Ory Hydra, Ory Kratos, Ory Keto, Ory Polis, Ory Elements v26.4.16 released

Ory Hydra

Configure outbound HTTP limits per feature

Hydra now supports shared outbound HTTP settings under default_http_client and feature-specific overrides for hooks, logout notifications, client key fetching, OpenID Connect Request Objects, sector identifiers, and the Kratos integration. Configure timeouts, retries, response-size limits, and private-IP restrictions without changing other integrations.

The legacy clients.http settings are deprecated and remain supported. Move them to default_http_client.private_ip_ranges, renaming disallow_private_ip_ranges to disallow and private_ip_exception_urls to exception_urls. Remove the old settings after migrating. Existing timeout and retry defaults remain unchanged.

When both old and new settings are present, feature-specific settings take precedence over default_http_client, which takes precedence over the legacy settings. An explicitly empty exception list clears inherited exceptions.

Breaking change

JWKS fetching, OpenID Connect Request Object fetching, back-channel logout, and sector identifier validation no longer use global or legacy private-IP exception URLs. Their HTTP client settings reject private_ip_ranges.exception_urls, including empty lists. When private-IP blocking is enabled, use publicly reachable endpoints for these client metadata URLs. Kratos and token hooks retain support for private-IP exceptions.

Token hooks, refresh-token hooks, and sector identifier responses retain their default 5 MiB response limit. Reading beyond that limit now reports a response-size error instead of end-of-file, so error details may change.

Revoking consent revokes all of the subject's tokens

Revoking a subject's OAuth2 consent sessions now revokes every access and refresh token issued to that subject, or to that subject and client when you revoke consent for a single client, as documented. Before, Ory Open Source only revoked tokens issued for a consent session that still existed.

Breaking changes

Tokens that never belonged to a consent session are revoked too, such as tokens from the resource owner password credentials grant and the JWT bearer grant. If you rely on such tokens staying valid when you revoke the subject's consent, issue new tokens afterwards or use a different subject for them.

This is now available for the Ory Enterprise License and will be part of the next Ory Open Source release.

Ory Kratos

Login failure web hooks receive the matched identity

When Ory Kratos Identities matches a failed login attempt to an identity, the login failure web hook now gets that identity in ctx.identity, as the login after web hooks do. Your endpoint can read the identity's external_id, traits, and public metadata without calling the admin API for each failed login. Credential secrets and admin metadata aren't included.

This is now available on Ory Network and for the Ory Enterprise License.

Ory Keto

Plan for Keto relationship index builds when upgrading

On PostgreSQL, CockroachDB, YugabyteDB, and SQLite, keto migrate up adds four partial indexes on keto_relation_tuples for relationship pagination. MySQL indexes do not change.

IndexColumnsRowsketo_relation_tuples_forward_sets_idxnid, namespace, object, relation, subject_set_namespace, subject_set_relation, subject_set_object, shard_idsubject_id IS NULLketo_relation_tuples_forward_ids_idxnid, namespace, object, relation, subject_id, shard_idall subject_set_* NULLketo_relation_tuples_reverse_sets_idxnid, subject_set_namespace, subject_set_object, subject_set_relation, relation, namespace, object, shard_idsubject_id IS NULLketo_relation_tuples_reverse_ids_idxnid, subject_id, relation, namespace, object, shard_idall subject_set_* NULL

Each build reads the whole table, so allow time and disk headroom on large installations. PostgreSQL, CockroachDB, and YugabyteDB build without locking the table. The existing indexes stay, so each tuple is in five secondary indexes instead of three until a later release removes the old ones; include the added write and storage cost in your capacity planning.

If a PostgreSQL build is interrupted, it leaves an invalid index that a later migration run does not rebuild. Check pg_index.indisvalid and run REINDEX INDEX CONCURRENTLY <index name> to repair it.

This is now available for the Ory Enterprise License and will be part of the next Ory Open Source release.

Ory Polis

Restrict which SAML fields can supply the subject

You can now list which sources Ory Polis may use as the subject (sub) of a SAML login: a named attribute, the NameID (optionally limited to a format such as persistent), or a hash of the email. Set SAML_SUBJECT_SOURCES for the deployment or subjectSources on a connection. A login whose assertion carries none of the listed sources fails instead of falling back to another identifier.

The setting limits where the subject comes from. It does not make a source unique. If you list a source that your identity provider sends with the same value for every user, such as nameid when the NameID is shared, those users still get one subject. List only sources that are unique for each user.

Without the setting, the subject is resolved as before. Changing the sources of an existing connection can change the subject of existing users. A user whose subject came from a source you removed can no longer log in when the assertion carries no other listed source, and gets a different subject when it does.

This is now available for the Ory Enterprise License and will be part of the next Ory Open Source release.

Ory Elements

Ory Elements proxies keep session cookies on the app's host

The Ory proxy of @ory/ssr, @ory/nextjs, @ory/react-router, and @ory/tanstack-start now passes the cookies Ory returns to the browser without a Domain attribute, so the browser sends them only to the host that set them, for example app.example.com. Before, the proxy set Domain to the registrable domain, such as example.com, and every host under it received the session cookie.

The proxy now sets the Secure attribute on every cookie it returns over HTTPS, including when a proxy in front of the app reports HTTPS in X-Forwarded-Proto, and otherwise keeps it as Ory sent it. It removes Secure only for plain-HTTP requests to localhost, *.localhost, 127.0.0.1, or [::1], so local development keeps working in every browser.

Breaking changes

If another host under the same domain reads the session cookie the proxy set, for example an API at api.example.com that calls /sessions/whoami with the cookie from app.example.com, set forceCookieDomain to the shared domain in the proxy options:

createOryMiddleware({
  forceCookieDomain: "example.com",
  trustedOrigins: ["https://app.example.com"],
})

Browsers keep a session cookie that an earlier version of the proxy set on the registrable domain until it expires. A user who logs out and in again before then has two session cookies, and Ory reads the old one, so the login seems to fail. Set forceCookieDomain to that domain to keep the previous scope, or wait for the old cookies to expire. Clearing cookies fixes it right away.

Testing over plain HTTP on a host other than localhost, such as a LAN address, no longer stores the session cookie. Use HTTPS or localhost instead.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Network, Ory Oathkeeper, and Ory Terraform

No significant changes in this release.