The value of the Content-Type HTTP header when serving static Javascript files (*.js) has been changed to text/javascript (instead of application/javascript) to align with RFC 9239. Requests for such files are mostly made by web browsers as a result of script tags in HTML pages. Major browsers accept both content types.
Content-Type
*.js
text/javascript
application/javascript
script
Note
The changes described in this section are non-breaking and related to internal behavior, so they shouldn’t affect existing configurations. They are mentioned here for completeness.
When an authenticator has an unfulfilled authentication or registration prerequisite, the server redirects the user to the prerequisite authenticator. The logic for handling/enforcing this has been improved in this release. Namely, the server no longer uses certain query-string parameters (e.g. __resumeUrl) on the prerequisite redirects.
__resumeUrl
The URLs for authenticators that are part of the Group Authenticator were also updated in a similar way. This means that the URLs supplied in the view model of the authenticator/group/authenticate/get.vm Velocity template have changed. The URLs are still rendered and accessed in the same way as before.
authenticator/group/authenticate/get.vm