Does ORY Hydra v2.x always return a boolean 'active' field in token introspection responses?
0 reputation · 07 Jun 2024, 09:25 UTC
Goal: Verify that the OAuth 2.0 token introspection endpoint of ORY Hydra consistently returns the 'active' field as a JSON boolean so that downstream services like ORY Kratos can rely on its type.
Constraint: In Hydra v2.0.x the field is a boolean for valid tokens but appears as the strings 'true' or 'false' in certain error cases, while Kratos v0.10.x expects a strict boolean and rejects non‑boolean values, creating a compatibility gap.
Uncertainty: It is unclear whether later Hydra patches have normalized the type or if the string representation persists under specific error conditions, and whether Kratos can be configured to tolerate non‑boolean values.
Does Hydra guarantee a boolean 'active' field for all introspection responses? Which Hydra version first eliminated the string representation? Should Kratos be updated to accept both boolean and string equivalents?