New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.4

v26.4.4​

Configure outbound HTTP clients per pipeline step and access rule​

The cookie_session and bearer_token authenticators and the hydrator mutator reject upstream responses larger than 5 MiB and fail the request by default. Session check requests time out after 30 seconds by default. Set top-level http_client settings for shared defaults, then override individual fields in each handler's config.http_client or each access rule's config.http_client. Settings cover timeout, response size limit, retries, and private IP restrictions. They apply to session checks, OAuth token and introspection calls, remote and Keto authorization, hydrator calls, and HTTP JWKS fetching for JWT authentication and ID-token mutation. Use unlimited to disable the timeout or response size limit.

The hydrator's api.retry.give_up_after and api.retry.max_delay settings are deprecated and remain supported. Use http_client.timeout for the timeout and http_client.retry.max for the retry count.

Breaking changes​

All pipeline HTTP clients limit response bodies to 5 MiB by default. Upstreams that return responses above 5 MiB require a larger http_client.max_response_body_size or unlimited. A hydrator give_up_after of 0s uses the HTTP client timeout, which defaults to 30 seconds, instead of disabling it.

Oathkeeper bounds how it fetches JSON Web Key Sets​

The jwt authenticator, the id_token mutator, and the /.well-known/jwks.json endpoint fetch JSON Web Key Sets through one shared cache.

  • A key ID that no configured location contains triggers at most one fetch per location every 15 seconds, or every half jwks_ttl when that is shorter. A rotated key is picked up within that interval.
  • Past jwks_ttl, cached keys keep serving while Oathkeeper refreshes them in the background. If a location stays unreachable, its last keys are served for up to one hour past jwks_ttl and are then rejected until the location recovers.
  • A fetch runs for at most 15 seconds. Responses larger than 1 MiB and documents without a keys property are rejected and leave the cached keys in place.

Breaking changes​

Oathkeeper no longer follows HTTP redirects when it fetches a JSON Web Key Set. If a jwks_urls or jwks_url entry redirects to another URL, replace it with the URL the redirect points to.