The use of JWT authentication for the `/api/user` API is being deprecated. This functionality will be removed in a future release.
@@ -2384,4 +2506,3 @@ The `/` path of FusionAuth no longer automatically forwards to the admin login.
### Client libraries
* Enhancements to the .NET Core client library to better support requests in a multi-tenant environment and to use the `IDictionary` reference instead of `Dictionary`.
* Resolves [GitHub Issue #1049](https://github.com/FusionAuth/fusionauth-issues/issues/1049) and [GitHub Issue #1050](https://github.com/FusionAuth/fusionauth-issues/issues/1050), thanks to [@atrauzzi](https://github.com/atrauzzi) for sharing his .NET Core expertise!
-
diff --git a/astro/src/content/json/exampleapps.json b/astro/src/content/json/exampleapps.json
index 0eade9997d..536279ce77 100644
--- a/astro/src/content/json/exampleapps.json
+++ b/astro/src/content/json/exampleapps.json
@@ -574,5 +574,11 @@
"name": "AWS CloudFront redirect to URL",
"description": "This example documents how to use a AWS CloudFront Function to redirect to country-specific URLs, such as a FusionAuth instance.",
"language": "javascript"
+ },
+ {
+ "url": "https://github.com/FusionAuth/fusionauth-example-ruby-on-rails-custom-scopes",
+ "name": "Ruby on Rails with Custom Scopes",
+ "description": "This example application shows how to implement Custom Scopes with FusionAuth.",
+ "language": "ruby"
}
]
diff --git a/astro/src/content/json/features.json b/astro/src/content/json/features.json
index 75b8054106..4e643f655e 100644
--- a/astro/src/content/json/features.json
+++ b/astro/src/content/json/features.json
@@ -6,7 +6,7 @@
},
{
"displayName": "Advanced and Gaming Identity Providers",
- "edition": "advanced",
+ "edition": "premium",
"link": "/docs/lifecycle/authenticate-users/identity-providers/"
},
{
@@ -71,7 +71,7 @@
},
{
"displayName": "WebAuthn",
- "edition": "advanced",
+ "edition": "licensed",
"link": "/docs/lifecycle/authenticate-users/passwordless/webauthn"
},
{
diff --git a/astro/src/content/quickstarts/5-minute-sandbox.mdx b/astro/src/content/quickstarts/5-minute-sandbox.mdx
index a10992f8c7..5af28b56b5 100644
--- a/astro/src/content/quickstarts/5-minute-sandbox.mdx
+++ b/astro/src/content/quickstarts/5-minute-sandbox.mdx
@@ -78,11 +78,11 @@ After doing so you'll arrive at the sandbox dashboard.
## 3. Grant Permissions
-
+
## 4. Configure the Backend to Complete the Login
-
+
## 5. Store the User Object In The Session
diff --git a/astro/src/content/quickstarts/_5-minute-application-setup.mdx b/astro/src/content/quickstarts/_5-minute-application-setup.mdx
index 9b942630d9..2ac0f2e878 100644
--- a/astro/src/content/quickstarts/_5-minute-application-setup.mdx
+++ b/astro/src/content/quickstarts/_5-minute-application-setup.mdx
@@ -1,7 +1,7 @@
import InlineField from 'src/components/InlineField.astro';
import InlineUIElement from 'src/components/InlineUIElement.astro';
-Once you arrive in the FusionAuth admin UI, the first thing you need to do is create an Application. An Application is something that a user can log into. This is the application you are building or that you are migrating to use FusionAuth. Click the Application menu option on the left side of the page or the Setup button in the box at the top of the page.
+Once you arrive in the FusionAuth admin UI, the first thing you need to do is create an Application. An Application is something that a user can log into. This is the application you are building or that you are migrating to use FusionAuth. Click the Applications menu option on the left side of the page.
@@ -9,9 +9,10 @@ This will take you to the listing page for Applications. Next, you'll click the
-On the Application form, provide a name for your Application (this is only used for display purposes) and a couple of items on the OAuth tab. Start with a simple setup that allows existing users to log into your application. There is no need to add any roles or registration configuration.
+On the Application form, provide a name for your Application (this is only used for display purposes).
+Click on the OAuth tab.
-When you click on the OAuth tab, you'll see this form.
+When you click on the OAuth tab, you'll see this form. Start with a simple setup that allows existing users to log into your application. There is no need to add any roles or registration configuration.
@@ -22,7 +23,7 @@ Most of the defaults will work, but provide the following items.
* Make sure the Authorization Code grant is selected in the Enabled Grants.
* Set the Require registration field to `true`.
-Once you have configured the application, you'll click the blue Save button at the top of the page.
+Once you have configured the application, you'll click the blue Save button (disk) at the top of the page.
diff --git a/astro/src/content/quickstarts/_5-minute-register-user.mdx b/astro/src/content/quickstarts/_5-minute-register-user.mdx
index 4bb4df067c..441b727900 100644
--- a/astro/src/content/quickstarts/_5-minute-register-user.mdx
+++ b/astro/src/content/quickstarts/_5-minute-register-user.mdx
@@ -2,7 +2,15 @@ import Aside from 'src/components/Aside.astro';
import InlineUIElement from 'src/components/InlineUIElement.astro';
import Breadcrumb from 'src/components/Breadcrumb.astro';
-Next, grant the user you created in the Setup Wizard permissions to log into your new Application. This can be done from the User management section of the FusionAuth admin UI. Click the Users link in the navigation. If needed, search for the user.
+{ props.installmethod === 'sandbox' &&
+ Next, grant the sandbox@fusionauth.io user permissions to log into your new Application.
+}
+
+{ props.installmethod !== 'sandbox' &&
+ Next, grant the user you created in the Setup Wizard permissions to log into your new Application.
+}
+
+ This can be done from the User management section of the FusionAuth admin UI. Click the Users link in the navigation. If needed, search for the user.
Manage the user's details by clicking on the black Manage button.
@@ -24,4 +32,4 @@ FusionAuth supports self-service registration. With self-service registration en
You want to make sure your user account has a first name, which should appear under the picture.
-If they don't, use the Edit Profile button in the upper right hand corner of the user details screen to edit the account and give them one. The first name is how they'll be greeted in the application.
+If they don't, use the Edit User button in the upper right hand corner of the user details screen to edit the account and give them one. The first name is how they'll be greeted in the application.
diff --git a/.github/known-blog-categories.txt b/config/contentcheck/known-blog-categories.txt
similarity index 100%
rename from .github/known-blog-categories.txt
rename to config/contentcheck/known-blog-categories.txt
diff --git a/.github/linkcheck-skip.txt b/config/linkcheck/linkcheck-skip.txt
similarity index 100%
rename from .github/linkcheck-skip.txt
rename to config/linkcheck/linkcheck-skip.txt
diff --git a/.github/knownwords.txt b/config/spellcheck/knownwords.txt
similarity index 100%
rename from .github/knownwords.txt
rename to config/spellcheck/knownwords.txt
diff --git a/.github/vale/styles/config/vocabularies/FusionAuth/accept.txt b/config/vale/styles/config/vocabularies/FusionAuth/accept.txt
similarity index 83%
rename from .github/vale/styles/config/vocabularies/FusionAuth/accept.txt
rename to config/vale/styles/config/vocabularies/FusionAuth/accept.txt
index b37d60146d..d43ee5fd4d 100644
--- a/.github/vale/styles/config/vocabularies/FusionAuth/accept.txt
+++ b/config/vale/styles/config/vocabularies/FusionAuth/accept.txt
@@ -2,12 +2,14 @@
Aiven
anonymization
API
+auditable
authorizer
Bachman
Basecamp
[Bb]crypt
Boolean
boolean
+Caldas
CAPTCHA
[Cc]yber
[Cc]yberattack
@@ -23,6 +25,7 @@ CVE
datacenter
datastore
[Dd]ev
+deduplicate
defragmentation
deprovision
deserialize
@@ -48,6 +51,7 @@ Id
Infosec
initializer
interoperate
+Inteligov
Inversoft
ISP
Istio
@@ -111,8 +115,10 @@ SSD
Splunk
Stytch
Supabase
+Sympla
Tangany
themeable
+tooltip
Twilio
URI
virtualized
@@ -129,3 +135,25 @@ xkcd
Yubico
YubiKey
Zendesk
+Frontegg
+[Ee]nv
+Backoffice
+Mailgun
+Sinch
+Brevo
+MailerSend
+Mailchimp
+Haraka
+mailcow
+IPs
+ESPs
+untrusted
+cPanel
+Sendinblue
+spammy
+Logstash
+Kibana
+libre
+Zip[Cc]ode
+aggregatable
+stdout
diff --git a/.github/vale/styles/write-good/Cliches.yml b/config/vale/styles/write-good/Cliches.yml
similarity index 100%
rename from .github/vale/styles/write-good/Cliches.yml
rename to config/vale/styles/write-good/Cliches.yml
diff --git a/.github/vale/styles/write-good/E-Prime.yml b/config/vale/styles/write-good/E-Prime.yml
similarity index 100%
rename from .github/vale/styles/write-good/E-Prime.yml
rename to config/vale/styles/write-good/E-Prime.yml
diff --git a/.github/vale/styles/write-good/Illusions.yml b/config/vale/styles/write-good/Illusions.yml
similarity index 100%
rename from .github/vale/styles/write-good/Illusions.yml
rename to config/vale/styles/write-good/Illusions.yml
diff --git a/.github/vale/styles/write-good/Passive.yml b/config/vale/styles/write-good/Passive.yml
similarity index 100%
rename from .github/vale/styles/write-good/Passive.yml
rename to config/vale/styles/write-good/Passive.yml
diff --git a/.github/vale/styles/write-good/README.md b/config/vale/styles/write-good/README.md
similarity index 100%
rename from .github/vale/styles/write-good/README.md
rename to config/vale/styles/write-good/README.md
diff --git a/.github/vale/styles/write-good/TooWordy.yml b/config/vale/styles/write-good/TooWordy.yml
similarity index 100%
rename from .github/vale/styles/write-good/TooWordy.yml
rename to config/vale/styles/write-good/TooWordy.yml
diff --git a/.github/vale/styles/write-good/Weasel.yml b/config/vale/styles/write-good/Weasel.yml
similarity index 100%
rename from .github/vale/styles/write-good/Weasel.yml
rename to config/vale/styles/write-good/Weasel.yml
diff --git a/.github/vale/styles/write-good/meta.json b/config/vale/styles/write-good/meta.json
similarity index 100%
rename from .github/vale/styles/write-good/meta.json
rename to config/vale/styles/write-good/meta.json
diff --git a/.github/scripts/.gitignore b/src/scripts/.gitignore
similarity index 100%
rename from .github/scripts/.gitignore
rename to src/scripts/.gitignore
diff --git a/.github/scripts/count-repos.sh b/src/scripts/count-repos.sh
similarity index 97%
rename from .github/scripts/count-repos.sh
rename to src/scripts/count-repos.sh
index 2ebe39f0f7..ac4860cf97 100755
--- a/.github/scripts/count-repos.sh
+++ b/src/scripts/count-repos.sh
@@ -34,7 +34,8 @@ function get_json_repos() {
# Repos that will be returned by the `gh` commands below, but are
# intentionally excluded from JSONFILE for... reasons?
local EXCLUDE=(
- "fusionauth-example-ruby-on-rails-custom-scopes"
+ "fusionauth-example-example-qr-codes"
+ "fusionauth-example-node-centralized-sessions"
"fusionauth-example-template"
"fusionauth-example-vue-sdk"
"fusionauth-quickstart-kotlin-android-native"
diff --git a/.github/scripts/publish_sitemap/package-lock.json b/src/scripts/publish_sitemap/package-lock.json
similarity index 100%
rename from .github/scripts/publish_sitemap/package-lock.json
rename to src/scripts/publish_sitemap/package-lock.json
diff --git a/.github/scripts/publish_sitemap/package.json b/src/scripts/publish_sitemap/package.json
similarity index 100%
rename from .github/scripts/publish_sitemap/package.json
rename to src/scripts/publish_sitemap/package.json
diff --git a/.github/scripts/publish_sitemap/publish_sitemap.js b/src/scripts/publish_sitemap/publish_sitemap.js
similarity index 100%
rename from .github/scripts/publish_sitemap/publish_sitemap.js
rename to src/scripts/publish_sitemap/publish_sitemap.js
diff --git a/.github/scripts/setup.sh b/src/scripts/setup.sh
similarity index 100%
rename from .github/scripts/setup.sh
rename to src/scripts/setup.sh
+SMTP providers handle two types of email: marketing (like newsletters and sale advertisements) and transactional (like account notifications and password resets). FusionAuth is concerned only with transactional email.
-Enable email by clicking on the *Enabled* toggle, and save your settings once you have completed your configuration.
+## Understand Email Security
+
+Email service providers (ESPs) such as Gmail, Yahoo Mail, and Proton Mail rely on several methods to prevent spam and phishing emails from being sent to their users. As of 2024, these methods have become even stricter. Google [requires SMTP providers to allow users to send only from their own registered domains](https://help.brevo.com/hc/en-us/articles/14925263522578-Prepare-for-Gmail-and-Yahoo-s-new-requirements-for-email-senders) to reduce spam.
+
+Here are the ways ESPs implement email security:
+- **Rate limits:** Emails that are received too frequently or show sudden spikes in volume are blocked.
+- **IP address block lists:** Emails received from dynamic IP addresses, those known to send spam, or those with a low reputation are added to lists that receivers use to reject mail.
+- **DNS records of email senders:** Emails must have valid records for Sender Policy Framework (SPF) (RFC 7208), Domain Keys Identified Mail (DKIM) (RFC 6376), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) (RFC 7489).
+
+SPF, DKIM, and DMARC are TXT records you need to add to the DNS records for your domain. Your SMTP provider will tell you what records to add.
+
+- An SPF record looks like `v=spf1 ip4:129.6.100.200 ip6:2610:20:6005:100::20 -all` and lists the IP addresses permitted to send email on behalf of the domain. ESPs should reject emails arriving from an IP address other than these.
+- A DKIM record looks like `k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQ8c7wIDAQAB` and specifies a public key. The SMTP provider will sign the sender address of an email with the corresponding private key. ESPs should reject emails with an invalid sender address signature.
+- A DMARC record looks like `v=DMARC1; p=none; rua=mailto:rua@dmarc.brevo.com` and specifies the policies supported by the email sender and where to send rejected email for analysis by the sender.
+
+Together, these three records allow an ESP to know that the email server and sender are valid and what responses the sender supports if an invalid email is received.
+
+You might also encounter the term Author Domain Signing Practices (ADSP), an optional extension to DKIM that enables a domain to publish the signing practices it adopts when relaying mail on behalf of associated authors.
+
+## Which Provider To Choose?
+
+An SMTP provider is an online service that sends email on your behalf. In return for payment, an SMTP provider guarantees you a service that provides IP addresses with a high reputation.
+
+Some providers are easy to test, requiring nothing more than registering with an email address. Others require comprehensive company details, your verified phone number, domain verification, having a professional business website, and communicating with support agents. The easiest providers to configure are:
+- MailerSend — Requires only an email address.
+- Gmail — Requires phone verification, and email is intended only for small tests. Not for production use.
+- AWS SES — Requires email and domain verification.
+- Postmark — Requires email and domain verification.
+- Resend — Requires email and domain verification.
+
+Postmark had especially clear documentation and an easy setup experience.
+
+The more difficult providers are:
+- Brevo
+- Mailgun (Sinch)
+- SendGrid (Twilio)
+
+These providers automatically disable your account on signup and require you to contact their support to have it activated. This involves having a business website ready for review, explaining what your purpose in sending email is, and explaining how you obtained your recipients' email addresses. However, Mailgun and Brevo support were friendly and quick, and unlocked the FusionAuth test account after reasonable discussion. SendGrid is the most onerous provider, with full company details needed for every sender address.
+
+The worst provider is Mailchimp (Mandrill). Mailchimp was the only SMTP provider that refused to provide FusionAuth an account, giving no explanation and accusing us of sharing prohibited content. Mailchimp support was poor — entirely automated, and no human could be contacted.
+
+Be aware that providers can cancel your account at any time, without explanation or a chance to appeal. This can cripple your business.
+
+Choose an SMTP provider that you feel is trustworthy. At the time of writing, these were the scores on https://www.trustpilot.com for each provider in this guide:
+
+| Provider | Score | Link |
+|----------------------|-----------|-----------------------------------------------------|
+| Mailgun (Sinch) | 4.4 | https://www.trustpilot.com/review/mailgun.com |
+| Brevo | 4.2 | https://www.trustpilot.com/review/www.brevo.com |
+| Postmark | 3.5 | https://www.trustpilot.com/review/postmarkapp.com |
+| Resend | 3.2 | https://www.trustpilot.com/review/resend.com |
+| MailerSend | 2.8 | https://www.trustpilot.com/review/mailersend.com |
+| Mailchimp (Mandrill) | 1.3 | https://www.trustpilot.com/review/www.mailchimp.com |
+| SendGrid (Twilio) | 1.2 | https://www.trustpilot.com/review/sendgrid.com |
+| AWS SES | No review | |
+
+These scores, especially the low ones for Mailchimp and SendGrid, are consistent with the experiences we had writing this guide.
+
+When comparing pricing, note that some providers charge a flat monthly fee, and some charge only for the number of emails you send. One provider might be cheaper than another for small volumes of email, but more expensive for large volumes.
+
+## Can You Use A Self-Hosted SMTP Server?
+
+It is possible to send email through an SMTP server hosted on your server using an application like [Postfix](https://www.postfix.org/documentation.html), [Haraka](https://haraka.github.io/getting_started), [mailcow](https://docs.mailcow.email/), or [Mail-in-a-Box](https://mailinabox.email/guide.html). Hosting your own server will cost you nothing more than a few dollars a month for a cloud server, or nothing if you already have a server for other applications.
+
+However, over time, hosting your own SMTP server will almost certainly cost you more time and money than paying a dedicated email company to handle mail for you. Below are some things you'll need to handle if you want to self-host:
+- Deliverability: Email service providers block or filter emails from dynamic IP addresses and untrusted servers. You need to maintain IP reputation, implement SPF, DKIM, and DMARC properly, and handle feedback loops with ESPs (bounces and spam requests).
+- Scalability: As email volume grows, you need to scale your infrastructure.
+- Technical expertise: Properly configuring and maintaining an email server requires understanding both the software and the network infrastructure. You need to continuously monitor your server and ensure it is available with 100% uptime.
+- Security: Your server must be secured against unauthorized access and data must be protected against breaches, requiring regular security audits and updates.
+Using your own SMTP server is appropriate if you are using FusionAuth for a hobby project or a small team where all users know to check their spam folders.
-### SMTP Settings
+## SMTP Settings
+
+Below are descriptions of the SMTP settings you will configure in FusionAuth in the following section.
+
+On the JWT tab, toggle the 
+
+Click the 
+
+For testing, you'll need to link a FusionAuth user to your application. You can either use the existing user you used to log in to FusionAuth or create a new isolated user.
+
+To create a new user, navigate to Users in the sidebar and click the green 
+
+Now select the Registrations tab. Click 
+
+Next, set up an API key. On the left sidebar, select Settings -> API Keys. Click the green 
+
+Save the API key. You should now see a list of all API keys. Click on the lock icon next to the 
+
+
+## Set Up Cloudflare
+
+Navigate to your [Cloudflare dashboard](https://dash.cloudflare.com/login) and log in or create a [Cloudflare account](https://developers.cloudflare.com/fundamentals/setup/account/create-account/) if you haven't got one already.
+
+
+### Create A Cloudflare Worker Function
+
+On the left-hand sidebar, navigate to Workers & Pages -> Overview. Click the 
+
+Click the 
+
+Test that the deployed function is working by clicking on the preview link provided on the next page.
+
+
+
+A new browser tab will open containing the text "Hello world!"
+
+Return to the Worker configuration page and click the 
+
+### Secure Your API With Cloudflare Gateway
+
+- Go to the Zero Trust dashboard in Cloudflare to set up security policies for your API.
+- Define policies to restrict access to your API, such as IP filtering, token-based access, or integrating with certain identity providers for alternative web login methods. FusionAuth is not an option here, but it can manually be added as a login provider using OpenID connect as an alternative solution.
+
+Finally, you can configure FusionAuth to ensure that the user is registered for the Cloudflare application or [fire off webhooks](/docs/extend/events-and-webhooks/) when the user logs in.
+
+You used the FusionAuth API to create a test token on behalf of a user. For a production system, the token will be generated after a user signs in to your application through a frontend. Check out some of the framework integration tutorials to implement that:
+
+