Does ORY Hydra v2.x always return a boolean 'active' field in token introspection responses?

Question

Goal: Verify that the OAuth 2.0 token introspection endpoint of ORY Hydra consistently returns the 'active' field as a JSON boolean so that downstream services like ORY Kratos can rely on its type.

Constraint: In Hydra v2.0.x the field is a boolean for valid tokens but appears as the strings 'true' or 'false' in certain error cases, while Kratos v0.10.x expects a strict boolean and rejects non‑boolean values, creating a compatibility gap.

Uncertainty: It is unclear whether later Hydra patches have normalized the type or if the string representation persists under specific error conditions, and whether Kratos can be configured to tolerate non‑boolean values.

Does Hydra guarantee a boolean 'active' field for all introspection responses? Which Hydra version first eliminated the string representation? Should Kratos be updated to accept both boolean and string equivalents?

Tasadduq Burney · Answer

The Short Answer
No, ORY Hydra v2.x does not guarantee a boolean active field across all possible response scenarios if specific error conditions or middleware transformations are present. While RFC 7662 mandates a boolean for the active field, certain edge cases in early v2.x releases or environmental configurations can result in type mismatches that trigger strict type-checking failures in downstream services like ORY Kratos.

Analysis of the Compatibility Gap
The core of the issue lies in the difference between RFC compliance and implementation reality. According to RFC 7662, the introspection endpoint must return a JSON object containing a boolean active member. If a token is expired, revoked, or invalid, the response should be {"active": false}.

Likely Causes of String Representation
If you are seeing "true" or "false" as strings rather than booleans, it is rarely the intended behavior of the Hydra core. The most likely culprits are:

API Gateways/Proxies: Middleware sitting between Hydra and Kratos may be intercepting the response and re-serializing the JSON, inadvertently converting booleans to strings.
  Custom Error Handlers: In specific error states where Hydra might return a non-standard response, a generic error wrapper may be casting values to strings.
  Version-Specific Regressions: Early patches of v2.x may have had inconsistencies in how they handled malformed tokens versus expired tokens.

Verification and Resolution
To determine if the issue is rooted in Hydra or the network layer, run the following tests using curl directly against the Hydra instance:

# Test with an expired token
curl -X POST http://hydra:4445/oauth2/introspect 
  -d "token=EXPIRED_TOKEN" 
  -d "client_id=YOUR_CLIENT_ID" 
  -d "client_secret=YOUR_CLIENT_SECRET"

Check the raw output. If the output is "active": false (no quotes), Hydra is behaving correctly. If it is "active": "false", the issue is within the Hydra version or a proxy.

Recommended Actions

Update Hydra: Ensure you are on the latest patch of v2.x, as normalization of RFC responses is a priority for the ORY ecosystem.
  Kratos Configuration: Since Kratos v0.10.x utilizes strict Go typing, it cannot be configured via a simple flag to accept strings as booleans. If you cannot update Hydra immediately, a lightweight proxy (like Nginx or a custom sidecar) must be used to normalize the response payload before it reaches Kratos.

Diagnostic Requirement: To provide a more precise version fix, please provide the exact Hydra patch version (e.g., v2.0.1) and whether an API Gateway is positioned between Hydra and Kratos.

Does ORY Hydra v2.x always return a boolean 'active' field in token introspection responses?

1 answer

The Short Answer

Analysis of the Compatibility Gap

Likely Causes of String Representation

Verification and Resolution

Recommended Actions

Your perspective belongs here.

0 question comments