V3 JS v3.0.1

This release adds security, authentication, UI, and localization updates. It also includes bug fixes for V3JS, Auth Studio, and Templates.

Changelog

Added

• Last used login method: Login screens now show the last successful method, including password, passwordless, passkey, and social login.

• Verification flows: Verification, password-reset, PIN, and passkey links now check for expiry. Users can request a new link. Registration also supports preventVerificationEmail for optional email verification.

Improved

• API and bot security: Identity API requests now send the API key in the X-LoginRadius-ApiKey header. Registration now uses CAPTCHA when Bot Protect on APIs is enabled.

• Localization: Expanded localization across profile fields, grouped-field labels, dropdowns, modal text, confirmation messages, and accessibility labels.

• Authentication callbacks: The onSuccess callback no longer fires on page reload for authenticated users.

• Passkey support: Improved WebAuthn credential validation and base64url handling. Added support for authenticatorAttachment and the configured public-key timeout.

Fixed

• Passkey login: Fixed passkey registration and login for email addresses containing +.

• Account deletion: The delete-account magic link now works from Profile security settings. It deletes the account and signs the user out.

• Workflow fields: Hidden IO workflow fields no longer appear as inputs. Gender options now display correctly in forms and previews.

• Privacy after password reset: Fixed the privacy flow when a new policy version appears during forgot-password or reset-password journeys.

Customer Impact

To update Auth Studio for existing templates, add this code to the Auth → Before Script file:

redirectIfAuthenticated();

function redirectIfAuthenticated() {
  // Skip every page that still has work to do:
  //  • Authorize flow → the /authorize round-trip must mint a code; handing the
  //                     app a bare token here would bypass it.
  //  • ?code=…        → the token exchange is still in flight.
  //  • ?vtoken=…      → email verification / password reset / org invite must run
  //                     even for a signed-in user.
  if (params.get("flow") === "authorize" || params.has("code") || params.has("vtoken")) {
    return;
  }

  LRObject.isAuthenticated()
    .then(function (authenticated) {
      if (authenticated) {
        redirectToReturnUrl(LRObject.getAccessToken());
      }
    })
    .catch(function (err) {
      // Session lookup failed — leave the widget on screen so the user can sign in.
      console.log(err && err.message ? err.message : err, true);
    });
}

Please reach out to LoginRadius Support for any further queries.