ory/hydra

View on GitHub

Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.

Stars: 17.6k
Forks: 1.6k
Open beginner issues: 0
Indexed issues: 62

Dominant language: Go
License: Apache-2.0
Last GitHub push: Jul 29, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed
PR merge metrics: No merged PRs in 30d

Beginner friendly Everything

Open All

62 open issues indexed

serve.admin.request_log.disable_for_health has no effect: health paths missing /admin prefix in exclusion list Open

Needs Triage

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

ory/hydra#4130 · Opened Sep 14, 2026
Support localhost redirection with arbitrary port Open

feat

Difficulty 3/5 1-2 days Newbie friendliness 68/100

ory/hydra#4127 · Opened Sep 9, 2026
Accepting login challenge with `remember: true, remember_for: 0` creates cookie with 30-day expiration Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 64/100

ory/hydra#4126 · 1 comment · Opened Sep 2, 2026
Device verification GET query parameters are not propagated to the authorization request Open

Needs Triage

Difficulty 3/5 1-2 days Newbie friendliness 78/100

ory/hydra#4118 · Opened Jul 30, 2026
SetClientAssertionJWT inline DELETE on hydra_oauth2_jti_blacklist causes lock contention and latency spikes under concurrent load Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 52/100

ory/hydra#4113 · 2 comments · Opened Jul 1, 2026
Device flow: denied consent does not return access_denied to the polling client (UserCodeRejected never set) Open

backlog bug

Difficulty 4/5 3-5 days Newbie friendliness 38/100

ory/hydra#4110 · Opened Jun 12, 2026
oauth2: Missing code_verifier parameter in token exchange OpenAPI spec Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

ory/hydra#4099 · Opened May 1, 2026
ci: surface breaking-change drift on spec/api.json Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

ory/hydra#4097 · 1 comment · Opened Apr 26, 2026
PATCHing an OAuth Client clears the registration access token Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

ory/hydra#4093 · Opened Apr 22, 2026
Default page_size for GET /admin/clients reduced to 100 — undocumented breaking change Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ory/hydra#4092 · Opened Apr 15, 2026
Post Quantum Roadmap Open

feat

Difficulty 5/5 Over a week Newbie friendliness 25/100

ory/hydra#4091 · 8 comments · Opened Apr 14, 2026
OIDC Dynamic Client Registration - PUT does not return `registration_client_uri` Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 52/100

ory/hydra#4084 · 1 reaction · Opened Mar 19, 2026
Bug: AcceptOAuth2LogoutRequest returns before session is invalidated, causing silent re-authentication race condition Open

bug

Difficulty 5/5 Over a week Newbie friendliness 32/100

ory/hydra#4070 · 1 comment · Opened Feb 20, 2026
[Code Flow, Ory Hydra 2.3.0] "nonce" is omitted in ID Token when passed as request parameter (not inside signed JWT Request Object) Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 42/100

ory/hydra#4069 · 2 comments · 3 reactions · Opened Feb 19, 2026
feat: Add HTTP client configuration options for token_hook to improve performance Open

feat

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ory/hydra#4067 · Opened Feb 11, 2026
Support "Client ID Metadata Document" (CIMD) Open

feat

Difficulty 5/5 Over a week Newbie friendliness 42/100

ory/hydra#4061 · 6 comments · 26 reactions · Opened Jan 17, 2026
Optional Access Token Strategy for Dynamic Client Registration Open

feat

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ory/hydra#4060 · Opened Jan 15, 2026
Configuration of the csrf cookies paths Open

feat

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ory/hydra#4059 · Opened Jan 13, 2026
Allow custom request parameters forwarded to token hook request payload Open

feat

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ory/hydra#4055 · 2 reactions · Opened Dec 22, 2025
skip_logout_consent has invalid default value Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 42/100

ory/hydra#4052 · 1 comment · Opened Dec 16, 2025
Allow setting default values for optional DCR values Open

backlog feat

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ory/hydra#4044 · 3 comments · 8 reactions · Opened Nov 22, 2025
Logout token does not contains exp claim Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

ory/hydra#4035 · Opened Oct 16, 2025
Support unsetting `jwks_uri` from `.well-known/openid-configuration` endpoint Open

feat

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/hydra#4029 · Opened Sep 26, 2025
Add Janitor removing expired tokens by client_secret_expires_at Open

feat stale

Difficulty 3/5 1-2 days Newbie friendliness 52/100

ory/hydra#4026 · 1 comment · Opened Sep 12, 2025
OAuth2 Token Revocation Endpoint Returns 200 OK for Invalid Scenarios (Empty Token & Wrong Client Credentials) Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ory/hydra#4025 · Opened Sep 2, 2025
Bug: Hydra 2.3.0 migration fails on clean MySQL 8.0.43 with “Cannot change column 'nid': used in a foreign key constraint” Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ory/hydra#4016 · 2 comments · Opened Aug 4, 2025
Post Logout Redirect Validation w/ Custom URL Scheme Namespace Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 42/100

ory/hydra#4009 · Opened Jul 7, 2025
Support JWKS_URI for trust grant issuer Open

feat stale

Difficulty 4/5 3-5 days Newbie friendliness 55/100

ory/hydra#3990 · 3 comments · 3 reactions · Opened May 15, 2025
Allow custom KID/JWK for ID and access token signing Open

feat

Difficulty 5/5 Over a week Newbie friendliness 35/100

ory/hydra#3985 · 2 comments · Opened May 5, 2025
Client specific login and consent urls Open

feat

Difficulty 5/5 Over a week Newbie friendliness 25/100

ory/hydra#3982 · 1 comment · 2 reactions · Opened Apr 25, 2025
oauth2 webhook: `granted_scopes` always empty for `authorization_code` Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 20/100

ory/hydra#3969 · Opened Mar 27, 2025
The current challenge is too long and may be mistakenly identified as risky by the browser Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 38/100

ory/hydra#3955 · 9 comments · Opened Mar 4, 2025
not supported by MySQL driver: unknown time zone Asia/Shanghai Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 25/100

ory/hydra#3954 · Opened Mar 4, 2025
`token` endpoint with `grant_type` `urn:ietf:params:oauth:grant-type:jwt-bearer` fails to work without `client_id` Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 38/100

ory/hydra#3903 · 1 reaction · Opened Dec 9, 2024
When using pairwise, sector_identifier_uri is enforced when creating an OIDC client from the CLI (*not* using Dynamic Client Registration) Open

bug

Difficulty 5/5 Over a week Newbie friendliness 25/100

ory/hydra#3898 · Opened Nov 28, 2024
Janitor purge does not remove lines from hydra_oauth2_flow Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 30/100

ory/hydra#3877 · 3 reactions · Opened Nov 5, 2024
Incorrect Handling of Scopes with Special Character "|" in scp Claim Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ory/hydra#3829 · 3 comments · 2 reactions · Opened Sep 2, 2024
Seq scan for janitor login/consent flows cleanup SQL query Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ory/hydra#3822 · 2 comments · 2 reactions · Opened Aug 26, 2024
Not able to perform simultaneous auth flows with the same client Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

ory/hydra#3757 · 1 comment · 2 reactions · Opened Apr 11, 2024
Add `prompt=create` alias for `prompt=registration` Open

backlog feat

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

ory/hydra#3742 · 2 comments · 1 reaction · Opened Mar 20, 2024
Assertions may be reused & dead lock Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 42/100

ory/hydra#3740 · 2 comments · Opened Mar 18, 2024
Calling end_session_endpoint with id_token_hint errors when JWK is rotated Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/hydra#3719 · 2 comments · Opened Feb 16, 2024
quickstart 5-min fails: permission denied Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/hydra#3713 · 2 comments · 1 reaction · Opened Feb 9, 2024
Reading cookie in cross-site context will be blocked in future Chrome versions Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 30/100

ory/hydra#3703 · 7 comments · Opened Jan 25, 2024
Configure sensitive fields that should be redacted Open

feat

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ory/hydra#3687 · 4 comments · Opened Dec 29, 2023
When the database cannot be connected, /oauth2/token returns a 401 status code instead of 500 Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

ory/hydra#3671 · 5 comments · 1 reaction · Opened Nov 24, 2023
Invalid links to Patreon and Open Collective Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

ory/hydra#3668 · Opened Nov 15, 2023
issue doing revocation with sid Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/hydra#3653 · 1 comment · Opened Oct 23, 2023
Client object is null in the GET <hydra-admin>/admin/oauth2/auth/requests/logout response if logout was initiated using GET <hydra-public>/oauth2/sessions/logout Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ory/hydra#3643 · Opened Oct 8, 2023
Disable admin health check request logging environment setting ignored Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ory/hydra#3630 · 3 comments · 1 reaction · Opened Sep 15, 2023

ory/hydra

Get new issues in your inbox