Upgrading from 10.4.X to 10.5.0#

Media type for static Javascript files#

The value of the Content-Type HTTP header when serving static Javascript files (*.js) has been changed to text/javascript (instead of application/javascript) to align with RFC 9239. Requests for such files are mostly made by web browsers as a result of script tags in HTML pages. Major browsers accept both content types.

Handling of prerequisite authenticators and Group Authenticator children#

When an authenticator has an unfulfilled authentication or registration prerequisite, the server redirects the user to the prerequisite authenticator. The logic for handling/enforcing this has been improved in this release. Namely, the server no longer uses certain query-string parameters (e.g. __resumeUrl) on the prerequisite redirects.

The URLs for authenticators that are part of the Group Authenticator were also updated in a similar way. This means that the URLs supplied in the view model of the authenticator/group/authenticate/get.vm Velocity template have changed. The URLs are still rendered and accessed in the same way as before.

Serialization filter system property#

The se.curity:identity-server:serialFilter Java system property allows additional Java types to be deserialized, on top of the types the Curity Identity Server allows by default. In previous versions, setting this property did not work correctly: instead of only allowing the types matched by its patterns, it effectively disabled the restriction for every type not in the default allow-list. This was fixed in versions 11.4.3, 11.3.3, 11.2.4, 11.1.4, 11.0.6, 10.7.8, 10.6.6, 10.5.5, 10.4.7, 10.3.5, 10.2.6, 10.1.5 and 10.0.7.

From these versions, only the types matched by the property’s patterns are allowed in addition to the default ones, and any other type is rejected. Deployments that set this property must review its value and make sure that it matches every type that actually needs to be deserialized, as a value that is too narrow previously went unnoticed. A type rejected by the filter is logged as a warning (Type ... not allowed to be deserialized).