v1.27.0

![logto-changelog-2025-04-27](https://github.com/user-attachments/assets/f7d816bd-ba2c-4952-b3c5-954eb3e96025)


## Security center in Logto Console

We have introduced a new"Security" page in the Logto console, which includes the following features:

- Password policy: This feature has been migrated from the "Sign-in Experience" page to the new "Security" page.
- CAPTCHA: Enable CAPTCHA for sign-up, sign-in, and password recovery to mitigate automated threats.
- Identifier lockout: Temporarily lock an identifier after multiple failed authentication attempts (e.g., consecutive incorrect passwords or verification codes) to prevent brute force access.

Refer to [documentation](https://docs.logto.io/security) for more details.

## Captcha bot protection

As mentioned in the above "Security" update, you can now enable CAPTCHA bot protection for your sign-in experience with providers such as Google reCAPTCHA enterprise and Cloudflare Turnstile.

To enable CAPTCHA bot protection, you need to:

1.  Go to Console > Security > CAPTCHA > Bot protection.
2.  Select the CAPTCHA provider you want to use.
3.  Configure the CAPTCHA provider by following our step-by-step guide.
4.  Save the settings.
5.  Enable CAPTCHA in the Security page.

Then take a preview of your sign-in experience to see the CAPTCHA in action.

Refer to [documentation](https://docs.logto.io/security/captcha) for more details.

## Identifier lockout (sentinel)

The identifier lockout has always been there protecting your Logto instance. However, previously it is hard-coded and not configurable. Now you can fully customize and override the default rules in the Security center.

This update includes the follow 3 parts:

1. Maximum failed attempts:

- This limits the number of consecutive failed authentication attempts per identifier within an hour. If the limit is exceeded, the identifier will be temporarily locked out.
- Default value: 100

2. Lockout duration (minutes):

- This specifies the period during which all authentication attempts for the given identifier are blocked after exceeding the maximum failed attempts.
- Default value: 60 minutes

3. Manual unblock:

A new API endpoint has been introduced to manually unblock a specified list of identifiers. This feature is useful for administrators to unlock users who have been temporarily locked out due to exceeding the maximum failed attempts.

Endpoint: `POST /api/sentinel-activities/delete`

This endpoint allows for the bulk deletion of all sentinel activities within an hour in the database based on the provided identifiers, effectively unblocking them.

Refer to [documentation](https://docs.logto.io/security/identifier-lockout) for details.

## Magic link (one-time token) support

You can now use the "one-time token" to compose magic links, and send them to the end user's email.

With a magic link, one can register a new account or sign in directly to the application, without the need to enter a password, or input verification codes.

You can also use magic link to invite users to your organizations.

### Example API request to create a one-time token

```bash
POST /api/one-time-tokens
```

Request payload:

```jsonc
{
  "email": "user@example.com",
  // Optional. Defaults to 600 (10 mins).
  "expiresIn": 3600,
  // Optional. User will be provisioned to the specified organizations upon successful verification.
  "context": {
    "jitOrganizationIds": ["your-org-id"],
  },
}
```

### Compose your magic link

After you get the one-time token, you can compose a magic link and send it to the end user's email address. The magic link should at least contain the token and the user email as parameters, and should navigate to a landing page in your own application. E.g. `https://yourapp.com/landing-page`.

Here's a simple example of what the magic link may look like:

```
https://yourapp.com/landing-page?token=YHwbXSXxQfL02IoxFqr1hGvkB13uTqcd&email=user@example.com
```

Refer to [documentation](https://docs.logto.io/end-user-flows/one-time-token) for more details.

## Bump node to v22

We've updated Node.js to v22 for better performance and security.

## Improvements

- f41938257: respond 404 for non-existing paths in `/assets`
- 7dbcedaa1: move password encyption to separate worker thread
- cfedfb306: clean up legacy Experience package
- 752d406bd: support string-typed boolean claims in OIDC connector
- 59c398442: add Ukrainian translation to Experience (credit @HighError)
- ba7621005: convert Windows absolute paths to file URLs for dynamic imports (credit @jtmaveryk)

## Security updates and vulnerability fixes

## New Contributors
* @HighError made their first contribution in https://github.com/logto-io/logto/pull/7205
* @jtmaveryk made their first contribution in https://github.com/logto-io/logto/pull/7126

**Full Changelog**: https://github.com/logto-io/logto/compare/v1.26.0...v1.27