Ory Hydra, Ory Elements v26.4.12 released

Ory Hydra

Token lifespans are administrator-only for dynamically registered clients

OpenID Connect Dynamic Client Registration no longer accepts per-client token lifespans. POST /oauth2/register and PUT /oauth2/register/{id} reject a request that sets one with invalid_client_metadata. The registration endpoints also no longer return the lifespan fields, so a registration client can read its own registration and send it back unchanged, as RFC 7592 prescribes.

A lifespan an administrator set with PUT /admin/clients/{id}/lifespans now stays in place when the client updates its own registration. Before, such an update cleared it.

The deployment ttl settings are unchanged. They remain the defaults for clients that set no override.

Breaking changes

A dynamic client registration request that sends a token lifespan field now fails. Remove the lifespan fields from dynamic registration payloads and set them with PUT /admin/clients/{id}/lifespans instead.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Elements

Forms show a loading state and no longer submit without a CAPTCHA token

Elements forms with a Cloudflare Turnstile CAPTCHA no longer send a submit before Turnstile has returned a token. Before, a user who clicked the Turnstile checkbox and then Continue right away could get a CAPTCHA error. The submit button is no longer disabled while Turnstile runs. When the user submits before the token is ready, the button shows its loading state and the submit waits for the token. If Turnstile asks the user to solve a challenge, the submit is cancelled so the user can solve it and submit again. A Turnstile error in the browser no longer leaves the form disabled until the page reloads.

While a form loads in the browser and while it submits, the default theme now dims the form controls instead of showing them in the disabled colors. The form element carries aria-busy="true" and data-busy="hydrating" or data-busy="submitting". Custom Form.Root components can read the same state with the new useOryFormBusy() hook.

If you replaced the default CAPTCHA component with your own and dispatch form_input_loading and form_input_ready, nothing changes for you: a pending input group still disables the submit, single sign-on, and method buttons.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Network, Ory Kratos, Ory Keto, Ory Oathkeeper, Ory Polis, and Ory Terraform

No significant changes in this release.