New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.16

v26.4.16​

Configure outbound HTTP limits per feature​

Hydra now supports shared outbound HTTP settings under default_http_client and feature-specific overrides for hooks, logout notifications, client key fetching, OpenID Connect Request Objects, sector identifiers, and the Kratos integration. Configure timeouts, retries, response-size limits, and private-IP restrictions without changing other integrations.

The legacy clients.http settings are deprecated and remain supported. Move them to default_http_client.private_ip_ranges, renaming disallow_private_ip_ranges to disallow and private_ip_exception_urls to exception_urls. Remove the old settings after migrating. Existing timeout and retry defaults remain unchanged.

When both old and new settings are present, feature-specific settings take precedence over default_http_client, which takes precedence over the legacy settings. An explicitly empty exception list clears inherited exceptions.

Breaking change​

JWKS fetching, OpenID Connect Request Object fetching, back-channel logout, and sector identifier validation no longer use global or legacy private-IP exception URLs. Their HTTP client settings reject private_ip_ranges.exception_urls, including empty lists. When private-IP blocking is enabled, use publicly reachable endpoints for these client metadata URLs. Kratos and token hooks retain support for private-IP exceptions.

Token hooks, refresh-token hooks, and sector identifier responses retain their default 5 MiB response limit. Reading beyond that limit now reports a response-size error instead of end-of-file, so error details may change.