github.com/ory/hydra

This is a security-focused release with fixes for CVE-2020-15234, CVE-2020-15223, CVE-2020-15233. Upgrading is strongly advised!

A few things have changed as part of these patches:

• OAuth2 Redirection URL error parameters error_hint, error_debug have been deprecated and are now part of error_description. The parameters are still included for compatibility reasons but will be removed in a future release.
• OAuth2 Error revocation_client_mismatch was not standardized and has been removed. Instead, you will now receive unauthorized_client with a description explaning why the flow failed.

Additionally, the TypeScript SDK generator has changed from OpenAPI's typescript-node to typescript-axios making the SDK compatible with both browser as well as node environments, which was not the case previously. Please be aware that some of the SDK's API signatures - especially responses - have changed and check your TypeScript output for instructions on upgrading. You may still use an older version of the SDK as none of ORY Hydra's HTTP APIs have changed.

New features have been added and bugs have been closed. No migrations are required when applying this release. Please check the list below for an in-depth overview.

Breaking Changes

As part of this patch, a few things have changed in a breaking fashion:

• OAuth2 Redirection URL error parameters error_hint, error_debug have been deprecated and now part of error_description. The parameters are still included for compatibility reasons but will be removed in a future release.
• OAuth2 Error revocation_client_mismatch was not standardized and has been removed. Instead, you will now receive unauthorized_client with a description explaning why the flow failed.

Bug Fixes

• Bump deps to patch CVE-2020-15223 (#2067) (b36073a)

• Bump ory/fosite to v0.34.1 to address CVEs (0561d74)

• Delete obsolete patch (1b99ce3)

• Downgrade log level for access rejections (#2038) (82208c4), closes #2031

• Ignore x/net false positives (fd14ad3)

• Remove docker-e2e file (096bc0c):

  The file and build pipeline have moved to https://github.com/ory/e2e-env.

• Support HTTP POST method for logout (#2043) (29b2af4)

• Update link to config docs displayed on hydra serve help (#2071) (d619fab), closes #2065

Code Generation

• Pin v1.8.0-pre.0 release commit (293c3ac)

Documentation

• Add missing word in sentence (#2082) (7a72083)

• Corrected documentation links (#2045) (#2047) (9e8c2e3)

• Fix broken link (ab3afec)

• Fix dead image links (#2053) (759ab16)

• Fix regression issues and OOM build error (f20f844)

• Fix relative path in consent flow doc (#2063) (2b0f87f)

• Fix typo "pariwise" on advanced flows page (bcd2de0)

• Fix typo (#2052) (d1f5ecc):

  s̶i̶g̶n̶l̶e̶ ̶p̶a̶g̶e̶ ̶a̶p̶p̶ ➡️ single page app

• Gitlab hydra integration (#2014) (e2bc127)

• Improve before-oauth2 (8bcb8c9)

• Minor typo in limitations.md (#2048) (42d85ee):

  It said "an maximum" but I believe it should be "a maximum".

• Resolve broken link (eedb1f8)

• Update logout flow docs based on new spec (#2044) (d8d4f1e), closes #1994

• Update pkg.go.dev link in README (#2084) (ce3515f):

  Remove www from the pkg.go.dev path.

• Use relative paths (5107e58)

Features

• Add client update command in cli (444d26d)

• Add DataDog support (#2056) (5a0236a), closes #1957

• Allow to automatically set GOMAXPROCS according to linux container quota (#2034) (39652ac)

• API for deleting a client's access tokens (#2058) (077c54a), closes #1728

• Improving the client update command description (85b6e86)

• Metrics prometheus endpoint should not require x-forwarded-proto header (#2074) (7d3a1c8), closes #2072:

  • moved MetricsPrometheusPath constant to metrics/prometheus/metrics.go
  • added rule to allow insecure requests for MetricsPrometheusPath endpoint
  • arranged tls_termination_test.go test to cover all cases in RejectInsecureRequests function