ory/oathkeeper

View on GitHub

A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP(s) requests. Inspired by the BeyondCorp / Zero Trust white paper. Written in Go.

Stars: 3.6k
Forks: 415
Open beginner issues: 0
Indexed issues: 71

Dominant language: Go
License: Apache-2.0
Last GitHub push: Jul 27, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: help wanted good first issue
PR merge metrics: No merged PRs in 30d

Beginner friendly Everything

Open All

71 open issues indexed

/health/ready reports ready after the first rule is loaded, so an incomplete rule set is served during startup Open

Needs Triage

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ory/oathkeeper#1284 · Opened Aug 20, 2026
remote_json: preserve 4xx status codes from remote authorizer Open

Needs Triage

Difficulty 4/5 3-5 days Newbie friendliness 58/100

ory/oathkeeper#1283 · Opened Aug 5, 2026
upstream reference closed: github.com/knadh/koanf/pull/47 Open

good first issue help wanted upstream

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/oathkeeper#1277 · Opened Jun 18, 2026
upstream reference closed: github.com/kubescape/kubescape/pull/1568 Open

good first issue help wanted upstream

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

ory/oathkeeper#1276 · Opened Jun 18, 2026
upstream reference closed: github.com/gobuffalo/fizz/issues/45 Open

good first issue help wanted upstream

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

ory/oathkeeper#1278 · Opened Jun 18, 2026
upstream reference closed: github.com/fsnotify/fsnotify/issues/199 Open

good first issue help wanted upstream

Difficulty 2/5 1-3 hours Newbie friendliness 42/100

ory/oathkeeper#1280 · Opened Jun 18, 2026
upstream reference closed: github.com/knadh/koanf/issues/77 Open

good first issue help wanted upstream

Difficulty 2/5 1-3 hours Newbie friendliness 30/100

ory/oathkeeper#1279 · Opened Jun 18, 2026
Allow forwarding selected request headers to remote authorizer Open

feat

Difficulty 3/5 1-2 days Newbie friendliness 68/100

ory/oathkeeper#1270 · Opened Apr 30, 2026
flaky tests(s) observed in `v26.2.0` Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ory/oathkeeper#1268 · Opened Mar 31, 2026
Oathkeeper v26.2.0 redirect error handler drops https Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

ory/oathkeeper#1267 · Opened Mar 24, 2026
Oathkeeper 26.2 strips trailing slash Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 62/100

ory/oathkeeper#1266 · 1 comment · 3 reactions · Opened Mar 21, 2026
Decision API discards query string from X-Forwarded-Uri, breaking authenticators that read query parameters Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

ory/oathkeeper#1264 · Opened Mar 19, 2026
upstream reference closed: github.com/fsnotify/fsnotify/issues/199 Open

good first issue help wanted upstream

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

ory/oathkeeper#1250 · Opened Dec 20, 2025
upstream reference closed: github.com/knadh/koanf/pull/47 Open

good first issue help wanted upstream

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ory/oathkeeper#1251 · Opened Dec 20, 2025
upstream reference closed: github.com/gobuffalo/fizz/issues/45 Open

good first issue help wanted upstream

Difficulty 1/5 Under an hour Newbie friendliness 25/100

ory/oathkeeper#1252 · Opened Dec 20, 2025
upstream reference closed: github.com/knadh/koanf/issues/77 Open

good first issue help wanted upstream

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

ory/oathkeeper#1253 · Opened Dec 20, 2025
upstream reference closed: github.com/evanphx/json-patch/pull/158 Open

good first issue help wanted upstream

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ory/oathkeeper#1254 · Opened Dec 20, 2025
Semicolon in Query string causes it to not be sent upstream Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ory/oathkeeper#1248 · Opened Dec 12, 2025
Make bearer token prefix configurable to support API key migration with Ory Hydra Open

feat

Difficulty 3/5 1-2 days Newbie friendliness 48/100

ory/oathkeeper#1245 · Opened Oct 28, 2025
allow remote authorizer 204 response as success or allowed Open

feat stale

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

ory/oathkeeper#1237 · 1 comment · Opened Sep 17, 2025
Access rules not matching any request (proxy always returns 404) Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 32/100

ory/oathkeeper#1235 · Opened Aug 4, 2025
503 Error on Readiness Probe Due to Empty Rules Array in Oathkeeper Helm Chart Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/oathkeeper#1225 · 2 reactions · Opened Apr 4, 2025
Differences in Ory Keto authorization request endpoints Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/oathkeeper#1220 · 2 comments · Opened Mar 13, 2025
More Customizable collapse_request_path Setting Open

feat

Difficulty 5/5 Over a week Newbie friendliness 35/100

ory/oathkeeper#1212 · 3 comments · Opened Dec 30, 2024
Wrong CORS headers when duplicate header in `Access-Control-Request-Headers` in v0.40.8 Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 42/100

ory/oathkeeper#1208 · 2 comments · Opened Dec 26, 2024
Option strip_path is ignored by .MatchContext.URL.Path Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 35/100

ory/oathkeeper#1204 · Opened Dec 2, 2024
Multiple matching rules are causing 500 Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ory/oathkeeper#1196 · 1 comment · Opened Nov 6, 2024
This request object uses unsupported signing algorithm "EdDSA" Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 52/100

ory/oathkeeper#1191 · 1 comment · 1 reaction · Opened Oct 2, 2024
Upgrade 'go-swagger/go-swagger' to avoid build error. Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

ory/oathkeeper#1179 · 6 comments · Opened Aug 27, 2024
cookie_session authenticator does not extract subject when method is HEAD Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 38/100

ory/oathkeeper#1172 · Opened Jul 8, 2024
Oathkeeper returns a 401 "Access credentials are invalid" when exceeding Ory Network's rate limiting on /sessions/whoami endpoint Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ory/oathkeeper#1167 · 8 comments · 2 reactions · Opened May 21, 2024
Oathkeeper docker-compose.yml outdated env vars Open

bug

Difficulty 1/5 Under an hour Newbie friendliness 45/100

ory/oathkeeper#1164 · 1 comment · 1 reaction · Opened May 14, 2024
Oathkeeper returns encoded cookie Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 30/100

ory/oathkeeper#1158 · Opened Apr 12, 2024
Duplicate requests using decisions endpoint via NGINX Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ory/oathkeeper#1156 · Opened Mar 27, 2024
None of the provided URLs returned a valid JSON Web Key Set Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 35/100

ory/oathkeeper#1151 · 1 comment · Opened Feb 29, 2024
Outdated OTEL dependencies prevent import Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/oathkeeper#1148 · Opened Jan 31, 2024
Decision API is not respecting the token_from config Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 35/100

ory/oathkeeper#1144 · 1 comment · Opened Dec 13, 2023
Reference to .MatchContext.RegexpCaptureGroups doesn't render in access rules authenticator config Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/oathkeeper#1141 · Opened Dec 1, 2023
Oathkeeper does not support X-Forwarded headers properly Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/oathkeeper#1139 · 4 comments · 3 reactions · Opened Nov 9, 2023
Basic Authorization header result in Unauthorized when using `anonymous` authenticator handler Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 38/100

ory/oathkeeper#1137 · 6 reactions · Opened Sep 14, 2023
Docs wrong for `bearer_token` Subject default location Open

bug

Difficulty 1/5 Under an hour Newbie friendliness 45/100

ory/oathkeeper#1130 · 2 reactions · Opened Aug 27, 2023
Oathkeeper duplicates CORS headers Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 35/100

ory/oathkeeper#1100 · 10 comments · 6 reactions · Opened May 2, 2023
`strip_path` strips the prefix from the final upstream request, not the initial request Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/oathkeeper#1085 · 2 comments · Opened Mar 30, 2023
Custom bearer token not redacted Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ory/oathkeeper#1081 · 1 comment · 2 reactions · Opened Mar 21, 2023
Middleware initializes pgx/v4 Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ory/oathkeeper#1064 · 1 comment · Opened Feb 8, 2023
Connection reuse in proxy mode Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 38/100

ory/oathkeeper#1045 · Opened Dec 23, 2022
remote_json encounted a go json error Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 38/100

ory/oathkeeper#1031 · Opened Nov 4, 2022
cookie_session Authenticator not working with gRPC middleware Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 42/100

ory/oathkeeper#1023 · 1 comment · Opened Sep 26, 2022
oathkeeper breaks with custom domain Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ory/oathkeeper#1005 · Opened Sep 8, 2022
Incorrect data format getting received from mutator. Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 38/100

ory/oathkeeper#990 · Opened Aug 9, 2022

ory/oathkeeper

Get new issues in your inbox