-
- Breaking Changes
-
-We listened to your feedback and have improved the naming of the SDK method initializeSelfServiceRecoveryForNativeApps to better match what it does: initializeSelfServiceRecoveryWithoutBrowser. As in the previous release you may still use the old SDK if you do not want to deal with the SDK breaking changes for now.
-We listened to your feedback and have improved the naming of the SDK method initializeSelfServiceVerificationForNativeApps to better match what it does: initializeSelfServiceVerificationWithoutBrowser. As in the previous release you may still use the old SDK if you do not want to deal with the SDK breaking changes for now.
-We listened to your feedback and have improved the naming of the SDK method initializeSelfServiceSettingsForNativeApps to better match what it does: initializeSelfServiceSettingsWithoutBrowser. As in the previous release you may still use the old SDK if you do not want to deal with the SDK breaking changes for now.
-We listened to your feedback and have improved the naming of the SDK method initializeSelfServiceregistrationForNativeApps to better match what it does: initializeSelfServiceregistrationWithoutBrowser. As in the previous release you may still use the old SDK if you do not want to deal with the SDK breaking changes for now.
-We listened to your feedback and have improved the naming of the SDK method initializeSelfServiceLoginForNativeApps to better match what it does: initializeSelfServiceLoginWithoutBrowser. As in the previous release you may still use the old SDK if you do not want to deal with the SDK breaking changes for now.
-
-Bug Fixes:
-
-
-Add json detection to setting error subbranches (fb83dcb)
Cache migration status (5be2f14), closes #1337
Change SMTP config validation from URI to a Regex pattern (#1436) (5ab1e8f), closes #1435
Check filesystem before fallback to bundled templates (#1401) (22d999e)
Continue button for oidc registration step (2aad5ac), closes #1422 #1320:
-
-When signing up with an OIDC provider and the traits model is missing some fields, the submit button shows all OIDC options. Instead, it should show just one option called “Continue”.
Deprecate sessionCookie (#1428) (eccad74), closes #1426
Do not cache incomplete migrations (#1434) (154c26f)
Do not run network migrations when booting (12bbab9), closes #1399
Improve identity list performance (f76886f), closes #1412
Incorrect openapi specification for verification submission (#1431) (ecb0a01), closes #1368
Mark ui node message as optional (#1365) (7b8d59f), closes #1361 #1362
Mark verified_at as omitempty (77b258e):
-
-Closes https://github.com/ory/sdk/issues/46
Panic if contextualizer is not set (760035a)
Panic on error in issue session (5fbd855), closes #1384
Prometheus metrics fix (#1299) (ac5d00d)
Recovery email case sensitive (#1357) (bce14c4), closes #1329
Remove typing from node.attribute.value (63a5e08):
-
-Closes https://github.com/ory/sdk/issues/75
-Closes https://github.com/ory/sdk/issues/74
-Closes https://github.com/ory/sdk/issues/72
Rename client package for external consumption (cba8b00)
Resolve driver issues (47b1c8d)
Resolve network regression (8f96b1f)
Resolve network regressions (8fc52c0)
Testhelper regressions (bf3b04f)
Use correct url in submitSelfServiceVerificationFlow (ab8a600)
Use STARTTLS for smtps connections (#1430) (c21bb80), closes #781
Version schema (#1359) (8c4bac7), closes #1331 #1101 ory/hydra#2427
-
-Code Refactoring:
-
-
-
-Documentation:
-
-
-
-Features:
-
-
-Add GetContextualizer (ac32717)
Add instana as possible tracing provider (#1429) (abe48a9), closes #1385
Add vk and yandex providers to oidc providers and documentation (#1339) (22a3ef9), closes #1234
Improve contextualization in serve/daemon (f83cd35)
Include Credentials Metadata in admin api (#1274) (c8b6219), closes #820
Include Credentials Metadata in admin api Missing changes in handler (#1366) (a71c220)
Natively support SPA for login flows (6ff67af), closes #1138 #668:
-
-This patch adds the long-awaited capabilities for natively working with SPAs and AJAX requests. Previously, requests to the /self-service/login/browser endpoint would always end up in a redirect. Now, if the Accept header is set to application/json, the login flow will be returned as JSON instead. Accordingly, changes to the error and submission flow have been made to support application/json content types and SPA / AJAX requests.
Natively support SPA for recovery flows (5461244):
-
-This patch adds the long-awaited capabilities for natively working with SPAs and AJAX requests. Previously, requests to the /self-service/recovery/browser endpoint would always end up in a redirect. Now, if the Accept header is set to application/json, the registration flow will be returned as JSON instead. Accordingly, changes to the error and submission flow have been made to support application/json content types and SPA / AJAX requests.
Natively support SPA for registration flows (57d3c57), closes #1138 #668:
-
-This patch adds the long-awaited capabilities for natively working with SPAs and AJAX requests. Previously, requests to the /self-service/registration/browser endpoint would always end up in a redirect. Now, if the Accept header is set to application/json, the registration flow will be returned as JSON instead. Accordingly, changes to the error and submission flow have been made to support application/json content types and SPA / AJAX requests.
Natively support SPA for settings flows (ea4395e):
-
-This patch adds the long-awaited capabilities for natively working with SPAs and AJAX requests. Previously, requests to the /self-service/settings/browser endpoint would always end up in a redirect. Now, if the Accept header is set to application/json, the registration flow will be returned as JSON instead. Accordingly, changes to the error and submission flow have been made to support application/json content types and SPA / AJAX requests.
Natively support SPA for verification flows (c151500):
-
-This patch adds the long-awaited capabilities for natively working with SPAs and AJAX requests. Previously, requests to the /self-service/verification/browser endpoint would always end up in a redirect. Now, if the Accept header is set to application/json, the registration flow will be returned as JSON instead. Accordingly, changes to the error and submission flow have been made to support application/json content types and SPA / AJAX requests.
Sign in with Auth0 (#1352) (f618a53), closes #609
Support api in settings error (23105db)
Support reading session token from X-Session-Token HTTP header (dcaefd9)
Team id in slack oidc (#1409) (e4d021a), closes #1408
Update openapi specs and regenerate (cac507e)
identities: Add a state to identities (#1312) (d22954e), closes #598
-
-Tests:
-
-
-Add tests for cookie behavior of API and browser endpoints (d1b1521)
Remove obsolete console.log (3ecc869)
Resolve e2e regressions (b0d3b82)
Resolve migratest panic (89d05ae)
e2e: Greatly improve test performance (#1421) (2ffad9e):
-
-Instead of running the individual profiles as separate Cypress instances, we now use one singular instance which updates the Ory Kratos configuration depending on the test context. This ensures that hot-reloading is properly working while also signficantly reducing the amount of time spent on booting up the service dependencies.
-
-Unclassified:
-
-
-
-Breaking Changes
-
-Unfortunately, some method signatures have changed in the SDKs. Below is a list of changed entries:
-
-
-- Error
genericError was renamed to jsonError and now includes more information and better typing for errors;
-- The following functions have been renamed:
-
-
-initializeSelfServiceLoginViaAPIFlow -> initializeSelfServiceLoginForNativeAppsinitializeSelfServiceLoginViaBrowserFlow -> initializeSelfServiceLoginForBrowsersinitializeSelfServiceRegistrationViaAPIFlow -> initializeSelfServiceRegistrationForNativeAppsinitializeSelfServiceRegistrationViaBrowserFlow -> initializeSelfServiceRegistrationForBrowsersinitializeSelfServiceSettingsViaAPIFlow -> initializeSelfServiceSettingsForNativeAppsinitializeSelfServiceSettingsViaBrowserFlow -> initializeSelfServiceSettingsForBrowsersinitializeSelfServiceRecoveryViaAPIFlow -> initializeSelfServiceRecoveryForNativeAppsinitializeSelfServiceRecoveryViaBrowserFlow -> initializeSelfServiceRecoveryForBrowsersinitializeSelfServiceVerificationViaAPIFlow -> initializeSelfServiceVerificationForNativeAppsinitializeSelfServiceVerificationViaBrowserFlow -> initializeSelfServiceVerificationForBrowsers
-- Some type names have changed, for example
traits -> identityTraits.
-
-
-Bug Fixes:
-
-
-- Properly handle CSRF for API flows in recovery and verification strategies (461c829), closes #1141
-- session: Use specific headers before bearer use (82c0b54)
-- Improve settings oas definition (867abfc)
-- Use correct api spec path (5f41f87)
-- Use correct openapi path for validation (#1340) (a0f5673)
-
-
-Code Generation:
-
-
-- Pin v0.6.3-alpha.1 release commit (5edf952)
-
-
-Code Refactoring:
-
-
-
-Code Generation:
-
-
-- Pin v0.6.2-alpha.1 release commit (99c1b1d)
-
-
-Documentation:
-
-
-
-Code Generation:
-
-
-- Pin v0.6.1-alpha.1 release commit (1df82da)
-
-
-Features:
-
-
-- Allow changing password validation API DNS name (#1009) (ced85e8)
-
-
-Bug Fixes:
-
-
-
-Code Generation:
-
-
-- Pin v0.6.0-alpha.2 release commit (a3658ba)
-
-
-Features:
-
-
-
-Breaking Changes
-
-BCrypt is now the default hashing alogrithm. If you wish to continue using Argon2id please set hashers.algorithm to argon2.
-This implies a significant breaking change in the verification flow payload. Please consult the new ui documentation. In essence, the login flow’s methods key was replaced with a generic ui key which provides information for the UI that needs to be rendered.
-
-To apply this patch you must apply SQL migrations. These migrations will drop the flow method table implying that all verification flows that are ongoing will become invalid. We recommend purging the flow table manually as well after this migration has been applied, if you have users doing at least one self-service flow per minute.
-This implies a significant breaking change in the recovery flow payload. Please consult the new ui documentation. In essence, the login flow’s methods key was replaced with a generic ui key which provides information for the UI that needs to be rendered.
-
-To apply this patch you must apply SQL migrations. These migrations will drop the flow method table implying that all recovery flows that are ongoing will become invalid. We recommend purging the flow table manually as well after this migration has been applied, if you have users doing at least one self-service flow per minute.
-This implies a significant breaking change in the settings flow payload. Please consult the new ui documentation. In essence, the login flow’s methods key was replaced with a generic ui key which provides information for the UI that needs to be rendered.
-
-To apply this patch you must apply SQL migrations. These migrations will drop the flow method table implying that all settings flows that are ongoing will become invalid. We recommend purging the flow table manually as well after this migration has been applied, if you have users doing at least one self-service flow per minute.
-This implies a significant breaking change in the registration flow payload. Please consult the new ui documentation. In essence, the login flow’s methods key was replaced with a generic ui key which provides information for the UI that needs to be rendered.
-
-To apply this patch you must apply SQL migrations. These migrations will drop the flow method table implying that all registration flows that are ongoing will become invalid. We recommend purging the flow table manually as well after this migration has been applied, if you have users doing at least one self-service flow per minute.
-This implies a significant breaking change in the login flow payload. Please consult the new ui documentation. In essence, the login flow’s methods key was replaced with a generic ui key which provides information for the UI that needs to be rendered.
-
-To apply this patch you must apply SQL migrations. These migrations will drop the flow method table implying that all login flows that are ongoing will become invalid. We recommend purging the flow table manually as well after this migration has been applied, if you have users doing at least one self-service flow per minute.
-This change introduces a new feature: UI Nodes. Previously, all self-service flows (login, registration, …) included form fields (e.g. methods.password.config.fields). However, these form fields lacked support for other types of UI elements such as links (for e.g. “Sign in with Google”), images (e.g. QR codes), javascript (e.g. WebAuthn), or text (e.g. recovery codes). With this patch, these new features have been introduced. Please be aware that this introduces significant breaking changes which you will need to adopt to in your UI. Please refer to the most recent documentation to see what has changed. Conceptionally, most things stayed the same - you do however need to update how you access and render the form fields.
-
-Please be also aware that this patch includes SQL migrations which purge existing self-service forms from the database. This means that users will need to re-start the login/registration/… flow after the SQL migrations have been applied! If you wish to keep these records, make a back up of your database prior!
-This change introduces a new feature: UI Nodes. Previously, all self-service flows (login, registration, …) included form fields (e.g. methods.password.config.fields). However, these form fields lacked support for other types of UI elements such as links (for e.g. “Sign in with Google”), images (e.g. QR codes), javascript (e.g. WebAuthn), or text (e.g. recovery codes). With this patch, these new features have been introduced. Please be aware that this introduces significant breaking changes which you will need to adopt to in your UI. Please refer to the most recent documentation to see what has changed. Conceptionally, most things stayed the same - you do however need to update how you access and render the form fields.
-
-Please be also aware that this patch includes SQL migrations which purge existing self-service forms from the database. This means that users will need to re-start the login/registration/… flow after the SQL migrations have been applied! If you wish to keep these records, make a back up of your database prior!
-The configuration value for hashers.argon2.memory is now a string representation of the memory amount including the unit of measurement. To convert the value divide your current setting (KB) by 1024 to get a result in MB or 1048576 to get a result in GB. Example: 131072 would now become 128MB.
-
-Co-authored-by: aeneasr 3372410+aeneasr@users.noreply.github.com
-Co-authored-by: aeneasr aeneas@ory.com
-Please run SQL migrations when applying this patch.
-The following configuration keys were updated:
-
-selfservice.methods.password.config.max_breaches
-
-
-
-password.max_breaches -> selfservice.methods.password.config.max_breachespassword.ignore_network_errors -> selfservice.methods.password.config.ignore_network_errors
-After battling with spf13/viper for several years we finally found a viable alternative with knadh/koanf. The complete internal configuration infrastructure has changed, with several highlights:
-
-
-- Configuration sourcing works from all sources (file, env, cli flags) with validation against the configuration schema, greatly improving developer experience when changing or updating configuration.
-- Configuration reloading has improved significantly and works flawlessly on Kubernetes.
-- Performance increased dramatically, completely removing the need for a cache layer between the configuration system and ORY Hydra.
-- It is now possible to load several config files using the
--config flag.
-- Configuration values are now sent to the tracer (e.g. Jaeger) if tracing is enabled.
-
-
-Please be aware that ORY Kratos might complain about an invalid configuration, because the validation process has improved significantly.
-
-Bug Fixes:
-
-
-Add include stub go files (6d725b1)
Add index to migration status (8c6ec27)
Add node_modules to format tasks (e5f6b36)
Add titles to identity schema (73c15d2)
Adopt to new go-swagger changes (5c45bd9)
Allow absolute file URLs as config values (#1069) (4bb4f67)
Allow hashtag in ui urls (#1040) (7591f07)
Avoid unicode-escaping ampersand in recovery URL query string (#1212) (d172368)
Bcrypt regression in credentials counting (23fc13b)
Broken make quickstart-dev task (#980) (999828a), closes #965
Broken make sdk task (#977) (5b01c7a), closes #950
Call contextualized test helpers (e1f3f78)
Code integer parsing bit size (#1178) (31e9632):
-
-In some cases we had a wrong bitsize of 64, while the var was later cast to int. Replaced with a bitsize of 0, which is the value to cast to int.
Contextualize identity persister (f8640c0)
Convert all identifiers to lower case on login (#815) (d64b575), closes #814
Courier adress (#1198) (ebe4e64), closes #1194
Courier message dequeue race condition (#1024) (5396a82), closes #652 #732:
-
-Fixes the courier message dequeuing race condition by modifying *sql.Persister.NextMessages(ctx context.Context, limit uint8) to retrieve only messages with status MessageStatusQueued and update the status of the retrieved messages to MessageStatusProcessing within a transaction. On message send failure, the message’s status is reset to MessageStatusQueued, so that the message can be dequeued in a subsequent NextMessages call. On message send success, the status is updated to MessageStatusSent (no change there).
Define credentials types as sql template and resolve crdb issue (a2d6eeb)
Dereference pointer types from new flow structures (#1019) (efedc92)
Do not include smtp in tracing (#1268) (bbfcbf9)
Do not publish version at public endpoint (3726ed4)
Do not reset registration method (554bb0b)
Do not return system errors for missing identifiers (1fcc855), closes #1286
Export mailhog dockertest runner (1384148)
Fix random delay norm distribution math (#1131) (bd9d28f)
Fork audit logger from root logger (68a09e7)
Gitlab oidc flow (#1159) (0bb3eb6), closes #1157
Give specific message instead of only 404 when method is disabled (#1025) (2f62041):
-
-Enabled strategies are not only used for handlers but also in other areas
-(e.g. populating the flow methods). So we should keep the logic to get
-enabled strategies and add new functions for getting all strategies.
Ignore unset domain aliases (ada6997)
Improve cli error output (43e9678)
Improve error stack trace (4351773)
Improve error tracing (#1005) (456fd25)
Improve test contextualization (2f92a70)
Initialize randomdelay with seeded source (9896289)
Insert credentials type constants as part of migrations (#865) (92b79b8), closes #861
Linking a connection may result in system error (#990) (be02a70), closes #694
Marking whoami auhorization parameter as ‘in header’ (#1244) (62d8b85), closes #1215
Move schema loaders to correct file (029781f)
Move to new transaction-safe migrations (#1063) (2588fb4):
-
-This patch introduces a new SQL transaction model for running SQL migrations. This fix is particularly targeted at CockroachDB which has limited support for mixing DDL and DML statements.
-
-Previously it could happen that migrations failure needed manual intervention. This has now been resolved. The new migration model is compatible with the old one and should work without a problem.
Pass down context to registry (0879446)
Re-enable SDK generation (1d5854d)
Record cypress runs (db35d8f)
Rehydrate settings form on successful submission (3457e1a), closes #1305
Remove absolete ‘make pack’ from Dockerfile (#1172) (b8eb908)
Remove continuity cookies on errors (85eea67)
Remove include stubs (1764e3a)
Remove obsolete clihelpers (230fd13)
Remove record from bash script (84a9315)
Remove stray non-ctx configs (#1053) (1fe137e)
Remove trailing double-dot from error (59581e3)
Remove unused sql migration (1445d1d)
Remove unused var (30a8cee)
Remove verify hook (98cfec6), closes #1302:
-
-The verify hook is automatically used when verification is enabled and has been removed as a configuration option.
Replace jwt module (#1254) (3803c8c), closes #1250
Resolve build and release issues (fb582aa)
Resolve clidoc issues (599e9f7)
Resolve compile issues (63063c1)
Resolve contextualized table issues (5a4f0d9)
Resolve crdb migration issue (9f6edfd)
Resolve double hook invokation for registration (032322c)
Resolve incorrect field types on oidc sign up completion (f88b6ab)
Resolve lint issues (0348825)
Resolve lint issues (75a995b)
Resolve linting issues and disable nancy (c8396f6)
Resolve mail queue issues (b968bc4)
Resolve merge regressions (9862ac7)
Resolve oidc e2e regressions (f28087a)
Resolve oidc regressions and e2e tests (f5091fa)
Resolve potential fsnotify leaks (3159c0a)
Resolve regressions and test failures (8bae356)
Resolve regressions in cookies and payloads (9e34bf2)
Resolve settings sudo regressions (4b611f3)
Resolve test regressions (e3fb028)
Resolve ui issues with nested form objects (8e744b9)
Resolve update regression (d0d661a)
Return delay instead of sleeping to improve tests (27b977e)
Revert generator changes (c18b97f)
Run correct error handler for registration hooks (0d80447)
Simplify data breaches password error reason (#1136) (33d29bf):
-
-This PR simplifies the error reason given when a password has appeared in data breaches to not include the actual number and rather just show “this password has appeared in data breaches and must not be used”.
Support form and json formats in decoder (d420fe6)
Update openapi definitions for signup (eb0b69d)
Update quickstart node image (c19b2f4):
-
-See https://github.com/ory/kratos/discussions/1301
cmd: Make HTTP calls resilient (e8ed61f)
hashing: Make bcrypt default hashing algorithm (04abe77)
Update to new goreleaser config (4c2a1b7)
Update to new healthx (6ec987a)
Use equalfold (1c0e52e)
Use new TB interface (d75a378)
Use numerical User ID instead of name to avoid k8s security warnings (#1151) (468a12e):
-
-Our docker image scanner does not allow running processes inside
-container using non-numeric User spec (to determine if we are trying
-to run docker image as root).
Use remote dependencies (1e56457)
-
-Code Generation:
-
-
-- Pin v0.6.0-alpha.1 release commit (507d13a)
-
-
-Code Refactoring:
-
-
-Adapt new sdk in testhelpers (6e15f6f)
Add nid everywhere (407fd95)
Contextualize everything (7ebc3a9):
-
-This patch contextualizes all configuration and DBAL models.
Do not use prefixed node names (fc42ece)
Improve Argon2 tooling (#961) (3151187), closes #955:
-
-This adds a load testing CLI that allows to adjust the hasher parameters under simulated load.
Move faker to exportable module (09f8ae5)
Move migratest helpers to ory/x (7eca67e)
Move password config to selfservice (cd0e0eb)
Move to go 1.16 embed (43c4a13):
-
-This patch replaces packr and pkged with the Go 1.16 embed feature.
Remove password node attribute prefix (e27fae4)
Remove profile node attribute prefix (a3ff6f7)
Rename config structs and interfaces (4a2f419)
Rename form to container (5da155a)
Replace flow’s forms with new ui node module (647eb1e)
Replace flow’s forms with new ui node module (f74a5c2)
Replace login flow methods with ui container (d4ca364)
Replace recovery flow methods with ui container (cac0456)
Replace registration flow methods with ui container (3f6388d)
Replace settings flow methods with ui container (0efd17e)
Replace verification flow methods with ui container (dbf2668)
Replace viper with koanf config management (5eb1bc0)
Update RegisterFakes calls (6268310)
Use underscore in webhook auth types (26829d2)
-
-Documentation:
-
-
-
-Features:
-
-
-Add email template specification in doc (#898) (4230d9e)
Add error for when no login strategy was found (6bae66c)
Add facebook provider to oidc providers and documentation (#1035) (905bb03), closes #1034
Add FAQ to docs (#1096) (9c6b68c)
Add gh login to claims (49deb2e)
Add login strategy text message (7468c83)
Add more tests for multi domain args (e99803b)
Add Prometheus monitoring to Public APIs (#1022) (75a4f1a)
Add random delay to login flow (#1088) (cb9894f), closes #832
Add return_url to verification flow (#1149) (bb99912), closes #1123 #1133
Add sql migrations for new login flow (e947edf)
Add sql tracing (3c4cc1c)
Add tracing to config schema (007dde4)
Add transporter with host modification (2c41b81)
Add workaround template for go openapi (5d72d10)
Adds slack sogial login (#974) (7c66053), closes #953
Allow session cookie name configuration (77ce316), closes #268
Allow specifying sender name in smtp.from_address (#1100) (5904fe3)
Bcrypt algorithm support (#1169) (b2612ee):
-
-This patch adds the ability to use BCrypt instead of Argon2id for password hashing. We recommend using BCrypt for web workloads where password hashing should take around 200ms. For workloads where login takes >= 2 seconds, we recommend to continue using Argon2id.
-
-To use bcrypt for password hashing, set your config as follows:
-
-hashers:
- bcrypt:
- cost: 12
- algorithm: bcrypt
-
-Switching the hashing algorithm will not break existing passwords!
-
-Co-authored-by: Patrik zepatrik@users.noreply.github.com
Check migrations in health check (c6ef7ad)
Configure domain alias as query param (9d8563e)
Contextualize configuration (d3d5327)
Contextualize health checks (8145a1c)
Contextualize http client in cli calls (3b3ef8f)
Contextualize persitence testers (6440373)
Courier foreground worker with “kratos courier watch” (#1062) (500b8ba), closes #1033 #1024:
-
-BREACKING CHANGES: This patch moves the courier watcher (responsible for sending mail) to its own foreground worker, which can be executed as a, for example, Kubernetes job.
-
-It is still possible to have the previous behaviour which would run the worker as a background task when running kratos serve by using the --watch-courier flag.
-
-To run the foreground worker, use kratos courier watch -c your/config.yaml.
Do not enforce bcrypt 12 for dev envs (bbf44d8)
Email input validation (#1287) (cd56b73), closes #1285
Export and add config options (4391fe5)
Expose courier worker (f50969e)
Expose crdb ui (504d518)
Global docs sidebar (#1258) (7108262)
Implement and test domain aliasing (1516a54):
-
-This patch adds a feature called domain aliasing. For more information, head over to https://www.ory.com/docs/kratos/guides/multi-domain-cookies
Improve oas spec and fix mobile tests (4ead2c8)
Improve sorting of ui fields (797b49d):
-
-See https://github.com/ory/kratos/discussions/1196
Include schema (348a493)
Make cli commands consumable in Ory Cloud (#926) (fed790b)
Migrate to openapi v3 (595224b)
Populate email templates at delivery time, add plaintext defaults (#1155) (7749c7a), closes #1065
Sort and label nodes with easy to use defaults (cbec27c):
-
-Ory Kratos takes a guess based on best practices for
-
-
-- ordering UI nodes (e.g. email, password, submit button)
-- grouping UI nodes (e.g. keep password and oidc nodes together)
-- labeling UI nodes (e.g. “Sign in with GitHub”)
-- using the “title” attribute from the identity schema to label trait fields
-
-
-This greatly simplifies front-end code on your end and makes it even easier to integrate with Ory Kratos! If you want a custom experience with e.g. translations or other things you can always adjust this in your UI integration!
Support base64 inline schemas (815a248)
Support contextual csrf cookies (957ef38)
Support domain aliasing in session cookie (0681c12)
Support label in oidc config (a99cdcd)
Support retryable CRDB transactions (f0c21d7)
Unix sockets support (#1255) (ad010de)
Web hooks support (recovery) (#1289) (3e181fe), closes #271:
-
-feat: web hooks for self-service flows
-
-This feature adds the ability to define web-hooks using a mixture of configuration and JsonNet. This allows integration with services like Mailchimp, Stripe, CRMs, and all other APIs that support REST requests. Additional to these new changes it is now possible to define hooks for verification and recovery as well!
-
-For more information, head over to the hooks documentation.
courier: Allow sending individual messages (cbb2c0b)
oidc: Support google hd claim (#1097) (1f20a5c)
schema: Add totp errors (a61f881)
-
-Tests:
-
-
-- Add case to ensure correct behavior when verifying a different email address (#999) (f95a117), closes #998
-- Add oasis test case (f80691b)
-- Bump poll interval (b3dc925)
-- Bump video quality (b7f8d04)
-- Bump wait times (b2e43f8)
-- Clean up hydra env before restart (cf49414)
-- Longer wait times (4bec9ef)
-- Reliable migration tests on crdb (2e3764b)
-- Remove old noop test (16dca3f)
-- Resolve compile issues (c1b5ba4)
-- Resolve flaky tests (cb670a8)
-- Resolve json parser test regression (a1b9b9a)
-- Resolve login integration regressions (388b5b2)
-- Resolve migration regression (2051a71)
-- Resolve more json parser test regressions (ff791c4)
-- Resolve regression (e2b0ad3)
-- Update schema tests for webhooks (d1ddfa8)
-- e2e: Significantly reduce wait and idle times (f525fc5)
-- Resolve more regressions (c5a23af)
-- Resolve order regression (40a849c)
-- Resolve regression (f0c9e5f)
-- Resolve regressions (4b9da3c)
-- Resolve stub regressions (82650cf)
-- Resolve test migrations (de0b65d)
-- Resolve test regression issues (ccf9fed)
-- Speed up tests (a16737c)
-- Update test description (55fb37f)
-- Use bcrypt cost 4 to reduce CI times (cabe97d)
-- Use fast bcrypt for e2e (d90cf13)
-
-
-Unclassified:
-
-
-
-Bug Fixes:
-
-
-CSRF token is required when using the Revoke Session API endpoint (#839) (d3218a0), closes #838
Incorrect home path (#848) (5265af0)
Make password policy configurable (#888) (7a00483), closes #450 #316:
-
-Allows configuring password breach thresholds and optionally enforces checks against the HIBP API.
Remove obsolete types (#887) (b8bac7a), closes #716
Set samesite attribute to lax if in dev mode (#824) (91d6698), closes #821
Use working cache-control header for cdn/proxies/cache (#869) (d8e3d40), closes #601
-
-Code Generation:
-
-
-- Pin v0.5.5-alpha.1 release commit (83aedcb)
-
-
-Documentation:
-
-
-
-Features:
-
-
-
-Tests:
-
-
-
-Unclassified:
-
-
-- docs: fix link and typo in Configuring Cookies (#883) (c51ed6b), closes #883
-
-
-Bug Fixes:
-
-
-
-Code Generation:
-
-
-- Pin v0.5.4-alpha.1 release commit (b02926c)
-
-
-Code Refactoring:
-
-
-- Move pkger and ioutil helpers to ory/x (60a0fc4)
-
-
-Documentation:
-
-
-
-Features:
-
-
-Add helper for choosing argon2 parameters (#803) (ca5a69b), closes #723 #572 #647:
-
-This patch adds the new command “hashers argon2 calibrate” which allows one to pick the desired hashing time for password hashing and then chooses the optimal parameters for the hardware the command is running on:
-
-$ kratos hashers argon2 calibrate 500ms
-Increasing memory to get over 500ms:
- took 2.846592732s in try 0
- took 6.006488824s in try 1
- took 4.42657975s with 4.00GB of memory
-[...]
-Decreasing iterations to get under 500ms:
- took 484.257775ms in try 0
- took 488.784192ms in try 1
- took 486.534204ms with 3 iterations
-Settled on 3 iterations.
-
-{
- "memory": 1048576,
- "iterations": 3,
- "parallelism": 32,
- "salt_length": 16,
- "key_length": 32
-}
-
-
-Bug Fixes:
-
-
-Add “x-session-token” to default allowed headers (3c912e4)
Do not set cookies on api endpoints (2f67c28)
Do not set csrf cookies on potential api endpoints (4d97a95)
Ignore unsupported migration dialects (12bb8d1), closes #778:
-
-Skips sqlite3 migrations when support is lacking.
Improve semver regex (584c0b5)
Properly set nosurf context even when ignored (0dcb774)
Update cypress (ba8b172)
Use correct regex for version replacement (ce870ab), closes #787
-
-Code Generation:
-
-
-- Pin v0.5.3-alpha.1 release commit (64dc91a)
-
-
-Documentation:
-
-
-
-Features:
-
-
-- Improve makefile install process and update deps (d1eb37f)
-
-
-Tests:
-
-
-- Add e2e tests for mobile (d481d51)
-- Add option to disable csrf protection in apis (a0077f1)
-- Bump wait time (7a719e1)
-- Install expo-cli globally (db21cfa)
-- Install expo-cli in cci config with sudo (d255f46)
-- Log wait-on output (62b5ba9)
-- Output web server address (cb41ca7)
-- Resolve csrf test issues in settings (ef8ba7d)
-- Resolve test panic (6f6461f)
-- Revert delay increase and improve install scripts (1eafcaa)
-
-
-Bug Fixes:
-
-
-- Add debug quickstart yml (#780) (16e6b4d)
-- Gracefully handle double slashes in URLs (aeb9414), closes #779
-- Merge gobuffalo CGO fix (fea2e77)
-- Remove obsolete recovery_token and add link to schema (acf6ac4)
-- Return correct error in login csrf (dd9cab0), closes #785
-- Use correct assert package (76be5b0)
-
-
-Code Generation:
-
-
-- Pin v0.5.2-alpha.1 release commit (79fcd8a)
-
-
-Documentation:
-
-
-- Small improvements to discord oidc provider guide (#783) (6a3c453)
-
-
-Tests:
-
-
-- Add tests for csrf behavior (48993e2), closes #785
-- Mark link as enabled in e2e test (c214b81)
-- Resolve schema test regression (bb7af1b)
-
-
-
-
- 
- 
- 
