Skip to main content

v26.3.14

v26.3.14​

One-time code sessions report the delivery channel​

Sessions created with a one-time code now record whether the code was sent by email or SMS. The code entry in authentication_methods carries a channel field set to email or sms, wherever the session is returned: /sessions/whoami, the admin session endpoints, and webhook payloads.

No other authentication method sets the field, so responses for password, social sign-in, and second-factor methods are unchanged.

Set the size limit for Jsonnet mapper input​

Ory Identities renders Jsonnet mappers — OIDC claims mappers, webhook bodies, courier templates — in a sandboxed worker process, and the input it sends that worker is limited to 1 MiB. A sign-in carrying a large context can exceed that limit, most often an OAuth2 or OIDC sign-in with many headers, many cookies, or a long return_to URL. That evaluation fails, and nothing else is affected.

The limit is now configurable. Set jsonnet.max_input_size to a byte count:

jsonnet:
  max_input_size: 4194304

or set the JSONNET_MAX_INPUT_SIZE environment variable to the same value. The default is unchanged at 1 MiB, so a deployment that sets nothing behaves as before. The largest accepted value is 4 MiB, which is the size the worker reads with.

Raise it only as far as you need. One worker serves every evaluation in the process and keeps enough memory to hold the largest input it has read.