Logto product updates for February 2023 (extended)
Notable updates include:
Let's take a look at what's inside!
Logto was using a single port to serve both normal users and admins, as well as the web console. While we continuously maintain a high level of security, it’ll still be great to decouple these components into two separate parts to keep data isolated and provide a flexible infrastructure.
From this version, Logto now listens to two ports by default, one for normal users (3001), and one for admins (3002).
http://localhost:3002/console.ADMIN_PORT. For instance, ADMIN_PORT=3456.ADMIN_ENDPOINT. For example, ADMIN_ENDPOINT=https://admin.your-domain.com.ADMIN_DISABLE_LOCALHOST=1 and leaving ADMIN_ENDPOINT unset.localhost and ENDPOINT from the environment.https://api.logto.io to https://default.logto.app/api.If you are upgrading from a previous version, simply run the database alteration command as usual, and we'll take care of the rest.
ADMIN_ENDPOINT is not specified, localhost:[admin-port] will be allowed to perform Cross-Origin Resource Sharing (CORS) in Logto.ADMIN_ENDPOINT is specified, only requests from the origin of ADMIN_ENDPOINT will be allowed.In previous versions, when registering or changing passwords, all new passwords were stored in plain text in the Audit Logs before being encrypted and inserted into the database.
In this version, we have updated the process to fully mask password fields before inserting them into the Audit Logs.
If you have any questions regarding this issue or the removal of data, please do not hesitate to contact us via email or Discord.
We have integrated the traditional input fields for username, phone number, and email into a single intelligent input box:
This advanced input box automatically identifies the type of characters you’re entering, such as an @ sign or consecutive numbers, and provides relevant error feedback.
By streamlining the sign-in process, users no longer need to waste time figuring out which button to click to switch their desired login method. This reduces the risk of errors and ensures a smoother sign-in experience.
We have put a lot of effort into improving the user sign-in experience and have provided a brand color option for the UI. However, we know that fine-tuning UI requirements can be unpredictable. While Logto is still exploring the best options for customization, we want to provide a programmatic method to unblock your development.
You can now use the Management API PATCH /api/sign-in-exp with body { "customCss": "arbitrary string" } to set customized CSS for the sign-in experience. You should see the value of customCss attached after <title> of the page. If the style has a higher priority, it should be able to override.
For instance, if you want to give your sign-in page a feel of the Night City, try this CSS:
"We have a city to burn!"
Logto now supports standard protocols (SAML, OIDC, and OAuth 2.0) for creating social connectors to integrate external identity providers. Each protocol can create multiple social connectors, giving you more control over your access needs.
Plus, we optimized the config interface for SAML connectors. Try it and let us know your feeling!
Added Russian translation. (credit @evist0)
Thank you!