English

release

Logto 2023 February update (extended)

Logto product updates for February 2023 (extended)

Gao

Founder

2/26/20234 min read

Stop wasting weeks on user auth

Launch secure apps faster with Logto. Integrate user auth in minutes, and focus on your core product.

Get started

Notable updates include:

Refactored infrastructure and enhanced security
Smart Input and Customize CSS added to Sign-in Experience
Open standard connectors (SAML, OIDC, and OAuth 2.0)
New language support

Let's take a look at what's inside!

💥 BREAKING CHANGES 💥

Decouple normal users and admins

Logto was using a single port to serve both normal users and admins, as well as the web console. While we continuously maintain a high level of security, it’ll still be great to decouple these components into two separate parts to keep data isolated and provide a flexible infrastructure.

From this version, Logto now listens to two ports by default, one for normal users (3001), and one for admins (3002).

‼️ Click to expand details

Nothing changed for normal users. No adaption is needed.
For admin users:
- The default Admin Console URL has been changed to http://localhost:3002/console.
- To change the admin port, set the environment variable ADMIN_PORT. For instance, ADMIN_PORT=3456.
- You can specify a custom endpoint for admins by setting the environment variable ADMIN_ENDPOINT. For example, ADMIN_ENDPOINT=https://admin.your-domain.com.
- You can now completely disable admin endpoints by setting ADMIN_DISABLE_LOCALHOST=1 and leaving ADMIN_ENDPOINT unset.
- Admin Console and admin user data are not accessible via normal user endpoints, including localhost and ENDPOINT from the environment.
- Admin Console no longer displays audit logs of admin users. However, these logs still exist in the database, and Logto still inserts admin user logs. There is just no convenient interface to inspect them.
- Due to the data isolation, the numbers on the dashboard may slightly decrease (admins are excluded).
Resource Indicator for Logto Management API changed from https://api.logto.io to https://default.logto.app/api.

If you are upgrading from a previous version, simply run the database alteration command as usual, and we'll take care of the rest.

CORS policy

If ADMIN_ENDPOINT is not specified, localhost:[admin-port] will be allowed to perform Cross-Origin Resource Sharing (CORS) in Logto.
If ADMIN_ENDPOINT is specified, only requests from the origin of ADMIN_ENDPOINT will be allowed.

🔐 Security update

In previous versions, when registering or changing passwords, all new passwords were stored in plain text in the Audit Logs before being encrypted and inserted into the database.

In this version, we have updated the process to fully mask password fields before inserting them into the Audit Logs.

If you have any questions regarding this issue or the removal of data, please do not hesitate to contact us via email or Discord.

🧑‍🚀 Feature update

We have integrated the traditional input fields for username, phone number, and email into a single intelligent input box:

This advanced input box automatically identifies the type of characters you’re entering, such as an @ sign or consecutive numbers, and provides relevant error feedback.

By streamlining the sign-in process, users no longer need to waste time figuring out which button to click to switch their desired login method. This reduces the risk of errors and ensures a smoother sign-in experience.

We have put a lot of effort into improving the user sign-in experience and have provided a brand color option for the UI. However, we know that fine-tuning UI requirements can be unpredictable. While Logto is still exploring the best options for customization, we want to provide a programmatic method to unblock your development.

You can now use the Management API PATCH /api/sign-in-exp with body { "customCss": "arbitrary string" } to set customized CSS for the sign-in experience. You should see the value of customCss attached after <title> of the page. If the style has a higher priority, it should be able to override.

For instance, if you want to give your sign-in page a feel of the Night City, try this CSS:

Click to expand CSS and preview

custom-css-preview

"We have a city to burn!"

🔗 Open standard connectors with better config interface

Logto now supports standard protocols (SAML, OIDC, and OAuth 2.0) for creating social connectors to integrate external identity providers. Each protocol can create multiple social connectors, giving you more control over your access needs.

Plus, we optimized the config interface for SAML connectors. Try it and let us know your feeling!

📄 New language

Added Russian translation. (credit @evist0)

🎉 New Contributors

@Alanimdeo made their first contribution in #3064
@gadkins made their first contribution in #3032
@evist0 made their first contribution in #3158
@muratgozel made their first contribution in #3203

Thank you!

💥 BREAKING CHANGES 💥#

Decouple normal users and admins#

CORS policy#

🔐 Security update#

🧑‍🚀 Feature update#

💡 Smart Input for Sign-in Experience#

🎨 Customize CSS in Sign-in Experience#

🔗 Open standard connectors with better config interface#

📄 New language#

🎉 New Contributors#