Changelog Features 317188b feat(auth): redesign the sign-in, sign-up and forget pages and fix dark mode f231a93 feat(dcr): inherit EnableSigninSession and EnableWebAuthn from default application 20564f4 feat(helm): probe /api/health with a startup probe and configurable timings adc3f3e feat(helm): support service annotations (#5904) de6b49b feat(web): add AutoComplete for SAML attributes value (#5…
Changelog Features 5bf0641 feat: add default record retention days to global settings 266a0c0 feat: brand the description, og tags and manifest of sign-in pages a866fe9 feat: support custom TableColumns mapping in Lark syncer (e.g. enterprise_email) (#5961) 20245fb feat: support private_key_jwt client authentication for DCR and CIMD clients d98b5f7 feat: support running as a Windows service Bug fi…
Changelog Features 6121c73 feat(helm): probe /api/health with a startup probe and configurable timings f74551c feat: add Logo signup item to hide the logo on the signup page 3ad7552 feat: add RFC 7009 token revocation endpoint 79c361b feat: add SAML NameID template to applications 2157444 feat: add account items for Deleted time, Last signin time and Last signin IP on the user page 0628c3a feat: a…
Changelog Features 6d4325d feat: accept client ID metadata document URLs as client_id for MCP clients Bug fixes 6bb563d fix: default the OIDC user ID mapping to sub and fall back to sub when the mapped claim is missing c5029ae fix: expire tokens and clear the forced password change when update-user changes the password 35bbf3b fix: keep the post-setup redirect URL when the auto sign-in also return…
Changelog Features 0df833e feat: add basePath to serve Casdoor under a sub-path 5619d6c feat: restyle toasts as plain cards with colored icons instead of tinted backgrounds 178a825 feat: rotate Marketplace themes on the sign-in page of demo sites d4a4598 feat: show Marketplace themes on all entry pages and the console of demo sites 75d57c7 feat: show the Marketplace theme given by ?theme= on embed…
Changelog Features 66eb494 feat: add Marketplace to install app, provider and theme integrations 5752bf5 feat: add forward auth endpoint for Traefik, Caddy and Nginx 7ddd355 feat: add public paths to sites and check site rules in forward auth ef7754b feat: let organization admins use fonts, images and HTML to customize the sign-in pages 8ee30d1 feat: link integration guides to the Marketplace site…
Changelog Features f34e525 feat(helm): support service annotations (#5904) dcd5651 feat: add expire time to invitations 258c80f feat: add option to disable self signup but keep provider signup f1813b6 feat: add verification code grant for native app sign-in b3a1351 feat: permanently delete a soft-deleted user when deleting it again 7dbcbf2 feat: prompt for email, phone and display name after third…
Changelog Features 4ee572a feat: add columns parameter to update-role and update-permission 00c52f5 feat: add container health checks bc93b03 feat: add initData values to the Helm chart ab4ed7e feat: apply the init data file continuously with merge and watch modes 9108c73 feat: link the v3 to v4 upgrade guide in README Bug fixes 4c6eb96 fix: accept passwords in organizations without a password typ…
Changelog Features 817334e feat: add a README to the Helm chart 69aba14 feat: let the global admin set the trusted database hosts of an organization
Changelog Features b45f7bc feat: add .well-known metadata file bffa297 feat: add DCR switch and support form_post and hybrid flow in consent page 77709d9 feat: add OpenSSF Best Practices badge to README 3c6aede feat: improve OIDC conformance for hybrid flow, prompt and max_age fbc08fe feat: link to the Casdoor Authenticator app in MFA setup, MFA accounts and README c6c6af7 feat: publish the Helm c…
Changelog Bug fixes 0feded2 fix: handle missing organization and user in remove-user-from-group API 29c2451 fix: mark JWT-Custom refresh tokens with tokenType refresh-token 0cef429 fix: redirect to the requested page after login 956c405 fix: release camera on unmount and attach video after face dialog mounts 84a262a fix: restrict uploaded groups, roles and permissions to the admin's organization 2…
Changelog Features b94dce9 feat: open account menu on hover bd13018 feat: return stable error code in login failure response Bug fixes 8f7efcf fix: check terms of use by default on login page c92ff2d fix: check terms of use by default on signup page 94c0ef0 fix: end access-token sessions when the token is revoked by SSO logout 51bd444 fix: inherit DCR token lifetimes from the default application a…
Changelog Features c9adca0 feat: add Audit provider to forward audit logs to Syslog Bug fixes 9944731 fix: keep provider host, endpoint and type unchanged on demo database 11f53fb fix: publish all certs in the global JWKS again 153bea5 fix: skip invalid certs instead of failing the whole JWKS fad4d7b fix: treat demo database as demo mode for provider APIs
Changelog Features 9f13005 feat: add application-level token group format option 3377f35 feat: support OIDC prompt=none on the authorize page (#5884) de6fc6d feat: support RFC 9207 iss parameter in authorization responses 980ad12 feat: support max session count for exclusive signin 6c18f6c feat: upgrade React to 19.3.0 in web Bug fixes 91fc924 fix: accept JWT-Standard subject tokens in token excha…
Changelog Bug fixes 1278f9d fix: bind MFA remember to device and block avatar SSRF and forged payment notifies 6179955 fix: block cross-org API permission fallback on empty owner a0701ad fix: harden DCR, session rotation, Kerberos realm and XSS sinks 03c6c9a fix: harden OAuth, MFA, CAS and signup security checks a8f8d56 fix: harden consent, password reset, master code and CAS checks 8b6360b fix: r…
Changelog Features 0f7d684 feat: support SAML Single Logout protocol Bug fixes 3343aa5 fix: authorize session APIs against sessionPkId instead of id b40db12 fix: block cross-org token minting and secret-field query oracles fcc949c fix: enforce MCP token scopes on token-derived session cookies 2b91d9e fix: harden MFA, device flow and cross-org group checks 18b4671 fix: harden credential and session…
Changelog Bug fixes 5b456e1 fix: make account item names selectable in organization edit page 9db04af fix: restore web-old behavior in the console's editable sub-tables 2ad0722 fix: send Vary: Origin from the CORS filter
Changelog Bug fixes eff25f6 fix: allow an org-scoped subject to update its own organization af0b022 fix: attribute audit records of unauthenticated requests to an organization 92c2db6 fix: correct Ukrainian (uk) i18n translations (#5869) 3cd925a fix: default the MFA setup wizard to the organization's required factor 2db20ea fix: don't prefill a random invalid phone number for new users 5370339 fix…
Changelog Features ab56581 feat: add RADIUS Message-Authenticator support with a per-provider switch 72a1d5a feat: add organization-level exclusive signin across applications 0352f4b feat: render the forced password update as a standalone auth page Bug fixes bcd8754 fix: follow the connection's search_path when syncing PostgreSQL tables 30f94bd fix: redirect to the RP on logout even when Casdoor h…
Changelog Features bb76eb6 feat: add magic link sign-in Bug fixes fbcb496 fix: keep empty forceLanguage empty so browser language detection works 0db629e fix: keep resolved RADIUS/push provider id through MFA setup enable step 4684d70 fix: read SAMLRequest case-insensitively in auth callback 91ae9d6 fix: redirect to the single OAuth provider only once instead of on every render 7bf924a fix: reset…
Changelog Features fb38eae feat: add group add/delete actions to group tree page 39a1bba feat: support popup mode for Captcha providers Bug fixes 0f629eb fix: URL-encode OAuth state on interactive login, consent, prompt, signup and post-logout redirects 1d65427 fix: allow only global admins to change applications' custom HTML f82480a fix: allow org admins to import groups, roles and permissions vi…
Changelog Features d60b5ae feat: add configurable password history check e1aa116 feat: add organization-level defaultTokenFields for new applications d6f2cb6 feat: show device, IP and last active time for each session e7f2799 feat: support app-level dark logo fbacaea feat: support group-level subscriptions ed417c1 feat: support invite-only pricing Bug fixes 3eb9231 fix(web): keep draft rows in key…
Changelog Features 8e48365 feat: fall back to user/list_id in WeCom syncer a61599b feat: support department sync in WeCom syncer Bug fixes 311f4d1 fix(auth): drop the panel card on a phone 0b1a605 fix: keep LDAP auto-sync alive after a connection panic e8db3f9 fix: list all organizations' rows when "All" is selected f886a09 fix: report the real reason when uploading users fails 1f86f4c fix: report…
Changelog Features cc39a93 feat(auth): redesign the sign-in, sign-up and forget pages and fix dark mode d353b15 feat: group release notes by commit type Bug fixes 75420fc fix(apple): use the real name from Sign in with Apple as the display name a2fb878 fix(auth): drop the app name heading from the signup and login pages 93cb910 fix(auth): keep the sign-in query string on the forget and organizatio…
Changelog 3659a08 ci: release from a manually pushed tag instead of semantic-release 0c42632 feat: add OIDC provider type babdb25 feat: add a command palette, bulk row selection and inline form validation 7685f8e feat: lay out console forms in two columns and let list tables hide columns bfe0353 feat: let an LDAP server opt in to password reset b6e2abd feat: mark which groups granted each of a use…
4.0.0 (2026-09-01) Features replace the Ant Design console with the shadcn/ui frontend (38ecc6e) BREAKING CHANGES web/ now holds the shadcn/ui frontend built with Vite. Its build output layout changed from create-react-app's build/static/{js,css} to Vite's build/assets/, so anything serving Casdoor's static files through a CDN or a reverse proxy needs its paths updated. The Ant Design frontend is…
3.164.0 (2026-08-30) Features add missing organization segment to syncer add URL (54df9cc)
3.163.3 (2026-08-30) Bug Fixes do not re-init login theme algorithm from localStorage (#5773) (8931d09)
3.163.2 (2026-08-30) Bug Fixes reject duplicate email and phone before sending signup code (44a81f4)
3.163.1 (2026-08-30) Bug Fixes correct Ukrainian (uk) i18n translations (#5775) (bde0144)