1_6_6.md

doc/release_notes/1_6_6.md

1.6.6

Improvements

  • Authorization form params will now be exposed to the HTML rendering via the rodauth.authorize_form_params; this not only reduces the size of the bundled forms, but also makes it much easier to add or remove features with their own required authorize params.

  • :oauth_jwt_base feature: new :oauth_jwt_iat_leeway option (defaults to 30, as in seconds), is used now to make the JWT claim iat claim tolerant to clock skew. This option is used in both the jwt and json/jwt gem integrations.

  • :oauth_pkce feature: new :oauth_pkce_allow_plain_method option, which may disallow the usage of "plain" as a PKCE challenge method

  • defaults to true in order not to break backwards compatibility, but this is going to change in a future version, so you are recommended to set it explicitly in order not to break your application in a future upgrade.

Bugfixes

  • (critical) :oauth_dynamic_client_registration feature: PUT /register was incorrectly authenticating the request (responding with 200 when secret didn’t match), thereby allowing anyone (else) to update application parameters.

  • (critical) :oauth_dynamic_client_registration feature: PUT /register was not hashing the client secret when hashing on the client secret was enforced.

  • :oauth_authorization_code_grant feature: escape untrusted values in the authorize form (hidden request params, the "state" in the cancel link, the client application name), in the authorize form post POST response form, and in the device verification template.

  • token endpoint: enforce 4XX HTTP responses with JSON encoded body when there are errors (instead of making it rely on the “accept” HTTP header).

  • client authentication: fallback to oauth_default_token_endpoint_auth_methods when the application being authentication has no token_endpoint_auth_method set (instead of assuming it as “none”).

  • :oauth_dynamic_client_registration feature: client metadata which the server does not understand is now ignored (RFC 7591 section 3.1), instead of failing the registration with an "invalid_client_metadata" error.

  • :oauth_dynamic_client_registration feature: fix typo which was exposing client_secret in the registration response in cases where it shouldn’t.

  • :oauth_dynamic_client_registration feature: emit "client_id_issued_at" as epoch seconds instead of an ISO8601 string, as per RFC 7591.

  • :oauth_dynamic_client_registration feature: remove “registration_access_token” and “registration_client_uri” parameters from the payload (these are only valid for the OIDC counterpart).

  • json/jwt: decoding a JWT was bypassing claims verification.

Security

  • Using rodauth timing_safe_eql? helper method, a string comparison function which is safe against timing attacks, in client secret matching and PKCE verification.