Ory Kratos, Ory Elements v26.3.8 released

Ory Kratos

OIDC-scoped after hooks now run for native id_token logins

Login and registration hooks scoped to the oidc method now also run when a native app completes the flow by submitting an id_token directly (for example Sign in with Apple on iOS). Previously these flows only triggered the unscoped hooks. If you use method-scoped hooks, expect them to fire for these logins from now on. The flow's active method is now also set to oidc in hook payloads and events for these flows.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Elements

Require trustedOrigins in the @ory/nextjs middleware

The Next.js middleware options now require trustedOrigins: a list of exact origins, or regular expressions for preview deployments, that your deployment serves. The middleware only reports the request origin to Ory — used as the base URL for redirects and emails — when it matches the list; otherwise Ory falls back to the project's configured base URL. createOryMiddleware throws at startup when trustedOrigins is unset or empty. We recommend upgrading and configuring the option promptly.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Network, Ory Hydra, Ory Keto, Ory Oathkeeper, Ory Polis, and Ory Terraform

No significant changes in this release.