New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.11

v26.4.11​

Accept a SAML assertion only from the IdP of its connection​

Ory Polis now requires the Issuer of a signed SAML assertion to be the entity ID of the connection's IdP, and rejects the response otherwise. An IdP whose assertions name an Issuer other than the entity ID in its metadata is rejected with an error that names both values in the SSO trace; update the connection's metadata to match.

Browser clients can send JSON or an Authorization header to the token endpoint​

The token endpoint (/api/oauth/token) now answers a CORS preflight request for POST, and the OpenID discovery document (/.well-known/openid-configuration) answers one for GET. Before, the preflight for the token endpoint only advertised GET and HEAD, so a browser application that sent the code exchange as JSON, or with client credentials in an Authorization header, was blocked by the browser before the request was sent. Form-encoded requests were never affected and keep working unchanged.

Both endpoints already allowed any origin to read their responses; nothing changes for server-side clients or in how requests are authenticated.