|
1 | 1 | # Change Log
|
2 | 2 |
|
| 3 | +## 1.26.0 |
| 4 | + |
| 5 | +### Minor Changes |
| 6 | + |
| 7 | +- 3594e1316: refactor: switch to `@logto/experience` package with latest [Experience API](https://openapi.logto.io/group/endpoint-experience) |
| 8 | + |
| 9 | + In this release, we have transitioned the user sign-in experience from the legacy `@logto/experience-legacy` package to the latest `@logto/experience` package. This change fully adopts our new [Experience API](https://openapi.logto.io/group/endpoint-experience), enhancing the underlying architecture while maintaining the same user experience. |
| 10 | + |
| 11 | + - Package update: The user sign-in experience now utilizes the `@logto/experience` package by default. |
| 12 | + API Transition: The new package leverages our latest [Experience API](https://openapi.logto.io/group/endpoint-experience). |
| 13 | + - No feature changes: Users will notice no changes in functionality or experience compared to the previous implementation. |
| 14 | + |
| 15 | +### Patch Changes |
| 16 | + |
| 17 | +- 7b342f7ef: remove `client_id` from OIDC SSO connector's token request body for better compatibility |
| 18 | + |
| 19 | + This updates addresses an issue with client authentication methods in the token request process. Previously, the `client_id` was included in the request body while also using the authentication header for client credentials authentication. |
| 20 | + |
| 21 | + This dual method of client authentication can lead to errors with certain OIDC providers, such as Okta, which only support one authentication method at a time. |
| 22 | + |
| 23 | + ### Key changes |
| 24 | + |
| 25 | + Removal of `client_id` from request body: The `client_id` parameter has been removed from the token request body. According to the [OAuth 2.0 specification](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3), `client_id` in the body is required only for public clients. |
| 26 | + |
| 27 | +- eb802f4c4: remove multiple sign-in experience settings restrictions |
| 28 | + |
| 29 | + For better customization flexibility, we have removed following restrictions in the sign-in experience "sign-in and sign-up" settings: |
| 30 | + |
| 31 | + 1. The `password` field in sign-up settings is no longer required when username is set as the sign-up identifier. Developers may request a username without requiring a password during the sign-up process. |
| 32 | + |
| 33 | + Note: If username is the only sign-up identifier, users without a password will not be able to sign in. Developers or administrators should carefully configure the sign-up and sign-in settings to ensure a smooth user experience. |
| 34 | + |
| 35 | + Users can still set password via [account API](https://docs.logto.io/end-user-flows/account-settings/by-account-api) after sign-up. |
| 36 | + |
| 37 | + 2. The requirement that all sign-up identifiers must also be enabled as sign-in identifiers has been removed. |
| 38 | + |
| 39 | +- Updated dependencies [dc13cc73d] |
| 40 | +- Updated dependencies [5da01bc47] |
| 41 | + - @logto/console@1.23.0 |
| 42 | + - @logto/language-kit@1.1.3 |
| 43 | + - @logto/schemas@1.26.0 |
| 44 | + - @logto/cli@1.26.0 |
| 45 | + |
3 | 46 | ## 1.25.0
|
4 | 47 |
|
5 | 48 | ### Minor Changes
|
|
0 commit comments