v1.5.0-rc1

no default cert headers

v1.4.9-rc2

support x509 distinguished name parsing

v1.4.9-rc1

support multiple cert headers

v1.4.8

Removed unsafe-inline scripts. If you previously customized the Headers__Security__ContentSecurity setting, now feel free to rely on the default which does not allow unsafe-inline scripts.

Fixed the password login failed attempt lockout to show immediately rather than on a subsequent attempt.

Better support for OAuth pass-through to OIDC.

v1.4.7

• Improves support for group email messages.
• Changes default ContentSecurity policy to include frame-ancestors.
• Allows configuration of auth cookie sliding behavior with Authorization__CookieSlidingExpiration and makes the default Authorization__CookieLifetimeMinutes explicit (600 minutes - 10 hours).
• Accommodates boolean claims in identity tokens.

Maintenance

Added setting for auth cookie lifetime: Authorization__CookieLifetimeMinutes = 0

Altered devimport endpoint to accept array of redirect-url strings.

Maintenance Release

Fixed checking of client secrets at token endpoints.

Configured a generic token issuer in development mode. This eases the hassle when developing with various local deployment scenarios.

Maintenance Release

Improves code verification when adding / changing an email username.

Maintenance Release

Updated dependencies and now allowing digits in account usernames.

Maintenance Release

This release fixes a couple of bugs and adds a setting.

• Fixed the seeding of identity resources for new databases.
• Fixed the generation of invite urls; now returns invite code and lets client construct url.
• Added setting Account__Registration__AutoUniqueUsernames = true; set to false if you don't want usernames to append unique tag. (Not recommended)