1.24.0 — Safe registration attribution across Bouncer

2026-09-06

django-mojo 1.24.0 preserves schema-declared registration attribution through Bouncer and login/register navigation while keeping credentials, navigation controls, undeclared parameters, and non-registration destinations excluded. It also applies one bounded value policy to hosted forwarding and registration capture. Consumers using newly reserved extra-field names must rename or remove them before upgrading.

Breaking

• Registration extra-field names reserved for canonical identity, tenancy and navigation, credentials and device tokens, OAuth, MFA, passkey, or handoff controls are now rejected. Persisted entries using those names normalize away; consumers using a reserved name must remove or rename it before upgrading.

Changed

• Bouncer and login/register switcher URLs now carry safe values only for fields declared by the resolved registration schema. Passkey, public-contact, and OAuth-consent destinations remain free of registration attribution.
• Hosted-page forwarding and registration capture now share one value policy: one non-empty scalar string, at most 512 characters, with no ASCII controls. Duplicate, malformed, or oversized values are dropped rather than truncated.
• Custom registration templates can consume the server-sanitized registration value map and shared maximum length instead of reparsing the raw browser query.

Fixed

• First-time visitors who receive a Bouncer challenge no longer lose declared referral, promotion, or tracking attribution before the registration page loads.

Upgrade notes

• Custom hosted registration templates should read the server-provided sanitized registration values and maximum length. Do not collect declared extras independently through URLSearchParams.