Repository Issue Activity (beta)

#1845 Support `private_key_jwt` in CIMD

#1857 CIMD ignores token_endpoint_auth_methods_supported and rejects usable clients

#1855 CIMD: a metadata document is rejected when it declares an extra grant_type the server doesn't support

#1853 CIMD applications don't get algorithm set

#1851 Serve up /o/token instead of redirecting it even if `APPEND_SLASH` is True

#1702 oauth2_settings.AUTHENTICATION_SERVER_EXP_TIME_ZONE violates specification

#1773 Remove JSONOAuthLibCore (deprecated in 3.4.1)

#1716 Hash user tokens, refresh tokens and grants in the DB

#1805 DOT is now vibe-coded/slopware – alternatives/forks?

#1843 3.4.1 update not functional on Oracle

#1731 DCR: allowlist settings for registration metadata (grant_types, token_endpoint_auth_method, redirect_uris)

#1846 RFC 9207: MUST include iss on error response

#1844 Store and use logo_uri, client_uri, tos_uri, policy_uri, contacts from CIMD

#1756 Deploy check for OAUTH2_RESPONSE_TYPES_SUPPORTED entries the server can never accept (response_type order-independence)

#984 Oauth2 Throttle class for Client Credentials

#1453 fix test.mig_settings for OIDC migrations and swappable dependencies?

#753 Skip auth form if valid refresh token exists?

#1746 e2e: add cross-site hosts + Firefox to test third-party-cookie impacts

#1098 OAuth 2.0 BCP -> OAuth 2.1

#490 Allow custom redirect_uri validator for AbstractApplication

#483 token_expires_in method of oauthlib.Server is ignored by DOT

#657 Use of Content-Type "application/x-www-form-urlencoded" not enforced

#1828 bug: log.exception() misused in two resource-server paths (+ implicit return in the introspection client)

#1786 Policy setting: allow a refresh token to survive access-token revocation (4.x)

#1782 Natively support CORS on the OIDC UserInfo endpoint