Skip to content

Release v1.10.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Jul 11:23
· 35 commits to main since this release
v1.10.0
a2bcf27

Release 1.10.0

Changelog

Security

  • Require IdP email_verified (or GitHub verified) before auto-linking or creating local users from social login (social_login.require_verified_email, default true).
  • Built-in rate limits (PSR-6 cache.app): password-reset request, magic-login request, registration POST; OTP reset lockout via password_reset.max_code_attempts.
  • Reject non-HTTPS / private / loopback custom OAuth endpoint URLs (SSRF hardening).
  • configure-security adds PUBLIC_ACCESS for social login routes when mode is enabled; access_control patterns expand {provider} / {id}.
  • first_user_only registration re-checks user count after flush and rolls back on race.
  • Magic login no longer 500s when firewall login_link is missing (silent skip + warning log; anti-enumeration).

Added

  • AuthKitAttemptLimiter, OAuthEndpointUrlValidator, profile knobs registration_rate_*, password_reset / magic_login request_rate_*, max_code_attempts, require_verified_email.
  • Translation key register.flash_rate_limited (all locales).

Changed

  • QR-LOGIN.md design: hard gate on verified phone (phone + phoneVerifiedAt) clarified (still in development / not shipped).

Full Changelog: v1.9.1...v1.10.0

Assets 2
Loading