While Logto Cloud is still under construction, we would like to introduce some new features to our foundation, Logto OSS. This will be the last version before general availability.
Notable updates include:
- Refactored infrastructure and enhanced security
- Smart Input and Customize CSS added to Sign-in Experience
- Open standard connectors (SAML, OIDC, and OAuth 2.0)
- New language support
Let's take a look at what's inside!
π₯ BREAKING CHANGES π₯β
Decouple normal users and adminsβ
Logto was using a single port to serve both normal users and admins, as well as the web console. While we continuously maintain a high level of security, itβll still be great to decouple these components into two separate parts to keep data isolated and provide a flexible infrastructure.
From this version, Logto now listens to two ports by default, one for normal users (3001
), and one for admins (3002
).
βΌοΈ Click to expand details
- Nothing changed for normal users. No adaption is needed.
- For admin users:
- The default Admin Console URL has been changed to
http://localhost:3002/console
. - To change the admin port, set the environment variable
ADMIN_PORT
. For instance,ADMIN_PORT=3456
. - You can specify a custom endpoint for admins by setting the environment variable
ADMIN_ENDPOINT
. For example,ADMIN_ENDPOINT=https://admin.your-domain.com
. - You can now completely disable admin endpoints by setting
ADMIN_DISABLE_LOCALHOST=1
and leavingADMIN_ENDPOINT
unset. - Admin Console and admin user data are not accessible via normal user endpoints, including
localhost
andENDPOINT
from the environment. - Admin Console no longer displays audit logs of admin users. However, these logs still exist in the database, and Logto still inserts admin user logs. There is just no convenient interface to inspect them.
- Due to the data isolation, the numbers on the dashboard may slightly decrease (admins are excluded).
- The default Admin Console URL has been changed to
- Resource Indicator for Logto Management API changed from
https://[your-tenant-id].logto.app/api
tohttps://default.logto.app/api
.
If you are upgrading from a previous version, simply run the database alteration command as usual, and we'll take care of the rest.
Under the hood, we use the powerful Postgres feature Row-Level Security to isolate admin and user data.
CORS policyβ
- If
ADMIN_ENDPOINT
is not specified,localhost:[admin-port]
will be allowed to perform Cross-Origin Resource Sharing (CORS) in Logto. - If
ADMIN_ENDPOINT
is specified, only requests from the origin ofADMIN_ENDPOINT
will be allowed.