doorkeeper 6.0.0.beta2 → 6.0.0.rc2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b401160f58e48398c2e25631a27e5dabc423480e08f34a64c91c25107ffcab53
-  data.tar.gz: 6c6dc01f00118c8525fe7ec329cab28cdaad05b5c5b06402cbb7f59ceb565e1a
+  metadata.gz: c6d4350f4bd6db700eb44e19c8078618b64e440bfd1edf8ec51ef306ec1a99a9
+  data.tar.gz: a284bba8ee06ab1bf53ca43fd8a803320c4d5fe1b2576f24633f3119b23582b0
 SHA512:
-  metadata.gz: c394405b84f4b64de4db90e9ab8ea932f2899a2f3898d78df4d06add7765c6f5ae7a457e8e3c19ed69bf7592ffec8c3d1ab5c241f1a521e0347780ead79c233d
-  data.tar.gz: 2275e90f19537ae4cda5e60ad1571ec29e0468e53b84d91bb165dea68960c2bf60d358194373ebd183b688d9043d86ef3a0e3685c0c38c7d4db8822ee7a98534
+  metadata.gz: 33c85db50f78fbef731514c037cda2fbbe40b3b7c3c25e671563781e946c02aed6084ff0a2cc5bae0409e7e2808ab4f30d67639f3274b039ac39cc27a8144e3f
+  data.tar.gz: 633fbee3c0259e194a1b183f3c959ef90194d721755bcad84ccf0d198173f94d88aed428b615aed3e3c3d83d2b8c01f2b6f317d036f074aa9b0c699180a2e2a8

data/CHANGELOG.md

@@ -9,6 +9,45 @@ User-visible changes worth mentioning.
 
 - [#PR ID] Description of the change.
 
+## 6.0.0.rc2
+
+**Please make sure** you read the [Upgrade guides](https://github.com/doorkeeper-gem/doorkeeper/wiki/Migration-from-old-versions)
+and changelog below before the update since this version includes breaking changes.
+
+- [#1951] Fix: the built gem no longer contains `vendor/bundle`. The gemspec globed all of `vendor/`, which swept in the bundle installed by the release workflow; 6.0.0.rc1 is a 44.4 MB download against 154 KB for 6.0.0.beta2.
+- Fix: `AuthorizedApplicationsController` now answers `401 Unauthorized` instead of running with a `nil` resource owner, which listed and revoked every token that has no resource owner — the ones the client credentials flow issues. Affected host applications are those whose `resource_owner_authenticator` answers `nil` without halting the request itself; the generated initializer's example redirects and is not affected.
+- Fix: `AuthorizationsController#destroy` now validates the client and redirect URI before producing the deny response, and renders — never redirects — when validation fails. Previously the deny path performed no OAuth-layer validation at all, allowing an open redirect to an attacker-controlled origin with the OAuth `state` attached. Also reject unregistered `response_type` values on the authorization endpoint rather than resolving them through the `constantize` fallback.
+- Fix: refuse redirect URIs with a script scheme (`javascript`, `vbscript`, `data`) both when an application is registered and at authorization time, regardless of `forbid_redirect_uri`. Such a URI is never a legitimate redirection endpoint, and with `response_mode=form_post` it became the action of the auto-submitting form the authorization server renders on its own origin. Already stored records with such a URI are now refused with `invalid_redirect_uri` before the consent screen is shown.
+- [#1932] Fix: keep the scope originally granted by the resource owner on refresh tokens (RFC 6749 §6), so a chain narrowed on one refresh can return to its granted scope. Tracked in a new `refresh_token_scopes` column; existing installations opt in with `rails generate doorkeeper:refresh_token_scopes`.
+- [#1933] Warn at boot when the `implicit` or `password` grant flow is enabled: both are deprecated by RFC 9700 (OAuth 2.0 Security BCP) and removed from OAuth 2.1, and may be removed in a future Doorkeeper release.
+- [#1915] Fix: fetching a client's `jwks_uri` now falls back to the other addresses returned by DNS when the first one cannot be connected to.
+- [#1934] The refresh_token grant now consults `custom_access_token_expires_in` (with `Doorkeeper::OAuth::REFRESH_TOKEN` as the context grant type) for the TTL of the refreshed access token. A callable that returns `nil` for this grant, or no callable at all, keeps inheriting the TTL of the token being refreshed as before. A callable that returns a value unconditionally now applies to refreshes as well.
+- [#1935] Add opt-in `public_client_access_token_expires_in` configuration option: a ceiling for the lifetime of access tokens issued to public (non-confidential) clients by any grant, refresh_token included, as OAuth 2.1 Section 2.4 requires the exposure of tokens issued to unauthenticated clients to be limited. Confidential clients are not affected.
+- [#1938] Fix: a request body ActionDispatch cannot parse (malformed JSON under a JSON content type, say) no longer raises `ActionDispatch::Http::Parameters::ParseError` out of `Doorkeeper::OAuth::Token.from_request` and `doorkeeper_token`. Since 5.9.7 the RFC 6750 §2 multi-method check read the body on every request, so such a request raised even when it carried a valid Bearer header. The body is now treated as carrying no token, the same way ActionDispatch's own `#filtered_parameters` treats that error.
+- [#1950] Document `hash_token_secrets` / `hash_application_secrets` `fallback:` as a migration-period setting that should be removed once every row is hashed, and warn at boot for as long as one is configured. While a `:plain` fallback is active the stored value is itself a valid credential, so those columns need protecting as carefully as plaintext ones.
+- [#1953] Fix: `public_client_access_token_expires_in` now also holds under `reuse_access_token` and with String TTLs, and the refresh_token grant hands `custom_access_token_expires_in` and `resource_indicator_validator` what every other grant does.
+
+## 6.0.0.rc1
+
+**Please make sure** you read the [Upgrade guides](https://github.com/doorkeeper-gem/doorkeeper/wiki/Migration-from-old-versions)
+and changelog below before the update since this version includes breaking changes.
+
+- Require Ruby >= 3.2 in the gemspec, matching the CI matrix (3.2 / 3.3 / 3.4 / 4.0). Ruby 2.7, 3.0 and 3.1 have reached end-of-life.
+- Fix: the `client_secret_basic` strategy now requires a `client_id` sent in the request body to name the same client as the `Authorization: Basic` header — the RFC 7521 §4.2 agreement check `private_key_jwt` already applies to an assertion's issuer. A request presenting Basic credentials for one client and a `client_id` for another was authenticated as the Basic client, silently discarding the other identity. A bare `client_id` is not a client authentication method of its own, so the RFC 6749 §2.3 multiple-methods check does not (and should not) count it.
+- [#1906] Internal: exempt `Doorkeeper::Config` from `Metrics/ClassLength` with a directive on the class itself instead of raising the cop's global ceiling, so adding a configuration option no longer trips the limit.
+- [#1907] Fix: a `resource` parameter no longer produces a 500 at the authorization endpoint when `resource_indicator_validator` is configured without the `doorkeeper:resource_indicators` migration. Such a request is now answered with `server_error`, as the token endpoint already did, and the missing migration is warned about at boot.
+- [#1909] Add Rails 8.1 to CI test matrix.
+- [#1910] Add opt-in `validate_client_before_resource_owner_authentication` configuration option: the authorization endpoint validates `client_id` and `redirect_uri` before authenticating the resource owner, so users are not sent through login for a request that can only fail.
+- [#1916] Fix broken Coveralls coverage reporting.
+- [#1918] The api_only controller specs no longer `load` the real controller sources, which detached the coverage of every other example that ran them and made the reported coverage depend on the random example order.
+- [#1923] Fix: the fallback secret upgrade no longer writes the matched secret back over a value stored in the meantime, which could undo a concurrent `#renew_secret` and leave the superseded secret valid. Active Record writes the upgrade conditionally on the column still holding the value that matched; other ORMs can implement the new `write_upgraded_secret` hook. The Active Record write is a single `update_all` statement, so model callbacks and validations no longer run on this upgrade (timestamps and optimistic locking are still maintained).
+- [#1925] Internal: pin the development dependency on `json` below 3.0. json 3 removed the positional options Hash from `JSON.parse` and the `quirks_mode` option from `JSON.generate`, both of which Active Support still uses, so the suite could not run on any released Rails version.
+- [#1926] **[BREAKING]** Fix: `private_key_jwt` client authentication no longer accepts an audience derived from the request's `Host` header, which let a client assertion minted for another authorization server be replayed here. A server that configures neither `issuer` nor Rails' `default_url_options[:host]` now has no acceptable audience and refuses every assertion, and is warned about it at boot.
+- **[BREAKING]** Refuse requests that transmit the access token by more than one method (RFC 6750 §2) with an `invalid_request` error, instead of silently authorizing with the first method that yielded a token and discarding the rest. The form-encoded body (§2.2) and the URI query (§2.3) count as two methods even though Rails and Rack merge them into a single `params` hash, and the same token repeated across two methods is refused too — §2 forbids the second method, not a disagreement between the two.
+  - Only the built-in extraction methods take part in the check; a custom callable in `access_token_methods` keeps the historical first-wins behavior and is never invoked more than once.
+  - `Doorkeeper::OAuth::Token.from_request` / `.authenticate` raise `Doorkeeper::Errors::MultipleAccessTokenMethods`. `Doorkeeper.authenticate` and every `doorkeeper_token` helper (Rails, Grape, and Doorkeeper's own controllers) keep their token-or-nil contract, so `doorkeeper_authorize!` renders the refusal through a new `doorkeeper_bad_request_render_options(error:)` hook (`head 400` unless you override it).
+  - **Upgrade note**: under `handle_auth_errors :raise` these requests raise `Doorkeeper::Errors::InvalidRequest`, a sibling of `Doorkeeper::Errors::InvalidToken` rather than a subclass — an existing `rescue Doorkeeper::Errors::InvalidToken` does not cover it.
+
 ## 6.0.0.beta2
 
 **Please make sure** you read the [Upgrade guides](https://github.com/doorkeeper-gem/doorkeeper/wiki/Migration-from-old-versions)
@@ -37,7 +76,6 @@ and changelog below before the update since this version includes breaking chang
 - [#1902] Fix: requests that omit `scope` now compute the same default scopes at the authorization and token endpoints (`Scopes#common`, symmetric). With dynamic scopes enabled, a scope pattern in either `default_scopes` or the application's scopes grants the matching concrete scope at both endpoints, closes [#1889].
 - [#1903] Fix: `revoke_previous_client_credentials_token` no longer revokes a client's live access token issued for a different `resource` ([#1886]), so a client can keep one audience-restricted token per resource server.
 - [#1905] [test] Cover `private_key_jwt` client authentication on the `client_credentials` grant, the one flow where an assertion is the client's only credential end to end. Test-only change.
-- Please add here
 
 ## 6.0.0.beta1
 
@@ -78,6 +116,15 @@ and changelog below before the update since this version includes breaking chang
 - [#1869] Improve test coverage
 - [#1870] Fix: raise the intended `Doorkeeper::Errors::TokenGeneratorNotFound` / `UnableToGenerateToken` (instead of a confusing `NameError`) when `application_secret_generator` is misconfigured.
 
+## 5.9.7
+
+- Refuse requests that transmit an access token by more than one method (RFC 6750 §2), instead of silently authorizing with the first configured `access_token_methods` entry that matched and discarding the other tokens. Such a request now fails closed as carrying no usable token (401 `invalid_token`); no calling contract changes. The form-encoded body (§2.2) and the URI query (§2.3) count as two methods even though Rails and Rack merge them into a single `params` hash. The same token repeated across two methods is refused too — §2 forbids the second method, not a disagreement between the two — and a custom callable extractor in `access_token_methods` keeps the historical first-wins behavior and is never invoked more than once. (The strict `invalid_request` (400) answer §3.1 prescribes ships with Doorkeeper 6.0.)
+- [#1925] Internal: pin the development dependency on `json` below 3.0. json 3 removed the positional options Hash from `JSON.parse` and the `quirks_mode` option from `JSON.generate`, both of which Active Support still uses, so the suite could not run on any supported Rails version.
+
+## 5.9.6
+
+- Reject requests that present more than one client identity (e.g. an `Authorization: Basic` header for one client and a `client_id` parameter naming another) with an `invalid_request` error, instead of authenticating the first extracted identity and silently discarding the other one. A `client_id` sent alongside another authentication method keeps working when it identifies the same client (RFC 7521 §4.2). Like the RFC 6749 §2.3 check released in 5.9.5, this validation does not apply when `client_credentials` is configured with a callable extractor, since the credentials the remaining extractors would return are never evaluated — the `client_credentials` option documents that now.
+
 ## 5.9.5
 
 - [#1901] Reject requests that authenticate the client with more than one method (RFC 6749 §2.3) with an `invalid_request` error, instead of silently authenticating with the first method that matched and discarding the other credentials.
@@ -132,7 +179,6 @@ and changelog below before the update since this version includes breaking chang
 - [#1779] Only lock previous access token model when creating a new token from its refresh token if revoke_previous_refresh_token_on_use is false
 - [#1778] Ensure that token revocation is idempotent by checking that that token has not already been revoked before revoking.
 
-
 ## 5.8.2
 
 - [#1755] Fix the error message for force_pkce

data/README.md

@@ -39,7 +39,9 @@ Supported features:
   - [Grape](#grape)
 - [ORMs](#orms)
 - [Extensions](#extensions)
+- [Database maintenance](#database-maintenance)
 - [Resource Indicators](#resource-indicators)
+- [Refresh Token Scopes](#refresh-token-scopes)
 - [Custom Grant Flows](#custom-grant-flows)
 - [Custom Client Authentication Methods](#custom-client-authentication-methods)
 - [Example Applications](#example-applications)
@@ -111,6 +113,18 @@ Extensions that are not included by default and can be installed separately.
 | CIBA - Client Initiated Backchannel Authentication Flow extension | [doorkeeper-ciba](https://github.com/autoseg/doorkeeper-ciba) |
 | Device Authorization Grant | [doorkeeper-device_authorization_grant](https://github.com/exop-group/doorkeeper-device_authorization_grant) |
 
+## Database maintenance
+
+Doorkeeper does **not** automatically remove expired or revoked tokens and grants. The `oauth_access_tokens` and `oauth_access_grants` tables grow indefinitely and can reach millions of rows if left unmanaged.
+
+Prune them periodically with the bundled rake task:
+
+```bash
+bundle exec rake doorkeeper:db:cleanup
+```
+
+This deletes expired and revoked access tokens and grants. See the [Rake tasks guide](https://doorkeeper.gitbook.io/guides/internals/rake) for details.
+
 ## Resource Indicators
 
 Doorkeeper supports [Resource Indicators for OAuth 2.0 (RFC 8707)](https://datatracker.ietf.org/doc/html/rfc8707), allowing clients to signal which protected resource(s) they intend to access. Tokens are then audience-restricted to those resources.
@@ -156,6 +170,21 @@ RFC 8707 uses repeated query parameters (`?resource=…&resource=…`) for multi
 
 A single `resource=…` works as-is.
 
+## Refresh Token Scopes
+
+A client may narrow the access token it gets back from the refresh token grant by sending a `scope` parameter. Per [RFC 6749 §6](https://datatracker.ietf.org/doc/html/rfc6749#section-6) the refresh token itself keeps the scope originally granted by the resource owner: a later refresh that omits `scope` returns to the granted scope, and one that asks for the granted scope again is accepted.
+
+Doorkeeper tracks the granted scope in the `refresh_token_scopes` column of `oauth_access_tokens`. New installs get it from the install migration; existing installs add it with:
+
+```bash
+rails generate doorkeeper:refresh_token_scopes
+rails db:migrate
+```
+
+With the column in place, [token introspection](https://datatracker.ietf.org/doc/html/rfc7662#section-2.2) of a refresh token reports the granted scope rather than the scope of the access token it was issued with, and `reuse_access_token` does not hand a grant of a narrower scope an existing token whose refresh token was granted a wider one.
+
+Without the column, a narrowed refresh narrows the refresh token as well, so the chain can never return to the granted scope (the behavior of Doorkeeper before the column existed), and a `refresh_token_scopes` assigned to an access token is ignored. Rows created before the migration keep that behavior until they are rotated, and so do the [ORM extensions](#extensions) (Sequel, MongoDB) until they add the field.
+
 ## Custom Grant Flows
 
 Besides the built-in OAuth 2 flows, Doorkeeper can recognize and process any custom grant type through its grant flow registry — including grant types whose names are URNs or URIs, such as the SAML 2.0 bearer assertion grant defined by [RFC 7522](https://www.rfc-editor.org/rfc/rfc7522).

data/app/controllers/doorkeeper/authorizations_controller.rb

@@ -2,6 +2,9 @@
 
 module Doorkeeper
   class AuthorizationsController < Doorkeeper::ApplicationController
+    before_action :validate_client,
+                  only: :new,
+                  if: -> { Doorkeeper.config.validate_client_before_resource_owner_authentication? }
     before_action :authenticate_resource_owner!
 
     def new
@@ -16,7 +19,14 @@ module Doorkeeper
       redirect_or_render(authorize_response)
     end
 
+    # The deny path answers a request the client sent, so it is subject to the
+    # same client and redirect URI validation as #create: without it an
+    # unregistered redirect_uri was honoured and the user-agent redirected to
+    # it, carrying the OAuth `state` (and, since RFC 9207 support was added,
+    # the issuer) to an origin of the caller's choosing.
     def destroy
+      return if refuse_invalid_client?(pre_auth)
+
       redirect_or_render(authorization.deny)
     rescue Doorkeeper::Errors::InvalidTokenStrategy => e
       error_response = get_error_response_from_exception(e)
@@ -45,13 +55,66 @@ module Doorkeeper
 
       if Doorkeeper.configuration.redirect_on_errors? && pre_auth.error_response.redirectable?
         redirect_or_render(pre_auth.error_response)
-      elsif Doorkeeper.configuration.api_only
-        render json: pre_auth.error_response.body, status: pre_auth.error_response.status
       else
-        render :error, locals: { error_response: pre_auth.error_response }, status: pre_auth.error_response.status
+        render_error_response(pre_auth.error_response)
       end
     end
 
+    def render_error_response(error_response)
+      if Doorkeeper.configuration.api_only
+        render json: error_response.body, status: error_response.status
+      else
+        render :error, locals: { error_response: error_response }, status: error_response.status
+      end
+    end
+
+    # Refuses the request before resource owner authentication when the
+    # client_id or redirect_uri is missing or invalid.
+    #
+    # Host applications that need to refuse a client on their own terms (an
+    # allow-list, a registry lookup) can override this and call +super+ first:
+    #
+    #   class AuthorizationsController < Doorkeeper::AuthorizationsController
+    #     private
+    #
+    #     def validate_client
+    #       super
+    #       return if performed?
+    #       return if MyRegistry.allowed?(client_pre_auth.client.application)
+    #
+    #       head :forbidden
+    #     end
+    #   end
+    def validate_client
+      refuse_invalid_client?(client_pre_auth)
+    end
+
+    # Renders the error of +pre_authorization+ when its client_id or
+    # redirect_uri is missing or invalid, and answers whether the request was
+    # refused. Errors are rendered, never redirected, regardless of
+    # `handle_auth_errors :redirect`: no failure this check can produce leaves
+    # a redirect target worth trusting. Either the client failed first, so the
+    # redirect URI was never reached, or the redirect URI is itself the invalid
+    # one — and RFC 6749 Section 3.1.2.4 forbids redirecting the user-agent to
+    # an invalid redirection URI.
+    def refuse_invalid_client?(pre_authorization)
+      return false if pre_authorization.client_valid?
+
+      error_response = pre_authorization.error_response
+      error_response.raise_exception! if Doorkeeper.config.raise_on_errors?
+
+      render_error_response(error_response)
+      true
+    end
+
+    # The pre-authentication view of the request. It carries no resource owner
+    # (nobody is authenticated yet), so it is kept apart from #pre_auth:
+    # owner-dependent validations (authorize_resource_owner_for_client) and the
+    # views need the one built with current_resource_owner.
+    def client_pre_auth
+      @client_pre_auth ||= OAuth::PreAuthorization.new(Doorkeeper.configuration, pre_auth_params)
+    end
+
     def can_authorize_response?
       Doorkeeper.config.custom_access_token_attributes.empty? && pre_auth.client.application.confidential? && matching_token?
     end

data/app/controllers/doorkeeper/authorized_applications_controller.rb

@@ -3,6 +3,7 @@
 module Doorkeeper
   class AuthorizedApplicationsController < Doorkeeper::ApplicationController
     before_action :authenticate_resource_owner!
+    before_action :validate_resource_owner
 
     def index
       @applications = Doorkeeper.config.application_model.authorized_for(current_resource_owner)
@@ -29,5 +30,27 @@ module Doorkeeper
         format.json { head :no_content }
       end
     end
+
+    private
+
+    # `authenticate_resource_owner!` hands the request to the host
+    # application's `resource_owner_authenticator` block, which is expected to
+    # halt the request itself — redirect to a sign-in page, raise, render —
+    # when nobody is signed in. A block that merely answers nil halts nothing:
+    # the library default (no block configured) logs a warning and answers
+    # nil, and so does any block written as a bare lookup such as
+    # `User.find_by(id: session[:user_id])`.
+    #
+    # Both actions here scope their work to `current_resource_owner`, and a
+    # nil owner is not "no scope" — it is the scope of the records that have
+    # no resource owner, which is what the client credentials flow issues.
+    # #index would list every application holding one and #destroy would
+    # revoke them, for a caller that never authenticated. So refuse the
+    # request rather than treat "nobody" as an owner. Only this controller is
+    # guarded; `authenticate_resource_owner!` itself is left alone because
+    # AuthorizationsController shapes its own response around the owner.
+    def validate_resource_owner
+      head :unauthorized unless current_resource_owner
+    end
   end
 end

data/app/controllers/doorkeeper/token_info_controller.rb

@@ -6,7 +6,7 @@ module Doorkeeper
       if doorkeeper_token&.accessible?
         render json: doorkeeper_token_to_json, status: :ok
       else
-        error = OAuth::InvalidTokenResponse.new
+        error = doorkeeper_token_error_response
         response.headers.merge!(error.headers)
         render json: error_to_json(error), status: error.status
       end
@@ -21,5 +21,17 @@ module Doorkeeper
     def error_to_json(error)
       error.body
     end
+
+    # RFC 6750 §3.1: transmitting the access token by more than one method is
+    # answered with invalid_request (400), not invalid_token (401). The helper
+    # answers nil for such a request and keeps the error, so the response is
+    # chosen here rather than by rescuing a raise.
+    def doorkeeper_token_error_response
+      if (error = @_doorkeeper_multiple_token_methods_error)
+        OAuth::InvalidRequestResponse.new(reason: error.reason)
+      else
+        OAuth::InvalidTokenResponse.new
+      end
+    end
   end
 end

data/config/locales/en.yml

@@ -99,6 +99,7 @@ en:
           request_not_authorized: 'Request needs to be authorized. Required parameter for authorizing the request is missing or invalid.'
           invalid_code_challenge: 'Code challenge is required.'
           multiple_client_auth_methods: 'The request utilizes more than one mechanism for authenticating the client.'
+          multiple_access_token_methods: 'The request uses more than one method for including an access token.'
         invalid_redirect_uri: "The requested redirect URI is malformed or doesn't match the client redirect URI."
         unauthorized_client: 'The client is not authorized to perform this request using this method.'
         access_denied: 'The resource owner or authorization server denied the request.'

data/lib/doorkeeper/config/validations.rb

@@ -10,12 +10,15 @@ module Doorkeeper
       def validate!
         validate_client_authentication_conflict
         validate_client_authentication_registered
+        validate_private_key_jwt_identity
         validate_reuse_access_token_value
         validate_token_reuse_limit
         validate_secret_strategies
+        validate_secret_fallback_strategies
         validate_pkce_code_challenge_methods
         validate_custom_metadata
         validate_refresh_token_flow
+        validate_deprecated_grant_flows
         validate_issuer_format
         validate_issuer_metadata_discoverability
       end
@@ -70,6 +73,33 @@ module Doorkeeper
         )
       end
 
+      # Warn when private_key_jwt client authentication is enabled on a server
+      # that identifies itself nowhere. An assertion's audience is what keeps
+      # it from being replayed at another authorization server, so it is only
+      # ever checked against the configured +issuer+ or Rails'
+      # +default_url_options+ - never against the request's Host header, which
+      # the client controls. With neither configured there is no acceptable
+      # audience and every assertion is refused, so make that loud at boot
+      # rather than leave it to be discovered request by request.
+      def validate_private_key_jwt_identity
+        # The deprecated client_credentials option only maps onto shared-secret
+        # methods, so a configuration using it alone never enables this one.
+        return if instance_variable_defined?(:@client_credentials_methods) &&
+                  !instance_variable_defined?(:@client_authentication)
+        return unless client_authentication.map(&:to_s).include?("private_key_jwt")
+        return if issuer.present?
+
+        url_options = ::Rails.application&.routes&.default_url_options || {}
+        return if url_options[:host].present?
+
+        ::Rails.logger.error(
+          "[DOORKEEPER] private_key_jwt client authentication is enabled, but the server " \
+          "identifies itself nowhere, so no audience is acceptable and every client " \
+          "assertion will be refused. Configure issuer, or " \
+          "Rails.application.routes.default_url_options[:host].",
+        )
+      end
+
       # Determine whether +reuse_access_token+ and a non-restorable
       # +token_secret_strategy+ have both been activated.
       #
@@ -93,6 +123,46 @@ module Doorkeeper
         application_secret_strategy.validate_for(:application)
       end
 
+      # Warn for as long as a secret fallback strategy is configured. The
+      # fallback exists so that values written before hashing was enabled stay
+      # valid while they migrate, which makes it a setting for the migration
+      # period rather than a permanent one - but nothing expires it, and an
+      # installation that finished migrating long ago keeps it silently.
+      #
+      # A +:plain+ fallback is worth saying more about: it looks a value up by
+      # the value exactly as given, so while it is configured whatever the
+      # credential column holds is itself a valid credential. Against anyone
+      # who can read the column - a dump, a read-only injection, a logged query
+      # - the hashing protects nothing until the fallback is removed. A
+      # fallback to another hashing strategy does not have that property, since
+      # its stored values are still transformed, so it only gets the first part
+      # of the warning.
+      #
+      # The warning is unconditional rather than raised only while unhashed
+      # rows remain: answering that question means querying the credential
+      # tables at boot, and the setting itself is what needs surfacing.
+      def validate_secret_fallback_strategies
+        {
+          token: token_secret_fallback_strategy,
+          application: application_secret_fallback_strategy,
+        }.each do |type, strategy|
+          next if strategy.nil?
+
+          message =
+            "[DOORKEEPER] hash_#{type}_secrets is configured with a fallback strategy " \
+            "(#{strategy}), which is intended for the migration period only. Remove the " \
+            "fallback: option once every row has been migrated to the hashed format."
+
+          if strategy <= Doorkeeper::SecretStoring::Plain
+            message += " While it is configured, a value stored in the #{type} credential " \
+                       "column is itself a valid credential, so that column needs to be " \
+                       "protected as carefully as a plaintext credential."
+          end
+
+          ::Rails.logger.warn(message)
+        end
+      end
+
       def validate_token_reuse_limit
         return if !reuse_access_token ||
                   (token_reuse_limit > 0 && token_reuse_limit <= 100)
@@ -157,6 +227,27 @@ module Doorkeeper
         )
       end
 
+      # Grant flows deprecated by RFC 9700 (OAuth 2.0 Security Best Current
+      # Practice, BCP 240) and removed from OAuth 2.1: the implicit grant
+      # (RFC 9700 §2.1.2) and the resource owner password credentials grant
+      # (RFC 9700 §2.4). Warn at boot when one of them is enabled so that
+      # applications relying on them notice ahead of the removal.
+      DEPRECATED_GRANT_FLOWS = %w[implicit password].freeze
+
+      def validate_deprecated_grant_flows
+        enabled = calculate_grant_flows.map(&:to_s)
+
+        DEPRECATED_GRANT_FLOWS.each do |flow|
+          next unless enabled.include?(flow)
+
+          ::Rails.logger.warn(
+            "[DOORKEEPER] The #{flow} grant flow is deprecated by RFC 9700 (OAuth 2.0 " \
+            "Security Best Current Practice) and removed from OAuth 2.1. It is enabled " \
+            "via grant_flows and may be removed in a future Doorkeeper release.",
+          )
+        end
+      end
+
       # Warn when a configured issuer is not RFC-compliant. RFC 8414 (the
       # metadata issuer) and RFC 9207 (the authorization response iss parameter)
       # both require an https URL with a host and no query or fragment component.

data/lib/doorkeeper/config.rb

@@ -10,7 +10,7 @@ module Doorkeeper
   # that returns configuration Builder class. This exception raises when they don't
   # define it.
   #
-  class Config
+  class Config # rubocop:disable Metrics/ClassLength
     # Default Doorkeeper configuration builder
     class Builder < AbstractBuilder
       # Provide support for an owner to be assigned to each registered
@@ -182,6 +182,13 @@ module Doorkeeper
         @config.instance_variable_set(:@force_pkce, true)
       end
 
+      # Validate the authorization request's client_id and redirect_uri before
+      # authenticating the resource owner, so users are not sent through login
+      # for a request that can only fail (disabled by default)
+      def validate_client_before_resource_owner_authentication
+        @config.instance_variable_set(:@validate_client_before_resource_owner_authentication, true)
+      end
+
       # Use an API mode for applications generated with --api argument
       # It will skip applications controller, disable forgery protection
       def api_only
@@ -309,6 +316,9 @@ module Doorkeeper
     option :skip_authorization,             default: ->(_routes) {}
     option :access_token_expires_in,        default: 7200
     option :custom_access_token_expires_in, default: ->(_context) { nil }
+    # Ceiling for the TTL of access tokens issued to public clients (OAuth 2.1 Section 2.4).
+    # Applies to every grant, including refresh_token. nil (the default) means no ceiling.
+    option :public_client_access_token_expires_in, default: nil
     option :authorization_code_expires_in,  default: 600
     option :orm,                            default: :active_record
     option :native_redirect_uri,            default: "urn:ietf:wg:oauth:2.0:oob", deprecated: true
@@ -369,7 +379,9 @@ module Doorkeeper
     option :allow_grant_flow_for_client,    default: ->(_grant_flow, _client) { true }
 
     # Allows to forbid specific Application redirect URI's by custom rules.
-    # Doesn't forbid any URI by default.
+    # Doesn't forbid any URI by default. Redirect URIs with a script scheme
+    # (`javascript`, `vbscript`, `data`) are always rejected, regardless of
+    # this option.
     #
     # @param forbid_redirect_uri [Proc] Block or any object respond to #call
     #
@@ -629,6 +641,10 @@ module Doorkeeper
       option_set? :force_pkce
     end
 
+    def validate_client_before_resource_owner_authentication?
+      option_set? :validate_client_before_resource_owner_authentication
+    end
+
     def enforce_configured_scopes?
       option_set? :enforce_configured_scopes
     end

data/lib/doorkeeper/errors.rb

@@ -37,6 +37,20 @@ module Doorkeeper
       end
     end
 
+    # Raised when a request transmits an access token by more than one method,
+    # which RFC 6750 §2 explicitly forbids ("Clients MUST NOT use more than
+    # one method to transmit the token in each request"); §3.1 lists it among
+    # the conditions answered with invalid_request (HTTP 400).
+    class MultipleAccessTokenMethods < DoorkeeperError
+      def type
+        :invalid_request
+      end
+
+      def reason
+        :multiple_access_token_methods
+      end
+    end
+
     class MissingRequiredParameter < DoorkeeperError
       attr_reader :missing_param
 

data/lib/doorkeeper/grape/helpers.rb

@@ -36,11 +36,20 @@ module Doorkeeper
         env["api.endpoint"]
       end
 
+      # Memoized with the same defined? guard as Rails::Helpers#doorkeeper_token:
+      # both a request without a usable token and a refused multi-method request
+      # leave @doorkeeper_token nil, which ||= would re-evaluate on every call —
+      # re-running authentication just to reach the same verdict again.
       def doorkeeper_token
-        @doorkeeper_token ||= OAuth::Token.authenticate(
+        return @doorkeeper_token if defined?(@doorkeeper_token)
+
+        @doorkeeper_token = OAuth::Token.authenticate(
           decorated_request,
           *Doorkeeper.config.access_token_methods,
         )
+      rescue Errors::MultipleAccessTokenMethods => e
+        @_doorkeeper_multiple_token_methods_error = e
+        @doorkeeper_token = nil
       end
 
       def decorated_request
@@ -49,6 +58,7 @@ module Doorkeeper
 
       def error_status_codes
         {
+          bad_request: 400,
           unauthorized: 401,
           forbidden: 403,
         }

data/lib/doorkeeper/helpers/controller.rb

@@ -39,10 +39,22 @@ module Doorkeeper
       end
 
       # :doc:
+      #
+      # Answers nil (not a raise) when the request transmits an access token
+      # by more than one method (RFC 6750 §2), the same token-or-nil contract
+      # Rails::Helpers#doorkeeper_token keeps. This is the doorkeeper_token a
+      # subclass of Doorkeeper::ApplicationController or
+      # Doorkeeper::ApplicationMetalController resolves to, so a raise here
+      # would turn doorkeeper_authorize! in such a controller into an
+      # unhandled 500. The error is kept so the response can still be the
+      # invalid_request (400) RFC 6750 §3.1 prescribes.
       def doorkeeper_token
         return @doorkeeper_token if defined?(@doorkeeper_token)
 
         @doorkeeper_token ||= OAuth::Token.authenticate(request, *config_methods)
+      rescue Errors::MultipleAccessTokenMethods => e
+        @_doorkeeper_multiple_token_methods_error = e
+        @doorkeeper_token = nil
       end
 
       def config_methods