github.com/ory/kratos

autogen: pin v0.8.3-alpha.1.pre.0 release commit

Breaking Changes

This patch removes the ability to use domain aliases, an obscure feature rarely used that had several issues and inconsistencies.

Bug Fixes

• Add identity_id index to identity_verifiable_addresses table (#2147) (86fd942):

  The verifiable addresses are loaded eagerly into the identity. When that happens, the identity_verifiable_addresses table is queried by nid and identity_id. This index should greatly improve performance, especially of the /sessions/whoami endpoint.

• Add ability to resume continuity sessions from several cookies (#2131) (8b87bdb), closes #2016 #1786

• Add hiring notice to README (#2074) (0c1e816)

• Add missing version tag in quickstart.yml (#2110) (1d281ea)

• Adjust scan configuration (#2140) (8506fcf), closes #2083

• Admin endpoint /schemas not redirecting to public endpoint (#2133) (413833f), closes #2084

• Choose correct CSRF cookie when multiple are set (633076b), closes ory/kratos#2121 ory-corp/cloud#1786:

  Resolves an issue where, when multiple CSRF cookies are set, a random one would be used to verify the CSRF token. Now, regardless of how many conflicting CSRF cookies exist, if one of them is valid, the request will pass and clean up the cookie store.

• continuity: Properly reset cookies that became invalid (8e4b4fb), closes #2121 ory-corp/cloud#1786:

  Resolves several reports related to incorrect handling of invalid continuity issues.

• continuity: Remove cookie on any error (428ac03)

• Do not send session after registration without hook (#2094) (3044229), closes #2093

• Docker-compose standalone definition (3c7065a)

• Explain mitigations in cookie error messages (ef4b01a)

• Expose network wrapper (a570607)

• Faq (#2101) (311f906):

  This patch

  • moves the FAQ to the Debug & Help section
  • renames it to Tips & Troubleshooting
  • moves many of the questions to documents where they fit better, reformatted and with added information where needed.
  • also some other spelling/format fixes

  See also https://github.com/ory/docusaurus-template/pull/87

• Ignore whitespace around identifier with password strategy (#2160) (45335c5), closes #2158

• Improve courier test signature (b8888e3)

• Include missing type string in config schema (#2142) (ec2c88a):

  Inside the config.schema.json under the CORS setting, add the missing type (string) for the items of the allowed_origins array

• login: Error handling when failed to prepare for an expired flow (#2120) (fdad834)

• Minor fixes in FAQ update (#2130) (b53eec7)

• Quickstart standalone service definition (#2149) (872b06e)

• Resolve configx regression (672c0ff)

• selfservice: Recovery self service flow passes on return_to URL (#1920) (b925d35), closes #914

• Send 404 instead of null response for unknown verification flows (#2102) (c9490c8), closes #2099:

  Fixes the verification handler to write the error, instead of nil object, when the flow does not exist. Adds tests for every handler to check proper behavior in that regard.

• Support setting complex configs from the environment (c45bf83):

  Closes https://github.com/ory/kratos/issues/1535 Closes https://github.com/ory/kratos/issues/1792 Closes https://github.com/ory/kratos/issues/1801

• Update download urls according to the new names (#2078) (86ae016)

Code Generation

• Pin v0.8.3-alpha.1.pre.0 release commit (b1f1da2)

Code Refactoring

• Deprecate domain aliases (894a2cc)

Documentation

• Fix incorrect port (c9a3587), closes #2095

• Fix link (c245ed4):

  Closes https://github.com/ory/kratos-selfservice-ui-node/issues/164

• Ory cloud mentions + spelling (#2100) (0c2fa5b)

• Pagination (#2143) (0807a03), closes #2039

• Typo (#2073) (e1a54f9)

• Typo (#2114) (a7a16d7)

• Update docker guide (072ca4d), closes #2086

• Upgrade guide (#2132) (4a4ab05):

  Closes https://github.com/ory/kratos/discussions/2104

Features

• Add preset CSP nonce (#2096) (8913292):

  Closes https://github.com/ory/kratos-selfservice-ui-node/issues/162

• Added phone number identifier (#1938) (294dfa8), closes #137

• Allow registration to be disabled (#2081) (864b00d), closes #882

• Courier templates fs support (#2164) (13689a7)

• courier: Override default link base URL (cc99096):

  Added a new configuration value selfservice.methods.link.config.base_url which allows to change the default base URL of recovery and verification links. This is useful when the email should send a link which does not match the globally configured base URL.

  See https://github.com/ory-corp/cloud/issues/1766

• docker: Add jaeger (27ec2b7)

• Enable Buildkit (#2079) (f40df5c):

  Looks like this was attempted before but the magic comment was not on the first line.

• Expose courier template load (#2082) (790716e)

• Generalise courier tests (#2125) (75c6053)

• Make the password policy more configurable (#2118) (70c627b), closes #970

• security: Add option to disallow private IP ranges in webhooks (05f1e5a), closes #2152

• Selfservice and administrative session management (#2011) (0fe4155), closes #655 #2007

Tests

• Update cypress (#2090) (883a1b1)