v26.4.0
v26.4.0
Fix native app SAML sign-in for first-time users
Native apps using SAML with the session token exchange now receive their return_to redirect when a user signs in for the first
time.
Previously, only users who already had a SAML credential were redirected back to the app's return_to URL with the exchange code.
When SAML sign-in created a new identity, Ory instead returned a 200 OK JSON response containing the session token. The app
never received its callback and could not complete the token exchange, so every user's first SAML sign-in failed while later
sign-ins worked.
This also stops the session token from being rendered in the browser on that response.
Restrict origins to session checks, FedCM, and logout
The new security.restricted_origins setting lists origins for pages that load scripts you don't control, such as ads, but need
to know whether the user is signed in.
Requests from a restricted origin can only call /sessions/whoami, the FedCM endpoints, and the logout endpoints. All other
public endpoints respond with 403 Forbidden. Responses never contain identity data: a session contains only its ID and whether
it's active, and tokenize_as fails with 400 Bad Request. The restrictions also apply while CORS is disabled. Keep the origin
in serve.public.cors.allowed_origins so that the browser can read the responses. Requests without an Origin header are
unchanged.
Size limits for remote files and upstream responses
Ory now rejects files loaded from a URL (http://, https://, file://, or base64://) and upstream responses that exceed a
size limit, instead of reading them in full. If a fetch exceeds its limit, the operation fails. Ory Kratos also logs a warning
that names the source and the limit.
| Source | Limit |
|---|---|
| Ory Kratos: Jsonnet templates and claims mappers loaded from a URL (webhooks, courier, OpenID Connect, SCIM, session tokenizer) | 1 MiB |
| Ory Kratos: token and user info responses from social sign-in providers | 1 MiB |
| Ory Talos: JSON Web Key Sets loaded from a URL | 1 MiB |
| Any other file loaded from a URL, such as courier templates or Ory Permission Language files in Ory Keto | 5 MiB |
If you expect to use a file larger than these limits, reduce its size before upgrading.