github.com/ory/hydra

We are excited to announce Ory Hydra v1.10.0!

This release adds significant data management improvements. As such, we introduce the new "hydra janitor" command which cleans up stale data and can be run, for example, as a (Kubernetes) CronJob.

The new janitor command is able to clean up invalid and expired access and refresh tokens as well as login and consent requests. This solves issues observed in installations with lots of traffic.

This patch refactors the internal file embed system by migrating to Go 1.16, simplifying and speeding up the build process.

To follow OAuth2 best-practice, refresh tokens will now invalidate the whole access and refresh token chain if reused.

Bug Fixes

• Add docs/node_modules make target (b302501)

• Add network specific error message to avoid confusion (#2367) (56d71e6), closes #2338

• Adds sqa section to config.schema.json (#2360) (89df8d7), closes #2358:

  Move from viper to koanf caused env vars without corresponding paths in config.schema.json to be ignored. This commit adds missing sqa section, so the SQA_OPT_OUT env var has effect again.

• Adopt new cli renderer pipeline (02483ce)

• Better http resiliency and sqlite updates (883a84f)

• Improve cache and update CI images to go 1.16 (#2388) (7803202)

• Increase conformance test timeout (e9bd064)

• Record cypress videos (c9d0a26)

• Resolve clidoc issues (8257cb2)

• Resolve docs build issues (6612099)

• Resolve e2e test issues (4812f54)

• Resolve migrator duplicate files (b1f63ff)

• Resolve migrator regression issues (cdfc03d)

• Revert mode default and maximum values (#2349) (b20fc48):

  I made a mistake in previous pull request, these socket mode values are in decimal, not octal format. Sorry.

• Update janitor help (b7965c6)

• Use appropriate migrations with precedence (b61d05c)

• Use gelf windows hotfix (0cac0f1)

• Use go 1.16 in conformity suite (3fbda05)

Code Generation

• Pin v1.10.1 release commit (2287ac5)

Documentation

• Faq custom data (#2334) (471e85d)

• Fix basic examples for the golang SDK (#2399) (6806865)

• Fix subject identifier algorithms to match configuration (#2400) (dd19b86):

  On https://www.ory.sh/hydra/docs/reference/configuration/ under 'subject identifiers' the name for defining which subject identifier algorithms are supported it is called "supported_types", not "enabled" as in these pages.

• Improve readme tests section (#2380) (277afe9)

• Quickstart config (#2328) (f20f645)

• Update config.schema.json default values (#2348) (8494822):

  Updated wrong config schema values

• Update examples to new helm install command format (#2369) (f006556):

  Tried example with helm 3.5.2 and it does not support --name flag. So I moved name and repository to first line of commands.

Features

• Add --no-shutdown flag to "hydra token user" to prevent auto-termination (#2382) (#2386) (a17d10e)

• Add front/backchannel logout params to client cli (#2387) (055f801), closes #1487

• Flush inactive/expired login and consent requests (#2381) (f039ebb), closes #1574:

  This patch resolves various table growth issues caused by expired/inactive login and consent flows never being purged from the database.

  You may now use the new hydra janitor command to remove access & refresh tokens and login & consent requests which are no longer valid or used. The command follows the notAfter safe-guard approach to ensure records needed to be kept are not deleted.

  To learn more, please use hydra help janitor.

  This patch phases out the /oauth2/flush endpoint as the janitor is better suited for background tasks, is easier to run in a targeted fashion (e.g. as a singleton job), and does not cause HTTP timeouts.

• Flush refresh tokens for service oauth2/flush (#2373) (b46a14c):

  See https://github.com/ory/hydra/issues/1574#issuecomment-736684327

• Move to go 1.16 and static embed files (6fa591c)

• Refresh token reuse detection (#2383) (bc349f1), closes #2022:

  This patch adds support for Refresh Token reuse Detection introduced by https://github.com/ory/fosite/pull/567. Ory Hydra's persister no longer deletes refresh tokens when using them, but instead deactivates them - similar to how authorization codes work.

Tests

• Bump cypress to newer version and add resilience (c76309c)
• Bump ory/x and resolve regressions (1a03c07)
• Fix record arg (b248406)
• Improve e2e script and add record option (9d4764d)
• Resolve flaky cypress tests (356b05f)
• Resolve migration regression (e59e2bc)
• Use cypress fetchers (2aa0980)
• Use go 1.16 in conformity (ccd983d)

Unclassified

• Do not send 404 on revoke consent / delete login (#2397) (854b9ee)
• Resolve oidc conformity regression (1049602)