github.com/keratin/authn-server

What's Changed

• fix: null OAuth email behavior by @diegosperes in #259

Full Changelog: v1.20.0...v1.20.1

Fixed

• Handle null values for oauth account email.

What's Changed

• Fix links in readme by @cornerman in #256
• Oauth unlink social accounts by @diegosperes in #253

Full Changelog: v1.19.0...v1.20.0

Added

• Public and private APIs for oauth account visibility and removal - requires migration to record user email on oauth accounts (#253)

What's Changed

• oauth: add sign-in with apple support (fixes #110) by @AlexCuse in #243

Full Changelog: v1.18.2...v1.19.0

Added

• Sign in with Apple oauth support

What's Changed

• Revert "oauth: get signing key from provider (#236)" by @AlexCuse in #250

Full Changelog: v1.18.1...v1.18.2

Fixed

• Remove incomplete "provider specific signing key" feature (#250)

What's Changed

• oauth: get signing key from provider by @AlexCuse in #236
• CI: update maintained actions to eliminate node warnings by @AlexCuse in #237
• chore: migrate deprecated ioutil usage to io package by @AlexCuse in #238
• chore: use github.com/go-jose/go-jose/v3 over deprecated square package by @AlexCuse in #240
• Remove duplicate print of PUBLIC_PORT by @cornerman in #242
• Bugfix: authn initiates user login upon connection attempt by @diegosperes in #246
• Bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3 by @dependabot in #244
• prepare 1.18.1 by @AlexCuse in #247

New Contributors

• @cornerman made their first contribution in #242
• @diegosperes made their first contribution in #246

Full Changelog: v1.18.0...v1.18.1

Fixed

• Disallow OAuth linking to an account other than current session's account (#246)
• Replace deprecated gopkg.in/square/go-jose.v2 with github.com/go-jose/go-jose/v3 (#240)

What's Changed

• feat: add support for TOTP multi-factor authentication by @AlexCuse in #220
• Bump golang.org/x/crypto from 0.0.0-20200622213623-75b288015ac9 to 0.1.0 by @dependabot in #228
• Bump github.com/prometheus/client_golang from 0.9.0-pre1 to 1.11.1 by @dependabot in #229
• admin: clear TOTP secret when expiring password by @AlexCuse in #231
• claims: add amr for authentication method by @AlexCuse in #230
• Bump golang.org/x/crypto from 0.1.0 to 0.17.0 by @dependabot in #233
• prepare 1.18.0 by @AlexCuse in #232

Full Changelog: v1.17.1...v1.18.0

Added

• Beta support for TOTP multi-factor authentication (#220, #230, #231)
• Bump prometheus client to 1.11.1 (#229)
• Bump golang.org/x/crypto to 0.17.0 (#233)

Added

• HMAC notification signatures (#207)
• support inferring default port from configured URL (via #214)
• fix unmarshaling bug in Microsoft OAuth Provider (via #214)

What's Changed

• session: add option to use explicit expiry for refresh token cookies by @AlexCuse in #208

Full Changelog: v1.16.0...v1.17.0

Added

• support for persistent cookies via REFRESH_TOKEN_EXPLICIT_EXPIRY env var [#208]

Added

• Usernames may not be passwords [#200]
• ID token contains Session ID claim (sid) [#205]

Added

• Usernames may not be passwords [#200]
• ID token contains Session ID claim (sid) [#205]

Added

• Added /jwks to both public and private routes [#198]

Added

• Added /jwks to both public and private routes [#198]

Added

• Added last_login_at and password_changed_at to Get Account API [#195]

Added

• Support for non-default Redis user [#191]
• Support for TLS connections to Redis with rediss [#190]

Added

• Update to go 1.17
• Flexible app domains with wildcard matching [#189]

Added

• Support for Redis Sentinel [#181]

Fixed

• Improved validation for AUTHN_URL and other ENV url values [#178]

Fixed

• Broken pipe error on Postgres [#174]

Fixed

• Usernames are now case insensitive on Postgres and SQLite. This requires a migration that can fail if the existing database has unintended duplicates! [#170]

Fixed

• CORS configuration allows content-type header

Fixed

• added a timeout to webhook sender

Added

• OAuth through Microsoft [#155]

Added

• endpoint for checking zxcvbn password score [#149]
• option to expire an account's sessions after a password change [#154]

Fixed

• improvements to constant time comparison in basic auth (thanks @lsmith130)

Added

• Support Content-Type: application/json [#143]
• Support for SameSite property on AuthN session cookie [#147]

Added

• OAuth authentication through Discord [#116]

Fixed

• Email validations no longer allow misplaced periods in the domain

Added

• Log when rejecting a request for a missing or invalid Origin header [#34]
• Accept PUT HTTP calls on every endpoint accepting PATCH [#104]

Changed

• Same-origin requests are now accepted (for browsers that do not send Origin header for same-origin), by falling back to Referer header to determine the application domain that should be selected in the request's context. The Referer header is only consulted when Origin is not set. Since browsers are only permitted to omit Origin header for same-origin requests this behavior should be robust. [#105]
• Query optimizations on private admin endpoints.
• Pre-compute JWK key on RSA key generation and include within private key wrapper type for use by dependees. [#100]

Fixed

• panic while evaluating some utf8 password characters
• zxcvbn library we use exhibited some deviation from standard (see: https://github.com/nbutton23/zxcvbn-go/issues/20) so switched to https://github.com/trustelem/zxcvbn [#99]

Added

• Passwordless Logins (aka Magic Links) [#71]
• New field: accounts.last_login_at [#71]
• Windows build

Changed

• Improved printing for configuration errors

Fixed

• Uncaught uniqueness violation in PATCH /account/:id

Fixed

• connection leak with Postgres adapter [#60]

Added

• OAuth authentication via Facebook, GitHub, and Google [#50]
• PostgreSQL support [#47]

Added

• Improved (simplified) coordination between multiple AuthN servers when synchronizing keys [#44]

Added

• ability to control location of sqlite3 database [#43]

Fixed

• aggressively short wlock timeout on blob store (could result in competing keys)

Added

• Log the actual client IP when deployed behind a proxy [#38]
• Bind a second port with only public routes [#37]

Added

• GET /accounts/:id endpoint [#30]
• Airbrake error reporting [#32]
• AuthN version number is now printed on startup

Fixed

• bug with account archival [#29]

Fixed

• Recovery of RSA keys from SQLite3 blob store when restarting AuthN

Added

• AuthN can run entirely from SQLite3 (without Redis)
• LogReporter prints more information to associate an error with a request

Fixed

• Inverted logic in GET /accounts/available