4.19.2

2024-11-21

Contains Breaking Changes

patch

Breaking Changes 1

Signed session cookies for Login V2 breaking

Login V2 now signs its session cookie to prevent tampering. This requires the `ZITADEL_SESSION_COOKIE_SECRET` environment variable to be set. Existing cookies are invalidated, requiring users to log in again.

login-v2 security

SAML IdP Confusion Vulnerability critical

SAML identity-provider confusion leading to account takeover.

idp saml
Unsigned Session Cookie Vulnerability critical

Account takeover through the unsigned Login V2 session cookie.

login-v2
Administrator Impersonation Vulnerability high

End-user impersonators could impersonate administrators.

oidc impersonation

Fix Console event paging using creation date instead of sequence (#12790)

Switched the paging cursor from sequence to creation date. Since the v2 migration, sequences are per-aggregate, causing "load more" functionality to incorrectly omit events.

console admin-api
Prevent projections from skipping events under load (#12703)

Fixes an issue where projections could skip committed events under high load due to position stamping logic and incorrect cursor offsets.

eventstore projections
Resolve performance issues caused by suboptimal index selection (#10626)

Ensures leftover indexes that interfered with Postgres query planning for projection handlers are handled, improving query execution plans.

database
Reject mismatched SAML assertions

Reject SAML assertions from a different Identity Provider than the one intended to prevent account takeover confusion.

idp saml
Restrict administrative impersonation

Require the `admin.impersonation` permission to impersonate administrators, preventing end-user impersonators from gaining administrative access.

oidc impersonation

Optimize eventstore sort performance via column-based ordering (#12792, #12703, #12789, #12790)

Replaced row constructor `ORDER BY` with a column list to allow Postgres to utilize btree indexes for incremental sorting. This resolves performance issues where every descending query was forced to read and sort all matching events before applying limits.

eventstore database
Signed session cookies for Login V2 breaking

Login V2 now signs its session cookie to prevent tampering. This requires the `ZITADEL_SESSION_COOKIE_SECRET` environment variable to be set. Existing cookies are invalidated, requiring users to log in again.

login-v2 security
Order events API by creation date for improved performance (#12789, #10626, #12703)

Introduced an opt-in `OrderByCreationDate` for the `SearchQueryBuilder`. This allows the admin `ListEvents` endpoint to utilize existing indexes for efficient paging and sorting, fixing performance degradation on the Console Events page.

eventstore admin-api
Read projection events per event type for faster catch-up (#12753, #12703)

Implemented `ScanEventTypesSeparately()` to allow projections to read event types via separate subqueries merged with `LATERAL` joins. This prevents projections that fall behind from performing N² reads, significantly improving catch-up speed.

projections eventstore