SqlOS 11.1.0

SqlOS 11.1.0 lets a browser that is already signed in approve a device without signing in again, in hosted mode and in a headless login UI. The same release closes sign-in edges that used to spend an email code, store a secret in plaintext, accept an unbounded SAML post, or leave an unverified address signed in after an organization revoked sessions for its SSO domain.

Highlights

• Headless device approval uses a live issuer session and continues to organization selection, MFA, or the approval screen. Approve and deny stay explicit (#531).
• POST /sqlos/auth/email-otp/verify refuses a third-party client before the code is checked, spent, or used to claim an unverified address (#530).
• ProtectSecret throws when Data Protection is unavailable. The public SqlOSCryptoService constructor requires an IDataProtectionProvider. AddSqlOS already registers Data Protection (#532).
• The SAML ACS caps the form at 2 MB, the encoded response at 1 MB, and the document at 512K characters. Oversized or malformed posts return 400 and consume nothing (#533).
• Organization SSO session revocation signs out every account with an address at the verified domain, including unverified addresses (#529).
• Breaking: delete a leftover MapAuthServer() call. AddSqlOS maps the auth, audit, email, and calendar routes (#528).
• The repository includes the sorted-pagination paper. It does not change the package (#526).

Validation

The release passed the complete GitHub matrix: build, website/docs, unit tests, core SQL integration tests, example-app integration tests, Todo integration tests, merged coverage, and coverage threshold.

• Hosted owned-app flow validated
• Headless owned-app flow validated
• Portable CIMD flow validated
• Compatibility DCR flow validated
• Protected-resource metadata and audience validation validated

Read the release article

Full changelog: v11.0.0...v11.1.0