ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Goal: Verify that the OAuth 2.0 token introspection endpoint of ORY Hydra consistently returns the 'active' field as a JSON boolean so that downstream services like ORY Kratos can rely on its type. Constraint: In Hydra v2.0.x the field is a boolean for valid tokens but appears as the strings 'true' or 'false' in certain error cases, while Kratos v0.10.x expe
When a Crystal HTTP::Client receives a 401 Unauthorized response that includes a WWW‑Authenticate header after a successful TLS handshake, the standard library does not automatically retry the request with refreshed credentials. Developers must decide whether to propagate the error, invoke custom middleware, or implement a retry loop that extracts the challe
When integrating with the Sketch REST API, authentication is managed via an API token passed in the Authorization header. While requests missing a token consistently return a 401 Unauthorized response, there is uncertainty regarding the API's behavior when a token is syntactically valid but lacks the necessary permissions for a specific resource. The goal is
The goal is to clarify whether a token obtained via LinkedIn’s client‑credentials grant can be used to call user‑level endpoints such as /me when the request includes a user‑specific scope like r_liteprofile. The current documentation states that the client‑credentials grant is limited to application‑level scopes, but it does not explicitly say whether reque
RFC 7009 Compliance and Token Enumeration The OAuth 2.0 Token Revocation specification (RFC 7009) defines a standardized mechanism for clients to invalidate access and refresh tokens. A critical security requirement of this specification is the prevention of token enumeration, which ensures that an attacker cannot determine if a specific token is valid by ob
401 Unauthorized error after token expiry in Swagger UI When a short‑lived OAuth2 token is used with Swagger UI’s Try it out feature, the first request succeeds. After the token’s lifetime elapses, subsequent requests return a 401 Unauthorized response. Swagger UI displays the response body but leaves the stale token in the Authorize dialog, allowing the use
Forgejo: Least‑Privilege Authentication vs. Expired Credentials – Interoperability with External Auth Providers The goal is to integrate an external OAuth2 provider with Forgejo while ensuring that user access remains strictly scoped and that revoked or expired tokens do not continue to grant access. Forgejo accepts OAuth2 access tokens but does not automati
When implementing the Proof Key for Code Exchange (PKCE) extension with the S256 challenge method, authorization servers must verify that the submitted code_verifier matches the previously stored code_challenge. While RFC 7636 recommends a code_verifier length of 43 to 128 characters using unreserved characters, many client libraries accept shorter values, a
Token lifetime vs. scope granularity OAuth 2.0 access tokens carry both an expiration timestamp (exp claim) and a set of granted scopes. Resource servers must reject expired tokens, but the specification leaves open how servers should handle tokens that are still valid yet request scopes exceeding the client's current least-privilege assignment. Unresolved b
ory
crystal
linkedin
swagger
forgejo