Changelog

The XSS inbox variable vulnerability allows malicious code to be executed within an inbox notification when the message is opened if the code is included as part of a data variable. This contrasts with directly placing the same code in the inbox template, which renders the code without executing it.

A customer reported the issue and demonstrated using an iframe with a JavaScript alert payload. To reproduce the issue, you must create an inbox template, reference a variable in the template's body, send a data payload containing the malicious code, and then open the inbox message where the code execution occurs. The issue was with our Inbox and Components implementations on version 6.2.1. The release does not fix customers who have implemented their Inbox on top of our APIs; they will need to implement a similar XSS fix if affected. Please reach out to Courier Support for help.

We've redesigned our Integrations page to provide analytics about each channel implemented in Courier. You can see usage, errors and error rates broken down by channels at a glance.

Log in and check it out

We've been hard at work with our new front-end components, and this release shows it.

• Courier API Keys and Client Keys have moved to Integrations and got a redesign
• Quick settings in the navigation bar
• Dark mode Ternary toggle (light, dark and system)

We redesigned our user interface around Assets to improve the overall user experience for customers with many templates and automations. The new Assets navigation is centered around Templates and Automations and gives a unifying view of activity, channels, and tags.

This also means we've moved a few things out of assets. For example,

• Brands can be found in Database
• Preferences are now found in Settings

Tenants and User/Tenant Membership is now generally available. While we call the feature tenants, it can be used for any group membership with users. Teams, workspaces, groups, roles, etc. Each tenant can have parent tenants as well.

Using tenants you can

• Create Tenant hierarchy and parent-child inheritance
• Override template and notification properties
• Store properties and metadata for a tenant
• Specify default preferences for a tenant that will be inherited to the user defaults
• Brand emails differently per tenant

Start using tenants them with our SDKs, REST, Segment.group(), or Rudderstack.group() events.

In the first of its series, we've re-investing in our SDKs by parterning with Fern to launch our newest Node SDK. With use case oriented clients, stronger typing and robust documentation, our v6 is better than ever. Check it out on npm or Github and ask us questions on Discord.

New features include:

• Resource-scoped SDK methods
• Docs on Hover
• Retries with exponential backoff
• Configurable Timeouts

Courier’s React Native SDK now supports User Preferences.

All 3 of Courier’s User Preferences APIs are now available. The following User Preferences API are now available in Courier's React Native SDK:

1. Get All Preferences
2. Get an individual User Preference Topic
3. Update a User Preference Topic

For more details, refer to the Preferences.md file in the Courier React Native repository.

Support for JWT authentication has been added to the following User Preference REST API endpoints:

• PUT | PATCH | DELETE /users/:user_id/preferences/:topic_id
• GET /users/:user_id/preferences
• GET /users/:user_id/preferences/:topic_id

Docs: https://www.courier.com/docs/reference/auth/issue-token/#usage

Preferences can now be associated with a tenant. If you send to a user in the context of their tenant, the preferences being applied will be the tenant level preferences, and if its not in the context of a tenant, its picked from user level preferences.

Note, this change does not impact you unless you’re using tenants. See the Tenants API reference for more information.

The hosted user preference age now uses brands from the tenant when a notification is sent using tenant_id.

Create a tenant using API and attach a brand_id:

1
name: "ACME Inc",
2
  brand_id: "acme_brand_new",
3
  properties: {
4
    ceo: "Person",
5
  }
6
}

When you send a notification using the above tenant, the host user preference page links generated by Courier will have appropriate acme_brand_new instead of default brand.

Automations templates can now infer recipient userId in most cases without manual configuration. User Id is inferred when:

• An automation is triggered by a CDP (Segment, Rudderstack, Courier)
• The User id is supplied in the data payload (as user_id or userId) on invoke.
• The recipient field is set on invoke

The syntax for sending with a tenant has been updated to improve distinction vs sending to all members of a tenant with the addition of the context property.

Please see the tenants section of users for examples of this syntax and usage.