All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog and this project adheres to Semantic Versioning.
- Breaking Changes
- None
- Added
- None
- Fixed
- None
- Breaking Changes
- None
- Added
- Rubygems MFA requirement for authors added to gemspec.
- Fixed
- Breaking Changes
- None
- Added
- None
- Fixed
- Breaking Changes
- None
- Added
Authlogic::Session::Base.session_fixation_defense
- Reset the Rack session ID after authentication, to protect against Session Fixation attacks. (https://guides.rubyonrails.org/security.html#session-fixation) Default: true
- Fixed
- None
- Breaking Changes
- None
- Added
- #734 - Support for string cookies when using TestCase and friends
- Fixed
- None
- Breaking Changes
- None
- Added
- #733 - Rails 6.1 support
find_by_login_method
is deprecated in favor ofrecord_selection_method
, to avoid confusion with ActiveRecord's "Dynamic Finders".
- Fixed
- #726 - Thread
safety in
Authlogic::Session::Base.klass_name
- #726 - Thread
safety in
- Breaking Changes
- None
- Added
- #684 - Use cookies
only when available. Support for
ActionController::API
- #684 - Use cookies
only when available. Support for
- Fixed
- #725 -
NoMethodError
when settingsign_cookie
orencrypt_cookie
beforecontroller
is defined.
- #725 -
- Breaking Changes
- None
- Added
- Fixed
- None
-
Breaking Changes, Major
-
There is no longer a default
crypto_provider
. We still recommend SCrypt, but don't want users of other providers to be forced to install it. You must now explicitly specify yourcrypto_provider
, eg. in youruser.rb
.acts_as_authentic do |c| c.crypto_provider = ::Authlogic::CryptoProviders::SCrypt end
To continue to use the
scrypt
gem, add it to yourGemfile
.gem "scrypt", "~> 3.0"
-
-
Breaking Changes, Minor
- To set your crypto provider, you must use
crypto_provider=
, notcrypto_provider
. The arity of the later has changed from -1 (one optional arg) to 0 (no arguments).
- To set your crypto provider, you must use
-
Added
- #702 - The ability to specify "None" as a valid SameSite attribute
-
Fixed
-
Dependencies
- Drop support for ruby 2.3 (reached EOL on 2019-04-01)
See eg. the 5-1-stable
branch