AllAuth React SDK 1.4.5: isolated application support
Opt-in application-initiated support can run on a separate application hostname while ordinary administrator tabs retain their sign-in. The proxy preserves safe native actor/session context and validates the exact application return destination. Existing console support, cookies, signed transport and sign-in remain compatible.
What changed
- Add the exact applicationReturnUrl to the support proxy options when enabling application-initiated support on an isolated hostname. The matching service must explicitly enable delegation and register the separate callback.
- Safe actor kind/session, application audit ID and context are preserved through support status. Native session credentials remain in HttpOnly cookies, and support cleanup returns only the configured main-app administrator destination.
- The host must enforce its own current administrator/context checks on business and native proxy requests, block ordinary auth/admin flows on the support hostname and restrict native writes there to support-stop. Existing integrations remain disabled until explicitly configured; no customer upgrade or credential change is automatic.
Compatibility and upgrading
This release preserves existing APIs, sign-in flows and organisation permissions. Update the pinned SDK and its same-origin proxy together, then test and deploy your application.
Verified package
The versioned archive keeps its original URL. Verify the downloaded file against this SHA256 checksum.
https://allauth.co/sdk/allauth-react-1.4.5.tgz
63c5fc7cdf264f92f065d800ef0b6ea53650ccb5f5d3232ac1ff6633d6e5c397Release provenance
release
Immutable public SDK source/tag v1.4.5 and exact archive/checksum assets were verified on GitHub. Local isolated-origin native support, SDK source/archive parity, retained-client transport and Vite-style ES2020 consumer typechecks passed before publication. Matching service rollout is recorded separately.
Reviewed package files: support-server.ts, support-banner.tsx, README.md