github.com/ory/hydra

This release contains mostly minor bug fixes and allows more granular control for listening on unix sockets.

Bug Fixes

• Bump pop to v5.2 (#1922) (5097805), closes #1892

• Do not log error at login/consent cancelation (#1914) (379eed3), closes #1912

• Improve Makefile dependency management (#1918) (5359276), closes #1916:

  This install dependencies only when you make a target that needs it.

  This also removes the check that certain system dependencies (e.g. go) are installed. Instead, we simply let the target fail. This ensures we only test for the desired dependencies.

Code Generation

• Pin v1.5.2 release commit (4d2cd48)

Features

• Allow modifying unix socket permissions (#1915) (b19b7cf):

  This allows the reverse proxy to actually read the unix socket, since

  • The default permissions are 0755
  • Hydra is usually run as a user different than the reverse proxy
  • One needs read and write permissions to connect to the socket

  With the commit, one can set the group to be a group that contains the reverse proxy user and permissions to 0770

The 1.5.1 release includes several big changes to the internal code base and introduces exciting new features! It combines several beta releases that have been battle-tested by the community. Please use the 1.5.1 release instead of the 1.5.0 release which had issues with the CI pipeline! This release

• changes how migrations work internally. It does not contain breaking changes but please run hydra migrate sql once you have backed up the database;
• improves CockroachDB ZigZag query performance;
• OAuth2 clients are now able to use other token_endpoint_auth_signing_algorithms than RS256
• introduces Zipkin tracing support;
• improves the documentation in several locations;
• greatly improves structured logging output;
• supports unix sockets in the ORY Hydra CLI;
• uses the new ORY CLI as part of the toolchain;
• and resolves several other bugs and issues!

We would like to thank our amazing community and all contributors that have helped in making this release possible (in no particular order):

• https://github.com/rickwang7712
• https://github.com/bayansar
• https://github.com/sawadashota
• https://github.com/ka3de
• https://github.com/dalcde
• https://github.com/timsazon
• https://github.com/robhinds
• https://github.com/arkady-bagdasarov
• https://github.com/arapaho
• https://github.com/lopezator
• https://github.com/pjediny

If you haven't yet, consider joining our Slack family!

Code Generation

• Pin v1.5.1 release commit (af8d7a6):

  Bumps from v1.5.0-beta.1

The 1.5 release includes several big changes to the internal code base and introduces exciting new features! It combines several beta releases that have been battle-tested by the community. This release

• changes how migrations work internally. It does not contain breaking changes but please run hydra migrate sql once you have backed up the database;
• improves CockroachDB ZigZag query performance;
• OAuth2 clients are now able to use other token_endpoint_auth_signing_algorithms than RS256
• introduces Zipkin tracing support;
• improves the documentation in several locations;
• greatly improves structured logging output;
• supports unix sockets in the ORY Hydra CLI;
• uses the new ORY CLI as part of the toolchain;
• and resolves several other bugs and issues!

We would like to thank our amazing community and all contributors that have helped in making this release possible (in no particular order):

• https://github.com/rickwang7712
• https://github.com/bayansar
• https://github.com/sawadashota
• https://github.com/ka3de
• https://github.com/dalcde
• https://github.com/timsazon
• https://github.com/robhinds
• https://github.com/arkady-bagdasarov
• https://github.com/arapaho
• https://github.com/lopezator
• https://github.com/pjediny

If you haven't yet, consider joining our Slack family!

Bug Fixes

• Add config schema for log.leak_sensitive_values (#1905) (d954649)

• Properly return when subject is empty (#1909) (5b54519), closes #1842

• Remove duplicated tracing logger (#1900) (48c2c6d)

• Same site legacy workaround on iOS 12 (#1908) (128ad98), closes #1907:

  Enables legacy compatibility on iOS version < 13 and macOS version < 10.15

  #1810 incorrectly implements https://web.dev/samesite-cookie-recipes/#handling-incompatible-clients

  Notice Set-cookie: 3pcookie-legacy=value; Secure the cookie does not have the SameSite attribute present. The http.SameSiteDefaultMode used in hydra implementation results in attribute without the value, see https://github.com/golang/go/blob/release-branch.go1.14/src/net/http/cookie.go#L221

  That triggers the problems with the older iOS and macOS versions, as Apple did not follow the https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00#section-4.1 see https://trac.webkit.org/browser/webkit/trunk/Source/WebInspectorUI/UserInterface/Models/Cookie.js?rev=239226#L118

• Use .bin in PATH and improve CI tasks (#1897) (9c6eba8)

Chores

• Pin v1.5.0 release commit (dff6c21):

  Bumps from v1.4.10

Documentation

• Add hint for login different subject (#1880) (8f7227c):

  Add hint to allow login provider login different subject when there is already an authentication of another subject.

• Delete old redirect homepage (45595dc)

• Use mdx for api reference (5709439)

Features

• Add Zipkin support (#1904) (05bf907)
• Allow unix socket as --endpoint (#1899) (6999a82)
• Log errors with request information (#1893) (4bfbddb)
• Support jwt signing alg other than RS256 (#1889) (fe8d77f), closes #1817

Unclassified

• Add www-authenticate at userinfo endpoint (#1891) (e785bc7), closes #1827