🎉 Introducing our April release: Security center, identifier lockout (sentinel), CAPTCHA, magic link support, and explore more updates!
We have introduced a new"Security" page in the Logto console, which includes the following features:
Refer to documentation for more details.
As mentioned in the above "Security" update, you can now enable CAPTCHA bot protection for your sign-in experience with providers such as Google reCAPTCHA enterprise and Cloudflare Turnstile.
To enable CAPTCHA bot protection, you need to:
Then take a preview of your sign-in experience to see the CAPTCHA in action.
Refer to documentation for more details.
The identifier lockout has always been there protecting your Logto instance. However, previously it is hard-coded and not configurable. Now you can fully customize and override the default rules in the Security center.
This update includes the follow 3 parts:
A new API endpoint has been introduced to manually unblock a specified list of identifiers. This feature is useful for administrators to unlock users who have been temporarily locked out due to exceeding the maximum failed attempts.
Endpoint: POST /api/sentinel-activities/delete
This endpoint allows for the bulk deletion of all sentinel activities within an hour in the database based on the provided identifiers, effectively unblocking them.
Refer to documentation for details.
You can now use the "one-time token" to compose magic links, and send them to the end user's email.
With a magic link, one can register a new account or sign in directly to the application, without the need to enter a password, or input verification codes.
You can also use magic link to invite users to your organizations.
Request payload:
After you get the one-time token, you can compose a magic link and send it to the end user's email address. The magic link should at least contain the token and the user email as parameters, and should navigate to a landing page in your own application. E.g. https://yourapp.com/landing-page.
Here's a simple example of what the magic link may look like:
Refer to documentation for more details.
We've updated Node.js to v22 for better performance and security.
/assets