This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to master, this PR will be updated.
Releases
@logto/nuxt@1.0.0
Major Changes
5f4de8c: add support for secure cookie storage in Nuxt SDK and improve security handling
This is a breaking change that enhances security but requires manual configuration:
Introduce new cookieSecure configuration option to set whether Logto cookie should be secure
Remove automatic HTTPS detection based on Request URL and headers
No longer trust x-forwarded-proto or similar headers by default for security reasons
Previously, the SDK would automatically determine whether to use secure cookies based on the Request URL and headers. This automatic detection has been removed to prevent potential security vulnerabilities, especially in environments using reverse proxies or load balancers.
Now, users must explicitly configure the cookieSecure option based on their deployment environment. This change gives users more control and ensures that secure cookies are used only when explicitly configured.
It's strongly recommended to set cookieSecure to true when using HTTPS, especially in production environments.
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to master, this PR will be updated.
Releases
@logto/nuxt@1.0.0
Major Changes
5f4de8c: add support for secure cookie storage in Nuxt SDK and improve security handling
This is a breaking change that enhances security but requires manual configuration:
cookieSecureconfiguration option to set whether Logto cookie should be securex-forwarded-protoor similar headers by default for security reasonsPreviously, the SDK would automatically determine whether to use secure cookies based on the Request URL and headers. This automatic detection has been removed to prevent potential security vulnerabilities, especially in environments using reverse proxies or load balancers.
Now, users must explicitly configure the
cookieSecureoption based on their deployment environment. This change gives users more control and ensures that secure cookies are used only when explicitly configured.It's strongly recommended to set
cookieSecuretotruewhen using HTTPS, especially in production environments.Usage example:
Minor Changes
Patch Changes
@logto/browser@2.2.18
Patch Changes
@logto/capacitor@2.0.4
Patch Changes
@logto/chrome-extension@0.1.12
Patch Changes
@logto/client@2.8.1
Patch Changes
e92940f: add react-native package export condition
Enabling package export in react-native is unstable and can cause issues.
Replace the
exportsin@logto/clientpackage.json with thereact-nativecondition.So the
shim.jsmodule can be used in react-native projects, without enabling the unstable package export feature.@logto/express@2.3.16
Patch Changes
@logto/next@3.6.1
Patch Changes
@logto/node@2.5.7
Patch Changes
@logto/react@3.0.16
Patch Changes
@logto/remix@2.2.6
Patch Changes
@logto/sveltekit@0.3.6
Patch Changes
@logto/vue@2.2.17
Patch Changes
@logto/browser-sample@2.0.18
Patch Changes
@logto/express-sample@2.0.16
Patch Changes
@logto/next-app-dir-sample@2.1.20
Patch Changes
@logto/next-sample@2.1.20
Patch Changes
@logto/next-server-actions-sample@2.3.2
Patch Changes
@logto/react-sample@2.1.17
Patch Changes
@logto/vue-sample@2.1.16
Patch Changes