Userfront Changelog

Septemer 2024

All-New Tenant Details

The new Tenant Details offers a clean, concise overview of your tenant's configuration and simplifies navigation through complex data like child tenants, end users with roles, and example JWTs. With its redesigned layout, you can easily create child tenants and focus on what's most important to you.

Read a JWT's Session Data

This new API endpoint accepts any JWT and returns the most recent session data, ideal for improved session synchronization and management. It provides valuable insights into user activity and authentication status, enabling more effective user management and troubleshooting. Developers can use this information to enhance security measures and improve  overall user experience. Learn more about this new endpoint here.

Wildcard Live Domains

Wildcard Live Domains now allow you to use a single domain for multiple subdomains or custom domains in your application. This feature simplifies the process of managing multiple environments or client-specific instances under one umbrella domain. With wildcard live domains, you can dynamically create and manage subdomains without the need for individual domain configurations, streamlining your development and deployment processes. Learn more about wildcard live domains in our docs.

Toolkit is now UI Toolkit

As part of our ongoing effort to make our offerings more accessible, we've renamed the Toolkit to UI Toolkit. Our ready-to-use forms can be added to any website in seconds and customized for login, sign up, and password reset functions. Configure, style and install your toolkit in the Userfront Dashboard.

WordPress Plugin v1.2.2

We're thrilled to announce exciting updates for our WordPress plugin! We've made the plugin settings more user-friendly with new, easy-to-understand descriptions. We've also introduced feature control, allowing you to enable or disable specific functions like login, signup, and password reset. The new Organization ID field now associates roles instead of the workspace. Additionally, you can enhance security by blocking access with the "Require a WordPress account" option. These improvements, along with many more, are included in our latest release. Check it out on GitHub!

August 2024

WordPress Plugin

WordPress admins no longer need to decide between dozens of sketchy or broken auth plugins. Userfront is now available for access and identity management with an all-new plugin. Version 1 is available on GitHub for WordPress v6.6 and later. Read the installation instructions for a step-by-step guide on using the plugin.

Vercel Integration and Next.js 14 Template

The Userfront integration is now live on the Vercel Marketplace! Deploy a Next.js web application with fully-fledged authentication on Vercel in seconds. Click the deploy button below to get started!

or learn more about the integration and template.

Spring Boot and GoLang Examples

Our community asked and we understood the assignment! There are 2 new examples for Spring Boot and GoLang with the Gin web framework. All of our examples are publicly available on GitHub. Contributions are always welcome.

Refreshed Docs Layout

We’ve entirely redesigned the navigation and landing page of the Userfront Docs. The new reorganized layout is designed to make it easier to see all of our most important offerings, find exactly what you’re looking for and peruse through our plethora of content. We’ve also reorganized our API docs to improve the grouping and nesting of the categories, for an overall smoother developer experience.

May 2024

Updates to tenant management

We’ve made tenant types easier to understand:

• Tenants with one user are now called Individual tenants
• Tenants that allow more than one user to have a role in their tenant are Organization tenants

• Enterprise tenants have their own custom authentication and can have their own administrator

Also:

• The tenant detail page now lists the creator of the tenant
• The tenant list page now lists the max number of tenants per type allowed for your subscription

Improved team member management

Adding and removing team members has been simplified and the seat management process improved.

‍

February 2024

Updated rate limit rules

Rate limiting for sending emails has been updated as follows:

• Email sending now has additional rate limiting based on the number of unused email links/codes sent recently.
• Confirmed users can now be excluded from daily rate limits.

‍

You can find complete guidance on rate limiting in the API docs

New & improved Users page

The Dashboard's Users page now includes:

• New user sorting and filtering functionality
• Users can be added with no roles - or multiple roles
• Users can be added without sending an invite email

‍

Configurable theming for Toolkit forms

Visit the Toolkit page in your Dashboard to customize the look & feel of your Toolkit forms

‍

January 2024

Delete Workspaces

You can now delete a workspace directly from the Dashboard

Fixed: reset emails without email link configured

Password reset email for new users now work as expected when email link is not configured as a first auth factor

Improved workspace and tenant management

The display of nested tenants has been improved to make tenant heierarchy clearer. Workspace UUIDs are also now displayed and searchable. See these updates now on the Tenants page.

New Toolkit release

The latest release of Toolkit resolves an issue where "oops, an unknown error occurred" was occasionally displayed. Read more in the complete release notes.

October 2023

New support for custom JWT payloads

You can now create a JWT access token with a custom payload in Userfront's API. Learn more in the API docs.

Rate limits on email

Rate limiting for sending emails has been updated as follows:

• emails are not sent in test mode. In live mode, emails to new & unverified users are limited to one email per day.
• Verified users may not be emailed more than once every 10 seconds.

‍

September 2023

New Toolkit 🎉

A milestone new release of Userfront's Toolkit makes it easier to add multi-factor authentication (MFA) to your website or mobile application. Read more about this Toolkit release here on the blog, or follow along with a hands-on tutorial here.

August 2023

New meta fields for user confirmation status

Confirmation status on users is now more granular with the addition of two fields:

• New fields: isEmailConfirmed and isPhoneNumberConfirmed
• Deprecated field: isConfirmed

‍

These fields are returned in every user record within your workspace or your workspace's tenants.

July 2023

Added the GET /self endpoint to allow a logged-in user to read detailed information about themself. See Read own user data.

Import users via API

You can now import existing users into your Userfront database in bulk via API.

Learn more about the new user import endpoints in the API reference.

June 2023

Add Okta SSO

Single Sign-On is now available for Okta on both web and mobile. You can configure Okta as an SSO provider directly in your Userfront dashboard.

October 2022

GET /self endpoint

{
 "mode": "live",
 "userId": 5,
 "tenantId": "demo1234",
 "email": "user@example.com",
 "name": "Jane Doe",
 "locked": false,
 "isConfirmed": true,
 "isMfaRequired": false,
 "data": {
   "custom": "data"
 },
 ...,
 "tenant": {
   "tenantId": "demo1234",
   "name": "Demo Workspace"
 },
 "authentication": {
   "firstFactors": [
     { "strategy": "password", "channel": "email" },
     { "strategy": "link", "channel": "email" }
   ],
   "secondFactors": [{ "strategy": "totp", "channel": "authenticator" }]
 },
 "authorization": {
   "demo1234": {
     "roles": []
   }
 }
}

Nested roles

It is now possible to use your workspace API key or JWT access token to manage roles for your nested tenants.

This means you can have a structure like the following:

• Your application (global)
  • Organization A
    • Team A1
    • Team A2
  • Organization B
    • Team B1
    • Team B2
      ‍

Each level can have its own roles, and each user can have roles at any level, or at multiple levels. For example, a user could be a viewer at the global application level, an editor in Organization A, an owner in Organization B, a viewer in Team B1, and so on.

You can manage roles for each user using the Roles API endpoints.

September 2022

New dashboard 🎉

The new Userfront dashboard is live, with many new features.

• New dashboard home page that includes insights and top users for your workspace, automatically calculated based on your application's activity.

‍

‍

• Insights page with additional insights.
• Security report with detailed information about all of your security settings, all in one place.
• MFA configuration page that allows you to configure which factors you want to use for MFA, and whether it should be required for all users.

‍

‍

The old dashboard will remain available at https://old.userfront.com through the end of 2022.

Tenant nesting

Now you can nest tenants an additional level, allowing you to create sub-organizations within your application.

• Your application
  • Organization A
    • Workspace A1
    • Workspace A2
  • Organization B
    • Workspace B1
    • Workspace B2
    • ‍

See the create child tenant endpoint to create a nested tenant. Once you have created a child tenant, the other existing endpoints work the same as for the parent tenant.

August 2022

Improved usage recording

Userfront now records all signup and login activities to help identify usage patterns and attempted unauthorized actions. These events and metrics will soon be available to view in the dashboard.

Improved usage reporting

Userfront now aggregates user activity into daily and monthly summaries for your workspace. This includes:

• Daily Active Users (DAU)
• Daily new users
• Monthly Active Users (MAU)
• Total users
• Top existing users
• Top new users
• Calendar heat maps for signups
• Calendar heat maps for activity

‍

This aggregate information will soon be available to view in the dashboard.

July 2022

Improved brute force security

All nonce-based security methods now have enhanced security, with brute-force detection and blocking built in.

By default, each link can only be guessed 10 times before the link credentials will be marked as invalid. Userfront also records these attempts, and in the future will notify you when they occur.

This change adds additional brute force security and monitoring to the following:

• Passwordless links
• Password reset links
• Verification codes
• SSO final step (Google, Facebook, Azure, Apple, etc.)
• SAML exchange
• MFA first factor token

‍

authentication object included in API response

For user CRUD operations, Userfront now returns a list of authentication methods that are valid for the user:

{
 "authentication": {
   "firstFactors": [
     { "strategy": "password", "channel": "email" },
     { "strategy": "google", "channel": "email" }
   ],
   "secondFactors": [{ "strategy": "totp", "channel": "authenticator" }]
 }
}

June 2022

Verification code and TOTP authenticator

It's now possible to login with 2 more approaches:

• Login or signup via a single-use verification code sent either by email or SMS
  • Sign up with verification code
  • Log in with verification code
    ‍

• Login with a TOTP app such as Google Authenticator or Authy
  • Set up TOTP authenticator
  • Log in with TOTP authenticator
    ‍

signup({ method: "verificationCode" }) and login({ method: "verificationCode" })

Accompanying the verification code approaches above, the signup() and login() methods for Core JS now support the verificationCode method.

login({ method: "totp" })

Accompanying the TOTP authenticator code approach above, the login() method for Core JS now supports the totp method.

sendVerificationCode()

Added the sendVerificationCode() method to Core JS. This method allows a user to request an email or SMS with a single-use verification code. The verification code can be used with login({ method: "verificationCode" }) mentioned above.

updatePassword() method

Added the updatePassword() method to Core JS. This method supersedes the resetPassword() method, which is now an alias, and allows for updating a user's password with their reset link credentials or while the user is logged in.

May 2022

Add Apple SSO

Single Sign-On is now available for Apple on both web and mobile. For mobile applications it satisfies Apple's requirement to include Apple as an SSO option whenever any other providers are included.

Add Azure single-tenant SSO

Users can now sign in via Oauth 2.0 using Azure with single tenant. Previously, this was only possible for multi-tenant Azure instances.

Password update endpoint for logged in users

Added an API endpoint for Update own password that allows a user to update their own password when logged in. If the user does not have a password yet (e.g. if they signed in with SSO), this endpoint creates their password.

Tenant search endpoint

Added an API endpoint for Search tenants that allows searching for tenants by name, custom data attributes, and/or tenantId.

Phone number verification

Added an API endpoint for Verify a phone number that allows a user to send a 6-digit verification code by SMS to the given phone number and then enter that 6-digit verification code to verify the phone number. Once a phone number is verified, it can be used for login or multi-factor authentication.

Email 6-digit verification codes

Added the ability to log in by receiving a 6-digit verification code by email. Users can receive their code and submit it to the verification code login endpoint to log in.

April 2022

Authenticator app Multi-Factor Authentication (alpha)

Multi-factor authentication (MFA) via TOTP (Time-based One-Time Password) / authenticator app is now available in alpha. This allows for MFA flows that use Google Authenticator, Authy, and other TOTP code-generating applications.

This feature is in closed alpha and will be in beta shortly, followed by general release.

As with SMS MFA, we will release SDK methods and integrate MFA into the toolkit in the coming weeks.

Disable all Userfront emails

You can now disable all emails from Userfront, ensuring that there are no triggers that will generate an automated email from Userfront to your users. This feature will be added to the dashboard soon, and in the meantime you can contact us to set up this feature.

Support for x-origin header

Previously, when making client-to-server requests from a mobile application or backend server in live mode, the request could include the x-application-id header in place of the origin header (which the browser sends). Now the request can additionally include either the x-origin header or the x-application-id header.

The chosen header should correspond to a live mode domain in order for the request to be considered live mode. For example:

{
 "headers": {
   "x-origin": "https://livedomain.com"
 }
}

Login option: noResetEmail

The default behavior on Userfront is that when a user attempts to log in with a password but does not yet have a password set, Userfront sends the user a password reset email. This can happen with users who have previously signed in with SSO, for example.

With the the included noResetEmail: true flag, Userfront does not send the user a password reset email if they do not already have a password, and instead returns an error message.

March 2022

SMS Multi-Factor Authentication (beta)

Multi-factor authentication (MFA) is officially live through the use of security codes sent by SMS.

• API endpoints

We will release SDK methods and integrate MFA into the toolkit as well in the coming weeks.

Authenticator MFA is next.

Improved rate limiting

We improved our internal rate limiting infrastructure to further prevent unwanted access attempts and to harden the service overall.

Custom cookie attributes (beta)

Browser storage for JWT access tokens is now customizable. See the MDN docs for more information about cookie attributes.