---
title: "1.24.0 — Safe registration attribution across Bouncer"
description: "django-mojo 1.24.0 preserves schema-declared registration attribution through Bouncer and login/register navigation while keeping credentials, navigation controls, undeclared parameters, and non-registration destinations excluded. It also applies one bounded value policy to hosted forwarding and reg…"
date: "2026-09-06"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-24-0/"
---

django-mojo 1.24.0 preserves schema-declared registration attribution through Bouncer and login/register navigation while keeping credentials, navigation controls, undeclared parameters, and non-registration destinations excluded. It also applies one bounded value policy to hosted forwarding and registration capture. Consumers using newly reserved extra-field names must rename or remove them before upgrading.

### Breaking

- Registration extra-field names reserved for canonical identity, tenancy and navigation, credentials and device tokens, OAuth, MFA, passkey, or handoff controls are now rejected. Persisted entries using those names normalize away; consumers using a reserved name must remove or rename it before upgrading.

### Changed

- Bouncer and login/register switcher URLs now carry safe values only for fields declared by the resolved registration schema. Passkey, public-contact, and OAuth-consent destinations remain free of registration attribution.
- Hosted-page forwarding and registration capture now share one value policy: one non-empty scalar string, at most 512 characters, with no ASCII controls. Duplicate, malformed, or oversized values are dropped rather than truncated.
- Custom registration templates can consume the server-sanitized registration value map and shared maximum length instead of reparsing the raw browser query.

### Fixed

- First-time visitors who receive a Bouncer challenge no longer lose declared referral, promotion, or tracking attribution before the registration page loads.

### Upgrade notes

- Custom hosted registration templates should read the server-provided sanitized registration values and maximum length. Do not collect declared extras independently through URLSearchParams.