Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Polis, Ory Elements v26.4.0 released

Ory Network

Correlate the events of one request in event streams

Events delivered through a live event stream now carry a TraceID key in eventAttributes. All events that Ory emits while handling one request share the same value, including events from different Ory services that took part in that request, such as Ory Identities completing a login and Ory OAuth2 accepting it. The value is the W3C Trace Context trace ID of the request: 32 lowercase hexadecimal characters.

TraceID is absent when no trace ID is available and on events that summarize many requests, such as PermissionsChecked. Existing consumers keep working without changes.

Make passkey authenticator, attestation, and timeout options configurable

The passkey strategy now exposes advanced configuration under selfservice.methods.passkey.config that was previously hardcoded:

• authenticator_selection.attachment, resident_key, and user_verification control which authenticators are eligible and whether biometrics or a PIN are required. attachment now defaults to no constraint, so by default users can register either platform or cross-platform authenticators. Set attachment: "platform" to restore the previous behavior of accepting only built-in authenticators.

• attestation.preference sets the attestation conveyance preference sent to the authenticator.

• timeouts.registration and timeouts.login set how long the WebAuthn ceremonies stay valid.

All options are optional. Defaults match the previous behavior, so existing projects do not need to change anything. See the passkey documentation for a full reference and examples.

Projects created with the Ory CLI or Terraform get the Ory Console's default actions

Projects that you create with the Ory CLI or the Ory Terraform provider now get the same default actions as projects that you create in the Ory Console:

• Users are signed in after they register with a password.

• When a user changes their password or recovers their account, all their other sessions are revoked. The session they used stays active.

If your automation creates projects and expects users not to be signed in after registration, or expects other sessions to stay active, remove these actions from the identity configuration after you create the project. A project that you create through the API with a list of hooks, including an empty list, keeps exactly those hooks.

Existing projects are not changed. To revoke other sessions in an existing project, turn on Revoke other sessions after password change in Authentication > Sessions and Revoke other sessions after recovery in Authentication > Account recovery.

Read more about revoking other sessions.

This is now available on Ory Network.

Ory Hydra

Remembered login sessions expire on the server

Hydra now ends a remembered login session on the server at the time the login provider requested with remember_for, capped at ttl.authentication_session. Browsers already discarded the session cookie at that time, so sign-in behavior does not change.

Front-channel and back-channel logout notifications are sent only while the login session is valid. A logout for a session older than remember_for completes without notifying clients.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Kratos

Fix native app SAML sign-in for first-time users

Native apps using SAML with the session token exchange now receive their return_to redirect when a user signs in for the first time.

Previously, only users who already had a SAML credential were redirected back to the app's return_to URL with the exchange code. When SAML sign-in created a new identity, Ory instead returned a 200 OK JSON response containing the session token. The app never received its callback and could not complete the token exchange, so every user's first SAML sign-in failed while later sign-ins worked.

This also stops the session token from being rendered in the browser on that response.

Make passkey authenticator, attestation, and timeout options configurable

The passkey strategy now exposes advanced configuration under selfservice.methods.passkey.config that was previously hardcoded:

• authenticator_selection.attachment, resident_key, and user_verification control which authenticators are eligible and whether biometrics or a PIN are required. attachment now defaults to no constraint, so by default users can register either platform or cross-platform authenticators. Set attachment: "platform" to restore the previous behavior of accepting only built-in authenticators.

• attestation.preference sets the attestation conveyance preference sent to the authenticator.

• timeouts.registration and timeouts.login set how long the WebAuthn ceremonies stay valid.

All options are optional. Defaults match the previous behavior, so existing projects do not need to change anything. See the passkey documentation for a full reference and examples.

Projects created with the Ory CLI or Terraform get the Ory Console's default actions

Projects that you create with the Ory CLI or the Ory Terraform provider now get the same default actions as projects that you create in the Ory Console:

• Users are signed in after they register with a password.

• When a user changes their password or recovers their account, all their other sessions are revoked. The session they used stays active.

If your automation creates projects and expects users not to be signed in after registration, or expects other sessions to stay active, remove these actions from the identity configuration after you create the project. A project that you create through the API with a list of hooks, including an empty list, keeps exactly those hooks.

Existing projects are not changed. To revoke other sessions in an existing project, turn on Revoke other sessions after password change in Authentication > Sessions and Revoke other sessions after recovery in Authentication > Account recovery.

Read more about revoking other sessions.

Restrict origins to session checks, FedCM, and logout

The new security.restricted_origins setting lists origins for pages that load scripts you don't control, such as ads, but need to know whether the user is signed in.

Requests from a restricted origin can only call /sessions/whoami, the FedCM endpoints, and the logout endpoints. All other public endpoints respond with 403 Forbidden. Responses never contain identity data: a session contains only its ID and whether it's active, and tokenize_as fails with 400 Bad Request. The restrictions also apply while CORS is disabled. Keep the origin in serve.public.cors.allowed_origins so that the browser can read the responses. Requests without an Origin header are unchanged.

Restrict origins to session checks, FedCM, and logout

You can now mark CORS origins as restricted with the new Ory Identities setting security.restricted_origins. Use it for pages that load scripts you don't control, such as ads, but need to know whether the user is signed in:

ory patch project <your-project-id> \
  --replace '/services/identity/config/security/restricted_origins=["https://www.example.com"]'

Requests from a restricted origin can only check the session with GET /sessions/whoami, sign in with FedCM, and log out. All other public endpoints respond with 403 Forbidden. Responses never contain identity data: a session contains only its ID and whether it's active, and tokenize_as fails with 400 Bad Request. Requests from other origins and from your server are unchanged.

Each entry is an exact origin without wildcards or paths. Keep the origin in your CORS allowed origins, or in the custom domain's CORS origins, so that the browser can read the responses.

Size limits for remote files and upstream responses

Ory now rejects files loaded from a URL (http://, https://, file://, or base64://) and upstream responses that exceed a size limit, instead of reading them in full. If a fetch exceeds its limit, the operation fails. Ory Kratos also logs a warning that names the source and the limit.

SourceLimitOry Kratos: Jsonnet templates and claims mappers loaded from a URL (webhooks, courier, OpenID Connect, SCIM, session tokenizer)1 MiBOry Kratos: token and user info responses from social sign-in providers1 MiBOry Talos: JSON Web Key Sets loaded from a URL1 MiBAny other file loaded from a URL, such as courier templates or Ory Permission Language files in Ory Keto5 MiB

If you expect to use a file larger than these limits, reduce its size before upgrading.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Keto

Size limits for remote files and upstream responses

Ory now rejects files loaded from a URL (http://, https://, file://, or base64://) and upstream responses that exceed a size limit, instead of reading them in full. If a fetch exceeds its limit, the operation fails. Ory Kratos also logs a warning that names the source and the limit.

SourceLimitOry Kratos: Jsonnet templates and claims mappers loaded from a URL (webhooks, courier, OpenID Connect, SCIM, session tokenizer)1 MiBOry Kratos: token and user info responses from social sign-in providers1 MiBOry Talos: JSON Web Key Sets loaded from a URL1 MiBAny other file loaded from a URL, such as courier templates or Ory Permission Language files in Ory Keto5 MiB

If you expect to use a file larger than these limits, reduce its size before upgrading.

This is now available for the Ory Enterprise License and will be part of the next Ory Open Source release.

Ory Polis

OpenTelemetry metrics follow the standard protocol and configuration

Ory Polis now sends OpenTelemetry metrics in the protocol you configure. OTEL_EXPORTER_OTLP_METRICS_PROTOCOL and OTEL_EXPORTER_OTLP_PROTOCOL accept grpc, http/protobuf and http/json; the metrics-specific variable takes precedence. Previously only grpc was honored and every other value, including http/protobuf, sent OTLP over HTTP/JSON.

The export schedule can now be set with the standard OTEL_METRIC_EXPORT_INTERVAL and OTEL_METRIC_EXPORT_TIMEOUT variables, in milliseconds, and the SDK's own diagnostic logging with OTEL_LOG_LEVEL. The previous OTEL_EXPORT_INTERVAL_MS and OTEL_EXPORTER_DEBUG variables are deprecated but still work when the standard ones are unset.

Metrics are now flushed when Polis receives SIGTERM or SIGINT, so the values recorded since the last periodic export are no longer lost on shutdown.

See Environment variables.

Breaking changes

When neither protocol variable is set, metrics are now sent as http/protobuf, the OpenTelemetry default, instead of http/json. If your collector accepts only JSON, set OTEL_EXPORTER_OTLP_METRICS_PROTOCOL=http/json before upgrading.

If you set OTEL_EXPORTER_OTLP_METRICS_PROTOCOL=http/protobuf, which the polis-oel Helm chart does by default, Polis now sends protobuf as configured rather than JSON. This is the correct behavior, but a collector that was relying on receiving JSON at that endpoint needs to accept protobuf.

This is now available for the Ory Enterprise License and will be part of the next Ory Open Source release.

Ory Elements

The @ory/nextjs middleware forwards the browser's origin headers

The Next.js middleware now forwards the browser's Origin, Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User request headers to Ory, so Ory sees the same origin signals as for a request the browser sends to Ory directly.

Breaking changes

Ory rejects API flows submitted from a browser. Before this release, the middleware dropped the Origin header, so an API flow submitted from the browser through the middleware went through. It is now rejected the same way as when the browser submits it to Ory directly. If your app submits API flows from the browser, switch to browser flows. API flows are for native apps.

This will be available in the next Ory Open Source release.

Ory Oathkeeper and Ory Terraform

No significant changes in this release.