Releases | Ecosyste.ms: Ruby

https://github.com/doorkeeper-gem/doorkeeper - v5.9.9

Fix: AuthorizedApplicationsController now answers 401 Unauthorized instead of running with a nil resource owner, which listed and revoked every token that has no resource owner — the ones the client credentials flow issues. Affected host applications are those whose resource_owner_authenticator answers nil without halting the request itself; the generated initializer's example redirects and is not affected.
Fix: AuthorizationsController#destroy now validates the client and redirect URI before producing the deny response, and renders — never redirects — when validation fails. Previously the deny path performed no OAuth-layer validation at all, allowing an open redirect to an attacker-controlled origin with the OAuth state attached. Also reject unregistered response_type values on the authorization endpoint rather than resolving them through the constantize fallback.
Fix: refuse redirect URIs with a script scheme (javascript, vbscript, data) both when an application is registered and at authorization time, regardless of forbid_redirect_uri. Such a URI is never a legitimate redirection endpoint, and with response_mode=form_post it became the action of the auto-submitting form the authorization server renders on its own origin. Already stored records with such a URI are now refused with invalid_redirect_uri before the consent screen is shown.
[#1938] Fix: a request body ActionDispatch cannot parse (malformed JSON under a JSON content type, say) no longer raises ActionDispatch::Http::Parameters::ParseError out of Doorkeeper::OAuth::Token.from_request and doorkeeper_token. Since 5.9.7 the RFC 6750 §2 multi-method check read the body on every request, so such a request raised even when it carried a valid Bearer header. The body is now treated as carrying no token, the same way ActionDispatch's own #filtered_parameters treats that error.

- Ruby
Published by nbulaj 9 days ago

https://github.com/doorkeeper-gem/doorkeeper - v6.0.0.rc2

Please make sure you read the Upgrade guides
and changelog below before the update since this version includes breaking changes.

[#1951] Fix: the built gem no longer contains vendor/bundle. The gemspec globed all of vendor/, which swept in the bundle installed by the release workflow; 6.0.0.rc1 is a 44.4 MB download against 154 KB for 6.0.0.beta2.
Fix: AuthorizedApplicationsController now answers 401 Unauthorized instead of running with a nil resource owner, which listed and revoked every token that has no resource owner — the ones the client credentials flow issues. Affected host applications are those whose resource_owner_authenticator answers nil without halting the request itself; the generated initializer's example redirects and is not affected.
Fix: AuthorizationsController#destroy now validates the client and redirect URI before producing the deny response, and renders — never redirects — when validation fails. Previously the deny path performed no OAuth-layer validation at all, allowing an open redirect to an attacker-controlled origin with the OAuth state attached. Also reject unregistered response_type values on the authorization endpoint rather than resolving them through the constantize fallback.
Fix: refuse redirect URIs with a script scheme (javascript, vbscript, data) both when an application is registered and at authorization time, regardless of forbid_redirect_uri. Such a URI is never a legitimate redirection endpoint, and with response_mode=form_post it became the action of the auto-submitting form the authorization server renders on its own origin. Already stored records with such a URI are now refused with invalid_redirect_uri before the consent screen is shown.
[#1932] Fix: keep the scope originally granted by the resource owner on refresh tokens (RFC 6749 §6), so a chain narrowed on one refresh can return to its granted scope. Tracked in a new refresh_token_scopes column; existing installations opt in with rails generate doorkeeper:refresh_token_scopes.
[#1933] Warn at boot when the implicit or password grant flow is enabled: both are deprecated by RFC 9700 (OAuth 2.0 Security BCP) and removed from OAuth 2.1, and may be removed in a future Doorkeeper release.
[#1915] Fix: fetching a client's jwks_uri now falls back to the other addresses returned by DNS when the first one cannot be connected to.
[#1934] The refresh_token grant now consults custom_access_token_expires_in (with Doorkeeper::OAuth::REFRESH_TOKEN as the context grant type) for the TTL of the refreshed access token. A callable that returns nil for this grant, or no callable at all, keeps inheriting the TTL of the token being refreshed as before. A callable that returns a value unconditionally now applies to refreshes as well.
[#1935] Add opt-in public_client_access_token_expires_in configuration option: a ceiling for the lifetime of access tokens issued to public (non-confidential) clients by any grant, refresh_token included, as OAuth 2.1 Section 2.4 requires the exposure of tokens issued to unauthenticated clients to be limited. Confidential clients are not affected.
[#1938] Fix: a request body ActionDispatch cannot parse (malformed JSON under a JSON content type, say) no longer raises ActionDispatch::Http::Parameters::ParseError out of Doorkeeper::OAuth::Token.from_request and doorkeeper_token. Since 5.9.7 the RFC 6750 §2 multi-method check read the body on every request, so such a request raised even when it carried a valid Bearer header. The body is now treated as carrying no token, the same way ActionDispatch's own #filtered_parameters treats that error.
[#1950] Document hash_token_secrets / hash_application_secrets fallback: as a migration-period setting that should be removed once every row is hashed, and warn at boot for as long as one is configured. While a :plain fallback is active the stored value is itself a valid credential, so those columns need protecting as carefully as plaintext ones.
[#1953] Fix: public_client_access_token_expires_in now also holds under reuse_access_token and with String TTLs, and the refresh_token grant hands custom_access_token_expires_in and resource_indicator_validator what every other grant does.

- Ruby
Published by nbulaj 9 days ago

https://github.com/doorkeeper-gem/doorkeeper - v5.9.7

Refuse requests that transmit an access token by more than one method (RFC 6750 §2), instead of silently authorizing with the first configured access_token_methods entry that matched and discarding the other tokens. Such a request now fails closed as carrying no usable token (401 invalid_token); no calling contract changes. The form-encoded body (§2.2) and the URI query (§2.3) count as two methods even though Rails and Rack merge them into a single params hash. The same token repeated across two methods is refused too — §2 forbids the second method, not a disagreement between the two — and a custom callable extractor in access_token_methods keeps the historical first-wins behavior and is never invoked more than once. (The strict invalid_request (400) answer §3.1 prescribes ships with Doorkeeper 6.0.)
[#1925] Internal: pin the development dependency on json below 3.0. json 3 removed the positional options Hash from JSON.parse and the quirks_mode option from JSON.generate, both of which Active Support still uses, so the suite could not run on any supported Rails version.

- Ruby
Published by nbulaj 23 days ago

https://github.com/doorkeeper-gem/doorkeeper - v6.0.0.rc1

Please make sure you read the Upgrade guides
and changelog below before the update since this version includes breaking changes.

Require Ruby >= 3.2 in the gemspec, matching the CI matrix (3.2 / 3.3 / 3.4 / 4.0). Ruby 2.7, 3.0 and 3.1 have reached end-of-life.
Fix: the client_secret_basic strategy now requires a client_id sent in the request body to name the same client as the Authorization: Basic header — the RFC 7521 §4.2 agreement check private_key_jwt already applies to an assertion's issuer. A request presenting Basic credentials for one client and a client_id for another was authenticated as the Basic client, silently discarding the other identity. A bare client_id is not a client authentication method of its own, so the RFC 6749 §2.3 multiple-methods check does not (and should not) count it.
[#1906] Internal: exempt Doorkeeper::Config from Metrics/ClassLength with a directive on the class itself instead of raising the cop's global ceiling, so adding a configuration option no longer trips the limit.
[#1907] Fix: a resource parameter no longer produces a 500 at the authorization endpoint when resource_indicator_validator is configured without the doorkeeper:resource_indicators migration. Such a request is now answered with server_error, as the token endpoint already did, and the missing migration is warned about at boot.
[#1909] Add Rails 8.1 to CI test matrix.
[#1910] Add opt-in validate_client_before_resource_owner_authentication configuration option: the authorization endpoint validates client_id and redirect_uri before authenticating the resource owner, so users are not sent through login for a request that can only fail.
[#1916] Fix broken Coveralls coverage reporting.
[#1918] The api_only controller specs no longer load the real controller sources, which detached the coverage of every other example that ran them and made the reported coverage depend on the random example order.
[#1923] Fix: the fallback secret upgrade no longer writes the matched secret back over a value stored in the meantime, which could undo a concurrent #renew_secret and leave the superseded secret valid. Active Record writes the upgrade conditionally on the column still holding the value that matched; other ORMs can implement the new write_upgraded_secret hook. The Active Record write is a single update_all statement, so model callbacks and validations no longer run on this upgrade (timestamps and optimistic locking are still maintained).
[#1925] Internal: pin the development dependency on json below 3.0. json 3 removed the positional options Hash from JSON.parse and the quirks_mode option from JSON.generate, both of which Active Support still uses, so the suite could not run on any released Rails version.
[#1926] [BREAKING] Fix: private_key_jwt client authentication no longer accepts an audience derived from the request's Host header, which let a client assertion minted for another authorization server be replayed here. A server that configures neither issuer nor Rails' default_url_options[:host] now has no acceptable audience and refuses every assertion, and is warned about it at boot.
[BREAKING] Refuse requests that transmit the access token by more than one method (RFC 6750 §2) with an invalid_request error, instead of silently authorizing with the first method that yielded a token and discarding the rest. The form-encoded body (§2.2) and the URI query (§2.3) count as two methods even though Rails and Rack merge them into a single params hash, and the same token repeated across two methods is refused too — §2 forbids the second method, not a disagreement between the two.
- Only the built-in extraction methods take part in the check; a custom callable in access_token_methods keeps the historical first-wins behavior and is never invoked more than once.
- Doorkeeper::OAuth::Token.from_request / .authenticate raise Doorkeeper::Errors::MultipleAccessTokenMethods. Doorkeeper.authenticate and every doorkeeper_token helper (Rails, Grape, and Doorkeeper's own controllers) keep their token-or-nil contract, so doorkeeper_authorize! renders the refusal through a new doorkeeper_bad_request_render_options(error:) hook (head 400 unless you override it).
- Upgrade note: under handle_auth_errors :raise these requests raise Doorkeeper::Errors::InvalidRequest, a sibling of Doorkeeper::Errors::InvalidToken rather than a subclass — an existing rescue Doorkeeper::Errors::InvalidToken does not cover it.

- Ruby
Published by nbulaj 23 days ago

https://github.com/doorkeeper-gem/doorkeeper - v5.9.6

Reject requests that present more than one client identity (e.g. an Authorization: Basic header for one client and a client_id parameter naming another) with an invalid_request error, instead of authenticating the first extracted identity and silently discarding the other one. A client_id sent alongside another authentication method keeps working when it identifies the same client (RFC 7521 §4.2). Like the RFC 6749 §2.3 check released in 5.9.5, this validation does not apply when client_credentials is configured with a callable extractor, since the credentials the remaining extractors would return are never evaluated — the client_credentials option documents that now.

- Ruby
Published by nbulaj about 2 months ago

https://github.com/doorkeeper-gem/doorkeeper - 6.0.0.beta2

Please make sure you read the Upgrade guides
and changelog below before the update since this version includes breaking changes.

[#1865] Revoke the token issued for an authorization code when the code is exchanged more than once, per RFC 6749 §4.1.2 / §10.5. Active when the oauth_access_grants.access_token_id column exists: new installs get it from the generated migration, existing apps can add it with rails generate doorkeeper:grant_reuse_revocation. Closes [#1713].
[#1871] [BREAKING] redirect_uri is now compared to the registered redirect URIs with the simple string comparison required by RFC 6749 §3.1.2.3 (the RFC 8252 §7.3 loopback port exception is kept). Clients relying on the previous lenient matching must send the exact registered URI, closes [#1718].
[#1874] Fix force_pkce requiring a code_challenge from response types that never issue an authorization code (e.g. token, or an OIDC extension's id_token / id_token token). PKCE (RFC 7636) protects the authorization code exchange, so for code-less response types there is no token-endpoint step where a code_verifier could ever be checked — such requests were rejected over a parameter that cannot be validated. force_pkce now only enforces the challenge for response types that issue a code (code and code-carrying hybrid types such as code id_token).
[#1876] Fix: reject a non-string scope parameter (e.g. scope[a]=b, which Rack parses into a Hash) with invalid_request (RFC 6749 §3.3) instead of an unhandled 500. Scopes.from_string now raises Errors::InvalidScopeParameter for a non-string argument — turned into invalid_request by the token endpoint's rescue_from, so every grant type is covered — and the authorization endpoint rejects it up front in pre-authorization validation. The crash was reachable unauthenticated, before client authentication.
[#1877] Fix: let the none client authentication strategy match a request whose Authorization header carries a Bearer token. A bearer credential authorizes access to the endpoint itself (e.g. a bearer-protected introspection endpoint per RFC 7662 §2.1, or a revocation request) rather than authenticating the client, so it must not suppress the public-client none strategy when the client identifies itself with a body client_id. Any other non-blank Authorization value — Basic, or a Bearer with no token — is still treated as header-based client authentication and continues to bypass none. The 6.0.0.beta1 workaround of dropping the Authorization header from such a request is no longer needed.
[#1878] Fix: the loopback redirect URI exception (RFC 8252 §7.3) now varies by port only, not by userinfo. The port was cleared with URI#port=, which on Ruby >= 4.0 also drops the userinfo, so http://attacker@127.0.0.1/cb matched a registered http://127.0.0.1/cb. The match is now made component-by-component. The destination host is always the loopback interface, so this was not a cross-origin open redirect, and non-loopback hosts were never affected.
[#1879] Fix: with reuse_access_token enabled, replaying an authorization code no longer revokes an access token that another grant still shares. The single-use revocation added in [#1865] followed the grant's access_token_id, which a reused token shares across grants, so a replay could collaterally revoke a token another valid session still held. The revocation now skips a token referenced by another grant and only reaches one unique to the replayed code; a token unique to the code is still revoked as before.
[#1881] Fix: Doorkeeper::ApplicationsController no longer 500s on create/update/destroy in api_only mode, where ActionController::API provides no flash. Confining flash to the HTML path is not sufficient on its own, because a client that does not name JSON explicitly still negotiates its way into that path — an absent Accept header and a browser-like list such as application/json, text/plain, */* both resolve to text/html, and a bare */* resolves to the first registered format — so api_only mode now pins the response format to JSON.
[#1883] Internal: merge CHANGELOG.md with git's union driver, so two pull requests that each add an entry no longer conflict on the line above "Please add here".
[#1884] Fix: /oauth/introspect and /oauth/revoke extend the token lookup across both token types when the lookup by token_type_hint finds nothing (RFC 7662 §2.1 / RFC 7009 §2.1), so a wrong hint no longer hides a token the server knows about ([#1882])
[#1885] Index oauth_access_grants.access_token_id in the migration templates: since [#1879] the code-replay revocation filters access grants by that column, the "never used to filter queries" premise behind index: false no longer holds.
[#1886] Add support for Resource Indicators for OAuth 2.0 (RFC 8707). Clients can include a resource parameter in authorization and token requests to indicate the target protected resource(s). The authorization server validates resource URIs, enforces audience restriction on tokens, and includes aud in introspection responses. Enable by configuring resource_indicator_validator with a callable. Requires new resource columns on access grants and tokens — run rails generate doorkeeper:resource_indicators to add the migration.
[#1887] [test] Pin that a requested non-default scope reaches the authorization grant and the exchanged token, and that the authorization strategy shares the controller's pre-authorization — the mismatch reported in [#1576] does not reproduce. Test-only change, closes [#1576].
[#1888] Document custom grant flow registration (Doorkeeper::GrantFlow.register) in the README with a SAML 2.0 bearer assertion (RFC 7522) walkthrough, and pin URN-shaped custom grant types with an end-to-end request spec. Docs/test-only change, closes [#764].
[#1890] [test] Pin that the authorization endpoint answers invalid_redirect_uri for a client registered without a redirect URI (allow_blank_redirect_uri), whether or not the request supplies one — the behavior required by RFC 6749 §3.1.2.3. Test-only change, closes [#1682].
[#1898] Fix: with reuse_access_token enabled, the client_credentials grant no longer reuses a token whose resource differs from the one requested (RFC 8707), so the audience restriction the client asked for is always applied. Follow-up to [#1886].
[#1899] Document the client authentication methods registry (Doorkeeper::ClientAuthentication.register) in the README with a walkthrough for registering a custom method, and pin it with an end-to-end request spec. Docs/test-only change, closes [#1894].
[#1891] Fix: an authorization request carrying a redirect_uri for a client registered without one (redirect_uri is nil under allow_blank_redirect_uri) now answers invalid_redirect_uri instead of crashing with an unhandled 500.
[#1896] Add an opt-in private_key_jwt client authentication method (RFC 7523 / OIDC Core §9, requires the jwt gem >= 2.7) that verifies assertions against the client's published public keys — jwks / jwks_uri attributes you define on your Application model, the latter fetched with an SSRF-hardened HTTP client. The jti replay guard and the fetched-JWKS cache are process-local by default and can be replaced with shared stores via the private_key_jwt_replay_guard / private_key_jwt_jwks_cache config options. Part of [#1875].
[#1901] [test] Pin the answered behaviors behind [#984], [#1554], [#1600], [#1663], [#1759] and [#1787] with regression specs — the built-in client authentication methods, the unmodified echo of long state values, DB persistence with custom token generators, refresh token rotation/expiry semantics and the introspection asymmetry. Test-only change, closes those issues along with [#1291], [#1756] and [#1764].
[#1902] Fix: requests that omit scope now compute the same default scopes at the authorization and token endpoints (Scopes#common, symmetric). With dynamic scopes enabled, a scope pattern in either default_scopes or the application's scopes grants the matching concrete scope at both endpoints, closes [#1889].
[#1903] Fix: revoke_previous_client_credentials_token no longer revokes a client's live access token issued for a different resource ([#1886]), so a client can keep one audience-restricted token per resource server.
[#1905] [test] Cover private_key_jwt client authentication on the client_credentials grant, the one flow where an assertion is the client's only credential end to end. Test-only change.

- Ruby
Published by nbulaj about 2 months ago

https://github.com/doorkeeper-gem/doorkeeper - v5.9.5

[#1901] Reject requests that authenticate the client with more than one method (RFC 6749 §2.3) with an invalid_request error, instead of silently authenticating with the first method that matched and discarding the other credentials.
[#1853] Fix reuse_access_token reusing a token that was created with custom_access_token_attributes values when the new request doesn't specify any custom attributes. Such requests now only match tokens without custom attributes.

- Ruby
Published by nbulaj about 2 months ago

https://github.com/doorkeeper-gem/doorkeeper - v6.0.0.beta1

Please make sure you read the Upgrade guides and changelog below before the update since this version includes breaking changes.

[#1816] Fix: redirect unauthorized_client errors per RFC 6749 Section 4.1.2.1; validate redirect_uri before client_supports_grant_flow to prevent open redirect
[#1867] Fix: use access_denied instead of invalid_client for resource_owner_authorize_for_client validation per RFC 6749 Section 4.1.2.1. invalid_client is a token endpoint error (Section 5.2), not an authorization endpoint error.
[#1838] Add OAuth 2.0 Authorization Server Metadata endpoint (RFC 8414) served at /.well-known/oauth-authorization-server. The response is built from your Doorkeeper configuration and advertises the authorization, token, revocation and (when token introspection is enabled) introspection endpoints, supported scopes, response/grant types and PKCE code challenge methods. Two new config options are available: issuer (defaults to the request base URL) and custom_metadata (a Hash merged into the response, e.g. to advertise an OIDC userinfo_endpoint). The controller/response use the RFC 8414 "Metadata" naming so they don't collide with a future OpenID Connect Discovery (.well-known/openid-configuration) implementation. Endpoints disabled through skip_controllers are omitted from the response instead of raising a route-generation error.
[#1839] Send client credentials in the request body (not the query string) in the token endpoint specs, per RFC 6749 §2.3.1. Test-only change: the *_endpoint_url helpers now return a path plus a matching *_endpoint_params builder so flow specs post credentials through the body.
[#1840] Introduce a pluggable client authentication registry (RFC 6749 §2.3).
- New client_authentication config option declares which methods are accepted and in which order. Built-in strategies: client_secret_basic, client_secret_post and none.
- Custom strategies can be registered with Doorkeeper::ClientAuthentication.register.
- [BREAKING] Client credentials are no longer read from the query string — send them in the request body or via HTTP Basic. This applies to every endpoint that authenticates clients: token, revocation and introspection.
- [BREAKING] The none strategy rejects requests that carry a non-blank Authorization header. A common casualty is a public client POSTing to /oauth/revoke with a body client_id while still sending its Authorization: Bearer <token> header — drop the header from that request.
- [BREAKING] The Doorkeeper::OAuth::Client::Credentials class methods .from_request, .from_basic and .from_params are removed — extensions extracting credentials from a request should register a client authentication method instead.
- Deprecated: the client_credentials option — use client_authentication instead.
- Deprecated: the Doorkeeper::OAuth::Client::Credentials constant itself — it remains as an alias of Doorkeeper::ClientAuthentication::Credentials (the plain uid/secret struct).
- See the Upgrade Guide for detailed breaking changes, deprecations and migration steps.
[#1841] Reject requests that use more than one client authentication method (RFC 6749 §2.3: "The client MUST NOT use more than one authentication method in each request") with an invalid_request error instead of silently using the first match. The request payload is validated against every registered method before the configured one is selected, so a client sending e.g. both Basic and body credentials is rejected even when only one of those methods is enabled. This applies to every endpoint that authenticates clients — token, revocation and introspection. Only real authentication mechanisms count: a bare client_id (the none method) is not a mechanism of its own, and deprecated client_credentials callable extractors never count towards the limit (they keep the historical first-extractor-wins selection).
[#1842] [BREAKING] force_pkce now requires PKCE for all clients, including confidential ones, in line with the OAuth 2.0 Security BCP (RFC 9700) and OAuth 2.1. Previously confidential clients were exempt. If you enable force_pkce and have confidential clients that do not yet send a code_challenge/code_verifier, their authorization requests will start to be rejected.
[#1845] Fix NameError when the config option DSL (Doorkeeper::Config::Option) is extended into a class that does not define self.builder_class. The guard raised Doorkeeper::MissingConfigurationBuilderClass, a constant that was never defined, so callers saw uninitialized constant instead of the intended message. The error is now defined as Doorkeeper::Errors::MissingConfigurationBuilderClass (a DoorkeeperError) and referenced correctly.
[#1846] Document and pin with regression specs that a scope parameter sent to the token endpoint is ignored for the authorization_code grant (RFC 6749 §4.1.3 does not define one): the access token always inherits the scopes of the authorization grant, and the response reports the actual granted scope. No behavior change.
[#1847] Fix Doorkeeper.config.enabled_grant_flows (and calculate_grant_flows) not listing the refresh_token grant flow when use_refresh_token is configured, so consumers (e.g. RFC 8414 metadata) no longer need to append it manually — the built-in metadata endpoint now relies on this too. The flow is no longer duplicated in token_grant_flows when refresh_token is also listed in grant_flows explicitly, a configuration-time warning is logged when grant_flows enables refresh_token without use_refresh_token (no refresh tokens would ever be issued), and the initializer template documents the flow.
[#1848] Derive token_endpoint_auth_methods_supported in the RFC 8414 metadata response from the effective client authentication configuration (including a deprecated client_credentials-only setup) instead of hardcoding the default methods. Servers that customize client_authentication (including extension-registered methods like private_key_jwt) now see their metadata reflect what the server actually accepts; unregistered names are not advertised.
[#1849] Support RFC 9207 (Authorization Server Issuer Identification): when issuer is configured, the iss parameter is added to the authorization responses redirected back to the client (successful and error responses alike) and authorization_response_iss_parameter_supported is advertised in the server metadata. Clients that parse the authorization redirect will start seeing the new iss parameter. A configured issuer that is not RFC-compliant (not an https URL, or containing a query/fragment) now logs a warning at boot, as does a path-bearing issuer, which RFC 8414 clients would not discover through Doorkeeper's root-only well-known metadata route.
[#1850] Fix reuse_access_token returning a refresh token that doesn't match the request: token reuse now requires the candidate's refresh token presence to match what the request asks for, in both directions. A request that expects a refresh token (e.g. use_refresh_token enabled) no longer reuses a token issued without one (previously the refresh token was silently omitted), and a request that does not expect one no longer reuses a token that carries one (previously an unrequested refresh token was returned, reachable via a per-request refresh_token_enabled callable). The requirement participates in the token matching itself, so an older matching token that satisfies it is still reused; a fresh token is created only when none does. API change for ORM extensions: matching_token_for and find_matching_token now take an optional block (&filter) that a token must satisfy to count as a match — extensions overriding either method must accept the block and honor it (accept and yield).
[#1851] Fix duplicate query parameter in the authorization callback when a client's registered redirect_uri already contains a parameter with the same name as a response parameter (e.g. state). The redirect query was merged with string keys on one side and symbol keys on the other, so a collision emitted the parameter twice (?state=fixed&code=...&state=user); the response parameter now overrides the registered one and appears exactly once. A blank response parameter (e.g. no state sent with the request) leaves the registered parameter untouched, per RFC 6749 §3.1.2.
[#1852] Fix the pkce_code_challenge_methods config validator using line anchors (^/$) instead of string anchors (\A/\z), so a multi-line value such as "plain\ngarbage" passed validation and was retained as a (never-matching) challenge method instead of being rejected and reset to the default.
[#1853] Fix reuse_access_token reusing a token that was created with custom_access_token_attributes values when the new request doesn't specify any custom attributes. Such requests now only match tokens without custom attributes.
[#1854] Fix the RFC 8414 metadata endpoint raising ActionController::UrlGenerationError (HTTP 500) when use_doorkeeper configures a custom controller whose namespace depth differs from doorkeeper/metadata (e.g. controllers tokens: "custom_tokens").
[#1855] Perform the fallback secret upgrade-on-access write (plain → hashed token or application secret) through the primary database role, so enable_multiple_database_roles setups no longer attempt the write on a read replica when the lookup happens in a request routed to the reading role.
[#1857] Pin with regression specs that a + between scopes in a form-encoded token request is decoded as a space (so scope=public+write refreshes fine), while a percent-encoded literal + (%2B) names a single scope and is rejected when unknown, per RFC 6749 §3.3. Test-only change, closes [#1686].
[#1859] Pin with regression specs that a refresh token bound to an expired access token can be revoked (fixed by [#1744]) and that the revoked refresh token is rejected at the token endpoint afterwards. Test-only change, closes [#1671].
[#1860] Fix introspection of refresh tokens (RFC 7662): a refresh token bound to an expired access token now introspects as active: true, matching the token endpoint which still accepts it. The introspection response for a presented refresh token no longer includes the paired access token's token_type and exp. Fixes [#1858].
[#1862] Document that with reuse_access_token enabled token matching considers only the application, resource owner, scopes and custom token attributes — separate authorization grants for the same combination intentionally share one access token — and pin the behavior with a regression spec. Docs/test-only change, closes [#1693].
[#1864] Fix custom_access_token_attributes values being dropped when the authorization goes through the consent screen: the approve/deny forms now carry the custom attributes as hidden fields, and the pre-authorization JSON (api_only mode) includes them so custom consent UIs can send them back.
[#1869] Improve test coverage
[#1870] Fix: raise the intended Doorkeeper::Errors::TokenGeneratorNotFound / UnableToGenerateToken (instead of a confusing NameError) when application_secret_generator is misconfigured.

- Ruby
Published by nbulaj 2 months ago

https://github.com/doorkeeper-gem/doorkeeper - v5.9.3

[#1834] Fix default allow_token_introspection returning false when a custom application_class is configured. The default proc compared application objects with ==, which fails when the authorized client and the introspected token's application are resolved as different classes (e.g. a base Doorkeeper::Application vs. a configured subclass) even though they reference the same record. It now compares application ids instead.
[#1832] Fix confusing belongs_to :owner side effect: Doorkeeper::Models::Ownership is now included only when enable_application_owner? is set (read at include time), so models no longer expose a misleading owner association/reflection when the application owner feature is disabled and the schema lacks the owner columns.

- Ruby
Published by nbulaj 4 months ago

https://github.com/doorkeeper-gem/doorkeeper - v5.9.2

[#1822][#1823][#1825] Update Rubocop config, auto-corrections and codebase cleanup.
[#1830] Fix NameError: uninitialized constant ApplicationRecord on rails db:seed (and other non-eager-loading flows) caused by on_load(:active_record) firing re-entrantly during ApplicationRecord autoload. The orm hooks no longer depend on ActiveSupport.on_load(:active_record); model concerns (Ownership, PolymorphicResourceOwner::ForAccessGrant, PolymorphicResourceOwner::ForAccessToken) are now wired up from each Mixins::* included block, which fires at parent-class autoload time — after Doorkeeper.configure has applied user settings and without re-entering the AR load chain.
- Upgrade note: fully custom model classes that don't include Doorkeeper::Orm::ActiveRecord::Mixins::{Application,AccessToken,AccessGrant} will no longer auto-receive Ownership / PolymorphicResourceOwner concerns (previously injected by run_orm_hooks via the configured class name). Either inherit from the Doorkeeper default model, include the corresponding Mixins::* module, or include the concerns directly.

- Ruby
Published by nbulaj 4 months ago

https://github.com/doorkeeper-gem/doorkeeper - v5.9.1

[#1781] Honor handle_auth_errors :raise in AuthorizationsController#authorize_response
[#1795] Fix: detailed error 'insufficient_scope' in protected resources 403s
[#1797] Fix doorkeeper:db:cleanup rake task failure on PostgreSQL
[#1800] Set @grant_type in ClientCredentialsRequest and RefreshTokenRequest constructors so request.grant_type returns
the correct value in hooks like before_successful_strategy_response.
[#1802] Fix filter_parameters not applied when Doorkeeper.configure is called inside to_prepare.
[#1804] Use ActiveSupport.on_load(:active_record) in ORM hooks to prevent loading ActiveRecord models too early
[#1806] Fix token revocation bypass for public clients (RFC 7009)
[#1815] Expose current_resource_owner as a view helper in Doorkeeper::ApplicationController.
[#1818] Fix token introspection returning exp: 0 for non-expiring tokens.
[#1784] Remove hardcoded colons from view templates, move punctuation to i18n translation strings.

[IMPORTANT]: if you have customized Doorkeeper views (authorizations/new, authorizations/show,
applications/show) or overridden the default en.yml translations, you may need to update them.
Colons are no longer hardcoded in the views — they are now part of the translation strings.
Update the doorkeeper-i18n gem to get the
updated translations for all locales.
[#1820] Remove dead wildcard presence check in Scopes#dynamic_scope_match? (internal cleanup, no behavior change).
[#1822] Update Rubocop config, auto-corrections.
[#1823] Update Rubocop config, part 2.
[#1825] Update Rubocop config, part 3.
[#1821] Fix noisy Could not find command "no_previous_refresh_token_column?" Thor output during the
PreviousRefreshTokenGenerator spec by stubbing the underlying DB column check instead of the generator's
private method (test-only change).

- Ruby
Published by nbulaj 5 months ago

https://github.com/doorkeeper-gem/doorkeeper - v.5.9.0

[#1791] Add support for Rails read replicas with automatic role switching via enable_multiple_database_roles configuration option
[#1792] Consider expires_in when clear expired tokens with StaleRecordsCleaner.
[#1790] Fix race condition in refresh token revocation check by moving InvalidGrantReuse check inside the lock block
[#1788] Fix regex for basic auth to be case-insensitive
[#1775] Fix Applications Secret Not Null Constraint generator
[#1779] Only lock previous access token model when creating a new token from its refresh token if revoke_previous_refresh_token_on_use is false
[#1778] Ensure that token revocation is idempotent by checking that that token has not already been revoked before revoking.

- Ruby
Published by nbulaj 7 months ago

https://github.com/doorkeeper-gem/doorkeeper -

[#1755] Fix the error message for force_pkce
[#1761] Memoize authentication failure
[#1762] Allow missing client to trigger invalid client error when force_pkce is enabled
[#1767] Make sure error handling happens on a controller level opposed to action level to account for the controller being extended

- Ruby
Published by nbulaj over 1 year ago

https://github.com/doorkeeper-gem/doorkeeper - v5.8.1

[#1752] Bump the range of supported Ruby and Rails versions
[#1747] Fix unknown pkce method error when configured
[#1744] Allow for expired refresh tokens to be revoked
[#1754] Fix refresh tokens with dynamic scopes

- Ruby
Published by nbulaj almost 2 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.8.0

[#1739] Add support for dynamic scopes
[#1715] Fix token introspection invalid request reason
[#1714] Fix Doorkeeper::AccessToken.find_or_create_for with empty scopes which raises NoMethodError
[#1712] Add Pragma: no-cache to token response
[#1726] Refactor token introspection class.
[#1727] Allow to set null secret value for Applications if they are public.
[#1735] Add pkce_code_challenge_methods config option.

- Ruby
Published by nbulaj almost 2 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.7.1

[#1705] Add force_pkce option that requires non-confidential clients to use PKCE when requesting an access_token using an authorization code

- Ruby
Published by nbulaj over 2 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.7.0

[#1696] Add missing #issued_token method to OAuth::TokenResponse
[#1697] Allow a TokenResponse body to be customized (memoize response body).
[#1702] Fix bugs for error response in the form_post and error view
[#1660] Custom access token attributes are now considered when finding matching tokens (fixes #1665). Introduce revoke_previous_client_credentials_token configuration option.

- Ruby
Published by nbulaj over 2 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.9

[#1691] Make new Doorkeeper errors backward compatible with older extensions.

- Ruby
Published by nbulaj over 2 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.8

[#1680] Fix handle_auth_errors :raise NotImplementedError

- Ruby
Published by nbulaj almost 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.7

[#1662] Specify uri_redirect validation class explicitly.
[#1652] Add custom attributes support to token generator.
[#1667] Pass client instead of grant.application to find_or_create_access_token.
[#1673] Honor custom_access_token_attributes in client credentials grant flow.
[#1676] Improve AuthorizationsController error response handling
[#1677] Fix URIHelper.valid_for_authorization? breaking for non url URIs.

- Ruby
Published by nbulaj almost 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.6

[#1644] Update HTTP headers.
[#1646] Block public clients automatic authorization skip.
[#1648] Add custom token attributes to Refresh Token Request.
[#1649] Fixed custom_access_token_attributes related errors.

- Ruby
Published by nbulaj over 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.5

[#1602] Allow custom data to be stored inside access grants/tokens.
[#1634] Code refactoring for custom token attributes.
[#1639] Add grant type validation to avoid Internal Server Error for DELETE /oauth/authorize endpoint.

- Ruby
Published by nbulaj over 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.4

[#1633] Apply ORM configuration in #to_prepare block to avoid autoloading errors.

- Ruby
Published by nbulaj over 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.3

[#1622] Drop support for Rubies 2.5 and 2.6
[#1605] Fix URI validation for Ruby 3.2+.
[#1625] Exclude endless access tokens from StaleRecordsCleaner.
[#1626] Remove deprecated active_record_options config option.
[#1631] Fix regression with redirect behavior after token lookup optimizations (redirect to app URI when found).
[#1630] Special case unique index creation for refresh_token on SQL Server.
[#1627] Lazy evaluate Doorkeeper config when loading files and executing initializers.

- Ruby
Published by nbulaj over 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.2

[#1604] Fix fetching of the application when custom application_class defined.

- Ruby
Published by nbulaj almost 4 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.1

[#1593] Add support for Trilogy ActiveRecord adapter.
[#1597] Add optional support to use the url path for the native authorization code flow. Ports forward [#1143] from 4.4.3
[#1599] Remove unnecessarily re-fetch of application object when creating an access token.

- Ruby
Published by nbulaj almost 4 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.0

[#1581] Consider token_type_hint when searching for access token in TokensController to avoid extra database calls.

- Ruby
Published by nbulaj about 4 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.0.rc1

[#1551] Change lazy loading for ORM to be Ruby standard autoload.
[#1552] Remove duplicate IDs on Auth form to improve accessibility.
[#1542] Improve performance of Doorkeeper::AccessToken#matching_token_for using database specific SQL time math.

[IMPORTANT]: API of the Doorkeeper::AccessToken#matching_token_for method has changed and now it returns
only active access tokens (previously they were just not revoked). Please remember that the idea of the
reuse_access_token option is to check for existing active token (see configuration option description).

- Ruby
Published by nbulaj over 4 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.4

[#1535] Revert changes introduced in #1528 to allow query params in redirect_uri as per the spec.

- Ruby
Published by nbulaj almost 5 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.3

[#1528] Don't allow extra query params in redirect_uri.
[#1525] I18n source for forbidden token error is now doorkeeper.errors.messages.forbidden_token.missing_scope.
[#1531] Disable strict-loading for Doorkeeper models by default.
[#1532] Add support for Rails 7.

- Ruby
Published by nbulaj about 5 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.2

[#1502] Drop support for Ruby 2.4 because of EOL.
[#1504] Updated the url fragment in the comment for code documentation.
[#1512] Fix form behavior when response mode is form_post.
[#1511] Fix that authorization code is returned by fragment if response_mode is fragament.

- Ruby
Published by nbulaj over 5 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.1

[#1496] Revoke old_refresh_token if previous_refresh_token is present.
[#1495] Fix respond_to undefined in API-only mode
[#1488] Verify client authentication for Resource Owner Password Grant when
config.skip_client_authentication_for_password_grant is set and the client credentials
are sent in a HTTP Basic auth header.

- Ruby
Published by nbulaj over 5 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.0

[#1482] Simplify TokenInfoController to be overridable (extract response rendering).
[#1478] Fix ownership association and Rake tasks when custom models configured.
[#1477] Respect ActiveRecord::Base.pluralize_table_names for Doorkeeper table names.

- Ruby
Published by nbulaj over 5 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.0.rc2

[#1473] Enable Applications and AuthorizedApplications controllers in API mode.

[IMPORTANT] you can still skip these controllers using skip_controllers in
use_doorkeeper inside routes.rb. Please do it in case you don't need them.
[#1472] Fix establish_connection configuration for custom defined models.
[#1471] Add support for Ruby 3.0.
[#1469] Check if redirect_uri exists.
[#1465] Memoize nil doorkeeper_token.
[#1459] Use built-in Ruby option to remove padding in PKCE code challenge value.
[#1457] Make owner_id a bigint for newly-generated owner migrations
[#1452] Empty previous_refresh_token only if present.
[#1440] Validate empty host in redirect_uri.
[#1438] Add form post response mode.
[#1458] Make config.skip_client_authentication_for_password_grant a long term configuration option.

- Ruby
Published by nbulaj over 5 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.0.rc1

[#1435] Make error response not redirectable when client is unauthorized
[#1426] Ensure ActiveRecord callbacks are executed on token revocation.
[#1407] Remove redundant and complex to support helpers froms tests (should_have_json, etc).
[#1416] Don't add introspection route if token introspection completely disabled.
[#1410] Properly memoize current_resource_owner value (consider nil and false values).
[#1415] Ignore PKCE params for non-PKCE grants.
[#1418] Add ability to register custom OAuth Grant Flows.
[#1420] Require client authentication for Resource Owner Password Grant as stated in OAuth RFC.

[IMPORTANT] you need to create a new OAuth client (Doorkeeper::Application) if yoo didn't
have it before and use client credentials in HTTP Basic auth if you previously used this grant
flow without client authentication. For migration purposes you could enable
skip_client_authentication_for_password_grant configuration option to true, but such behavior
(as well as configuration option) would be completely removed in a future version of Doorkeeper.
All the users of your provider application now need to include client credentials when they use
this grant flow.
[#1421] Add Resource Owner instance to authorization hook context for custom_access_token_expires_in
configuration option to allow resource owner based Access Tokens TTL.

- Ruby
Published by nbulaj about 6 years ago