Repository Issue Activity (beta)

#1719 Refresh Tokens as-implemented are susceptible to Refresh Token Reuse Attacks

#1730 There is no way to refresh an access token without revoking the previous access token

#1892 Deprecation or removal of insecure grant flows

#1771 Refresh tokens cannot reduce scopes correctly

#1875 Client ID Metadata Documents (CIMDs)

#1675 Better support for credential rotation

#1768 Support OAuth RFC - JWT for Client Authentication and Authorization Grants

#1711 Doorkeeper appears to be missing a way to validate client configuration before redirecting to the authentication page

#1914 IP address pinning after DNS resolution happens before vetting that the IP address works

#1600 Is there a way to store Doorkeeper::AccessToken data inside Doorkeeper::JWT (and not use db-backed tokens)?

#1613 Currently signed in user can revoke other users tokens

#1580 With enable_application_owner, issuing a token with grant_type=client_credentials does not associate the token with the owner

#1911 Improving publishing security?

#1799 Feature request: Support Identity Assertion JWT Authorization Grant (ID-JAG)

#1908 Missing documentation about doorkeeper:db:cleanup

#1889 Default-scope calculation diverges between the authorization and token endpoints when dynamic scopes are enabled

#1873 `force_pkce` requires a `code_challenge` from response types that never issue an authorization code

#1554 Response header too long for default nginx configuration

#1764 Issue: Configuring Active Record to Use Different Base Classes for Sharded and Non-Sharded Models

#1787 Refresh Token Rotation + Expiry questions

#1756 How to implement using multi-database like Makara

#1759 Introspecting a token should behave the same wrt "revoke on use"

#984 Is there Digest support for Doorkeeper Client Credentials Authentication

#1291 Add IndieAuth support

#1663 reuse_access_token config should be used when refreshing a token