Issues

• Allow overriding PKCE verifier validation without forking the handler

  ory/fosite#885 · Filter by author shilps1583 opened on Jul 15, 2026

• Security: unbounded strings.Split in HMACStrategy.Signature() enables memory exhaustion DoS

  ory/fosite#882 · Filter by author canolgun opened on Jun 19, 2026

• Request Object accepts alg=none when client omits request_object_signing_alg registration

  ory/fosite#876 · Filter by author ayadlin opened on May 12, 2026

• Request Object accepts alg=none when client omits request_object_signing_alg registration

  ory/fosite#875 · Filter by author ayadlin opened on May 9, 2026

• Support dynamic port matching for localhost redirect URIs (RFC 8252 §7.3 extension)

  feat
  ory/fosite#873 · Filter by author roncodingenthusiast opened on Apr 14, 2026

• Max JWT duration for urn:ietf:params:oauth:grant-type:jwt-bearer grant type is validated against (exp - iat) and not (exp - now)

  bug
  ory/fosite#853 · Filter by author Enr1g opened on Apr 24, 2025

• Should the JWK "use" parameter be optional?

  feat
  ory/fosite#851 · Filter by author FenTiger opened on Apr 16, 2025
  5

• Support audience parameter for the introspection endpoint

  feat
  ory/fosite#845 · Filter by author mitar opened on Mar 1, 2025
  2

• Why does HMACStrategy.Generate uses a lock?

  bug
  ory/fosite#803 · Filter by author mitar opened on Mar 10, 2024
  3

• Unable to obtain expiration time of refresh tokens

  feat
  ory/fosite#801 · Filter by author mitar opened on Mar 8, 2024
  5

• id_token_hint should not persist to storage

  bug
  ory/fosite#798 · Filter by author mitar opened on Mar 7, 2024
  2

• Consider upgrading to github.com/go-jose/go-jose/v4

  feat
  ory/fosite#797 · Filter by author mitar opened on Mar 7, 2024
  9

• NewDefaultSession's SetSubject should set IDTokenClaims as well

  feat
  ory/fosite#796 · Filter by author mitar opened on Mar 6, 2024
  6

• Support per-client signing algorithm

  feat
  ory/fosite#788 · Filter by author mitar opened on Jan 29, 2024
  12

• DefaultSigner should support key rotation

  feat
  ory/fosite#786 · Filter by author mitar opened on Jan 26, 2024
  6

• Can not run the example code

  bug
  ory/fosite#779 · Filter by author liuyangc3 opened on Nov 30, 2023
  1

• Concurrent requests for token endpoint on auth-code flow with same code succeed.

  bug
  ory/fosite#778 · Filter by author tn185075 opened on Nov 28, 2023
  8

• iat field in access token (JWT) issued as part of refresh_token grant.

  bug
  ory/fosite#774 · Filter by author tn185075 opened on Nov 9, 2023
  8

• Failed to decode id_token_hint when using different signer for id_token and others

  bug
  ory/fosite#769 · Filter by author hijiki51 opened on Sep 22, 2023

• Refresh token flow handler does not set the original request ID in the handler early enough

  bug
  ory/fosite#754 · Filter by author vivshankar opened on Jul 15, 2023

• During refresh token grant if token is invalid or expired return status code should be 400

  bug
  ory/fosite#747 · Filter by author love-bhardwaj opened on May 4, 2023
  3

• Auth Req omitted response_mode does not validate the default response_mode against the ResponseModeClient

  bug
  ory/fosite#742 · Filter by author james-d-elliott opened on Mar 27, 2023

• Invalid token (base64 error) isn't mapped to an RFC6749Error error

  bug
  ory/fosite#727 · Filter by author Philio opened on Dec 19, 2022

• Error messages with status 503 and message temporarily_unavailable when revoking access and refresh tokens sequentially

  bug
  ory/fosite#709 · Filter by author mih-kopylov opened on Oct 6, 2022

• Unable to request narrower scopes in OAuth2 Refresh Token Exchange

  bug
  ory/fosite#696 · Filter by author silverspace opened on Aug 25, 2022
  10