Version Number : 3.0.39

​

Overview

This minor update introduces changes for Authlete 3.0. This new version is available from October 29th (Thu).

​

New Features & Improvements

​

Full payload service flag

Added new returnFullPayload service flag which defaults to true and can be set to false by the user to receive a simplified payload from the applicable endpoints.

​

Specs support

N/A

​

Bug fixes

​

Refresh token deadlock fix

Fixed an issue where refresh token requests (grant_type=refresh_token) against the access_token table could hit a database deadlock under certain conditions.

​

Client token duration validation fix

Fixed an issue where the client update endpoint would not use the same lower bound as the create endpoint when validating the duration of the client token.

​

DN name error fix

Fixed an issue where invalid TLS certificate DN names would trigger a 500 error instead of the intended 401.

​

Request URI NPE fix

Fixed an issue where failing to fetch a client’s pre-registered request_uri would result in a NullPointerException instead of the intended invalid_request_uri authorization error.

​

Grant revoke response fix

Fixed an issue where a grant revoke targeting an unfound grant would result in a NO_CONTENT (204) response, instead of the intended 404.

• This 204 response is used for a successful revoke, which would mislead the caller into thinking that something happened, when in fact the revoke did not have any effect

​

Access token cache fix

Fixed an issue where access tokens would keep validating at introspection after a grant revoke, until the cache entry expires naturally.

​

Request expiry cap fix

Fixed an issue where a client could make an auth_req_id live for an arbitrary time, due to the client-supplied requested_expiry being uncapped.

​

Other

N/A