuthEndpoints are removed. Map MapExternalAuthProvider or MapExternalAuthEndpoints. A missing Add* throws at map time. AuthEndpoints.External.OAuth below 4.0.0 fails the build with AE4000.

Upgrading from 3.4.1

Follow Upgrade to 4.0. Each breaking change has a migration step on that page. POST /register already returned an empty 200 for a taken email. There is no migration for DuplicateUserName or DuplicateEmail.

Packages

  • AuthEndpoints 4.0.0
  • AuthEndpoints.External.OAuth 4.0.0 (forwarding shim)
  • AuthEndpoints.OAuth.GitHub 4.0.0
  • AuthEndpoints.OAuth.Google 4.0.0

Links

Assets 2
Loading