Logto v1.34 is here. This release introduces isolated cross-app authentication, a new Identifier.Lockout webhook event, and fixes to ensure refresh tokens correctly honor the full 180-day TTL.
_interaction cookies.Identifier.Lockout: A new webhook event Identifier.Lockout is introduced, triggered when a user is locked out after repeated failed sign-in attempts.Multiple applications can now initiate authentication in the same browser session without affecting each other.
_interaction cookie now stores a structured mapping { [appId]: [interactionId] }.appId is propagated via URL parameters or headers to maintain isolation.New webhook event: Identifier.Lockout
Addressed an issue where refresh tokens expired after 14 days due to an internal provider grant TTL cap.
Fixed a bug where the system incorrectly switched to MFA binding templates during multi-step sign-up flows.
SSO connector domain matching is now case-insensitive, improving reliability during sign-in flows.