Skip to content

v1.0.12
Compare
Choose a tag to compare
@danschultzer danschultzer released this 16 Aug 15:03
v1.0.12
dc01a6d

Changes

  • Added API integration guide #247
  • Added :reset_password_token_store configuration setting #245
  • To prevent timing attacks, Pow.Ecto.Context.authenticate/2 now verifies password on a blank user struct when no user can be found for the provided user id, but will always return nil. The blank user struct has a nil :password_hash value. The struct will be passed along with a blank password to the verify_password/2 method in the user schema module. #239
  • To prevent timing attacks, when Pow.Ecto.Schema.Changeset.verify_password/3 receives a struct with a nil :password_hash value, it'll hash a blank password, but always return false. #239
  • To prevent timing attacks, the UUID is always generated in PowResetPassword.Plug.create_reset_token/2 whether the user exists or not. #239
  • PowPersistentSession.Plug.Base now accepts :persistent_session_ttl which will pass the TTL to the cache backend and used for the max age of the sesion cookie in PowPersistentSession.Plug.Cookie #236
  • Deprecated :persistent_session_cookie_max_age configuration setting #236
  • Pow.Store.Backend.MnesiaCache can now auto join clusters #233
  • Pow.Store.Backend.MnesiaCache.Unsplit module added for self-healing after network split #233
  • Removed :nodes config option for Pow.Store.Backend.MnesiaCache #233
Assets 2
Loading