Ory Network, Ory Hydra, Ory Oathkeeper v26.3.9 released

Ory Network

Refreshed Console for self-hosted and enterprise deployments

Console now uses Ory's new design system when you run it against Ory Enterprise License or your own Kratos, Hydra, and Keto instances. Every screen was rebuilt: navigation, user management, activity and sessions, message delivery, OAuth2 clients, permissions, and project settings.

What you get:

• A consistent look across every screen.

• Reworked navigation with a searchable command palette.

• Faster lists. Identities, sessions, messages, OAuth2 clients, and relationships load more rows as you scroll instead of paging, so large data sets stay responsive. If loading more fails, the rows you already have stay on screen and you can retry.

• A back-to-top button on long lists, once you have scrolled past a screenful.

• Dates shown in a single readable format that follows your locale's 12- or 24-hour clock.

• A new confirmation dialog for starting an account recovery flow on behalf of a user. The action appears for identities that have a recovery email address.

• Terminating a session now asks for confirmation first, from both the sessions list and a session's own page.

• Navigation entries for services you have not configured stay visible but disabled, and explain which service is missing instead of failing silently.

• A layout that works on tablets and phones. On a tablet the sidebar starts collapsed; on a phone, floating search and menu buttons take its place. Both open the navigation as a panel over the page that takes keyboard focus, closes with Escape, and hands focus back to the button that opened it. Dialogs slide up from the bottom edge.

An identity's page is now split into Profile, Authentication, and Activity tabs, and remembers which tab you were on. From it you can remove a verification or recovery address whose trait is optional, remove an authentication method, unlink a connected account, revoke one or all OAuth2 consents, review device history, and move the identity to another organization. Every destructive dialog names the identity it affects.

OAuth2 clients list the client name over its type, show their grant types and scopes at a glance, and open when you click the row. You can search for a client by its exact name, and deleting one now spells out that the application stops being able to request tokens and that tokens it already issued stop working. Creating a client starts from a template, leaves the scope empty for you to fill in, and shows a worked example in every URI field.

Relationships get a detail page: click a row to read one, then edit or delete it from there. Project settings now checks each service instead of assuming it is reachable, so a service that is down reads as unreachable and the features that depend on it read as unavailable.

This is now available for the Ory Enterprise License and will be part of the next Ory Open Source release.

Ory Hydra

Limit request bodies to 10 MB

Ory Hydra now rejects requests whose body is larger than 10 MB, on both the public and the admin API. Most endpoints respond with 400 Bad Request; endpoints that read the access token or client credentials from the request body, such as /userinfo, respond with 401 Unauthorized instead.

Most endpoints were already bounded at the same magnitude, because Go's HTTP server caps form-encoded bodies at 10 MB. This change makes the limit explicit and closes the remaining gaps: multipart form data and JSON documents on the admin API were previously unbounded.

OAuth 2.0 and OpenID Connect requests are a few kilobytes at most, and so are the documents the admin API accepts, so this does not affect normal traffic. The largest payloads you are likely to send are a private_key_jwt client assertion, a signed request object, or an OAuth 2.0 client with an embedded JSON Web Key Set — all far below the limit.

Requests that exceed the limit now report the size as the reason. Previously an oversized form body was reported as an empty body, which pointed at the wrong cause.

Breaking changes

Integrations that send request bodies larger than 10 MB must reduce the body size before upgrading.

Expired JWT bearer grants no longer issue access tokens

The token endpoint no longer accepts urn:ietf:params:oauth:grant-type:jwt-bearer assertions for a trusted issuer grant whose expires_at has passed. Previously, such assertions could still be accepted after the grant expired.

If an integration still exchanges assertions against an expired grant, those token requests now fail with invalid_grant. Re-establish the trust relationship with a future expires_at to restore access. Deleted grants and unexpired grants behave as before.

Self-hosted Ory Hydra and Ory Enterprise License users should upgrade to a version containing this fix and can revoke a trusted issuer immediately by deleting the grant. The fix is deployed across the Ory Network, and Ory Network users do not need to take action.

Reject browser-executable URL schemes on OAuth2 clients

Creating or updating an OAuth2 client now rejects redirect_uris, post_logout_redirect_uris, and frontchannel_logout_uri values whose scheme a browser executes as script (javascript:, data:, vbscript:). Custom native-app schemes such as com.example.app:/callback keep working.

Requests with such values now fail with 400 Bad Request, on the admin client APIs and on OpenID Connect dynamic client registration. A rejected redirect_uris value returns an invalid_redirect_uri error; post_logout_redirect_uris and frontchannel_logout_uri return invalid_client_metadata. These values never worked as OAuth2 endpoints, so no functioning integration is affected.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Oathkeeper

Bound request-body buffering in the Oathkeeper remote authorizer

The remote authorizer buffers the inbound request body so it can be replayed to the upstream after the authorization call. That buffer is now bounded through the new max_request_body_size option.

The value is a human-readable byte size such as "10MiB" or "1GiB". Sizes are powers of 1024; the legacy suffixes KB, MB, GB and so on are accepted and mean the same. Set the option to "unlimited" or "0" to disable the limit. Requests larger than the limit are rejected with HTTP 413 Request Entity Too Large before any part of the body reaches the remote authorizer.

Only the remote authorizer is affected. The remote_json authorizer does not read the inbound body and is unchanged.

Breaking changes

Routes using the remote authorizer now default to a 10MiB limit. Requests with bodies larger than that are rejected with HTTP 413 unless you raise max_request_body_size or set it to "unlimited" or "0".

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Kratos, Ory Keto, Ory Polis, Ory Elements, and Ory Terraform

No significant changes in this release.