oauth2 2.0.17 → 2.0.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (43) hide show
  1. checksums.yaml +4 -4
  2. checksums.yaml.gz.sig +0 -0
  3. data/CHANGELOG.md +70 -4
  4. data/CITATION.cff +0 -0
  5. data/CODE_OF_CONDUCT.md +0 -0
  6. data/CONTRIBUTING.md +17 -25
  7. data/FUNDING.md +7 -10
  8. data/IRP.md +107 -0
  9. data/LICENSE.txt +1 -1
  10. data/OIDC.md +10 -1
  11. data/README.md +250 -370
  12. data/REEK +2 -0
  13. data/RUBOCOP.md +0 -0
  14. data/SECURITY.md +3 -0
  15. data/THREAT_MODEL.md +94 -0
  16. data/lib/oauth2/access_token.rb +12 -15
  17. data/lib/oauth2/authenticator.rb +9 -7
  18. data/lib/oauth2/client.rb +10 -2
  19. data/lib/oauth2/error.rb +2 -0
  20. data/lib/oauth2/filtered_attributes.rb +10 -49
  21. data/lib/oauth2/response.rb +14 -12
  22. data/lib/oauth2/strategy/assertion.rb +2 -2
  23. data/lib/oauth2/strategy/auth_code.rb +0 -0
  24. data/lib/oauth2/strategy/base.rb +0 -0
  25. data/lib/oauth2/strategy/client_credentials.rb +0 -0
  26. data/lib/oauth2/strategy/implicit.rb +0 -0
  27. data/lib/oauth2/strategy/password.rb +0 -0
  28. data/lib/oauth2/version.rb +1 -1
  29. data/lib/oauth2.rb +39 -17
  30. data/sig/oauth2/access_token.rbs +0 -0
  31. data/sig/oauth2/authenticator.rbs +0 -0
  32. data/sig/oauth2/client.rbs +0 -0
  33. data/sig/oauth2/error.rbs +0 -0
  34. data/sig/oauth2/filtered_attributes.rbs +6 -1
  35. data/sig/oauth2/response.rbs +0 -0
  36. data/sig/oauth2/sanitized_logger.rbs +32 -0
  37. data/sig/oauth2/strategy.rbs +0 -0
  38. data/sig/oauth2/thing_filter.rbs +10 -0
  39. data/sig/oauth2/version.rbs +0 -0
  40. data/sig/oauth2.rbs +0 -0
  41. data.tar.gz.sig +0 -0
  42. metadata +40 -62
  43. metadata.gz.sig +0 -0
data/README.md CHANGED
@@ -9,9 +9,7 @@
9
9
 
10
10
  # 🔐 OAuth 2.0 Authorization Framework
11
11
 
12
- ⭐️ including OAuth 2.1 draft spec & OpenID Connect (OIDC)
13
-
14
- [![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license-ref] [![Downloads Rank][👽dl-ranki]][👽dl-rank] [![Open Source Helpers][👽oss-helpi]][👽oss-help] [![CodeCov Test Coverage][🔑codecovi]][🔑codecov] [![Coveralls Test Coverage][🔑coveralls-img]][🔑coveralls] [![QLTY Test Coverage][🔑qlty-covi]][🔑qlty-cov] [![QLTY Maintainability][🔑qlty-mnti]][🔑qlty-mnt] [![CI Heads][🚎3-hd-wfi]][🚎3-hd-wf] [![CI Runtime Dependencies @ HEAD][🚎12-crh-wfi]][🚎12-crh-wf] [![CI Current][🚎11-c-wfi]][🚎11-c-wf] [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] [![CI JRuby][🚎10-j-wfi]][🚎10-j-wf] [![Deps Locked][🚎13-🔒️-wfi]][🚎13-🔒️-wf] [![Deps Unlocked][🚎14-🔓️-wfi]][🚎14-🔓️-wf] [![CI Supported][🚎6-s-wfi]][🚎6-s-wf] [![CI Legacy][🚎4-lg-wfi]][🚎4-lg-wf] [![CI Unsupported][🚎7-us-wfi]][🚎7-us-wf] [![CI Ancient][🚎1-an-wfi]][🚎1-an-wf] [![CI Test Coverage][🚎2-cov-wfi]][🚎2-cov-wf] [![CI Style][🚎5-st-wfi]][🚎5-st-wf] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Apache SkyWalking Eyes License Compatibility Check][🚎15-🪪-wfi]][🚎15-🪪-wf]
12
+ [![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license-ref] [![Downloads Rank][👽dl-ranki]][👽dl-rank] [![CodeCov Test Coverage][🏀codecovi]][🏀codecov] [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls] [![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov] [![QLTY Maintainability][🏀qlty-mnti]][🏀qlty-mnt] [![CI Heads][🚎3-hd-wfi]][🚎3-hd-wf] [![CI Runtime Dependencies @ HEAD][🚎12-crh-wfi]][🚎12-crh-wf] [![CI Current][🚎11-c-wfi]][🚎11-c-wf] [![CI JRuby][🚎10-j-wfi]][🚎10-j-wf] [![Deps Locked][🚎13-🔒️-wfi]][🚎13-🔒️-wf] [![Deps Unlocked][🚎14-🔓️-wfi]][🚎14-🔓️-wf] [![CI Supported][🚎6-s-wfi]][🚎6-s-wf] [![CI Legacy][🚎4-lg-wfi]][🚎4-lg-wf] [![CI Unsupported][🚎7-us-wfi]][🚎7-us-wf] [![CI Ancient][🚎1-an-wfi]][🚎1-an-wf] [![CI Test Coverage][🚎2-cov-wfi]][🚎2-cov-wf] [![CI Style][🚎5-st-wfi]][🚎5-st-wf] [![CodeQL][🖐codeQL-img]][🖐codeQL] [![Apache SkyWalking Eyes License Compatibility Check][🚎15-🪪-wfi]][🚎15-🪪-wf]
15
13
 
16
14
  `if ci_badges.map(&:color).detect { it != "green"}` ☝️ [let me know][🖼️galtzo-discord], as I may have missed the [discord notification][🖼️galtzo-discord].
17
15
 
@@ -21,16 +19,23 @@
21
19
 
22
20
  [![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate at ko-fi.com][🖇kofi-img]][🖇kofi]
23
21
 
22
+ <details>
23
+ <summary>👣 How will this project approach the September 2025 hostile takeover of RubyGems? 🚑️</summary>
24
+
25
+ I've summarized my thoughts in [this blog post](https://dev.to/galtzo/hostile-takeover-of-rubygems-my-thoughts-5hlo).
26
+
27
+ </details>
28
+
24
29
  ## 🌻 Synopsis
25
30
 
26
31
  OAuth 2.0 is the industry-standard protocol for authorization.
27
- OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications,
28
- desktop applications, mobile phones, and living room devices.
29
32
  This is a RubyGem for implementing OAuth 2.0 clients (not servers) in Ruby applications.
30
33
 
34
+ ⭐️ including OAuth 2.1 draft spec & OpenID Connect (OIDC)
35
+
31
36
  ### Quick Examples
32
37
 
33
- <details>
38
+ <details markdown="1">
34
39
  <summary>Convert the following `curl` command into a token request using this gem...</summary>
35
40
 
36
41
  ```shell
@@ -46,13 +51,14 @@ curl --request POST \
46
51
  NOTE: In the ruby version below, certain params are passed to the `get_token` call, instead of the client creation.
47
52
 
48
53
  ```ruby
49
- OAuth2::Client.new(
54
+ client = OAuth2::Client.new(
50
55
  "REDMOND_CLIENT_ID", # client_id
51
56
  "REDMOND_CLIENT_SECRET", # client_secret
52
57
  auth_scheme: :request_body, # Other modes are supported: :basic_auth, :tls_client_auth, :private_key_jwt
53
58
  token_url: "oauth2/token", # relative path, except with leading `/`, then absolute path
54
59
  site: "https://login.microsoftonline.com/REDMOND_REDACTED",
55
- ). # The base path for token_url when it is relative
60
+ )
61
+ client.
56
62
  client_credentials. # There are many other types to choose from!
57
63
  get_token(resource: "REDMOND_RESOURCE_UUID")
58
64
  ```
@@ -61,10 +67,11 @@ NOTE: `header` - The content type specified in the `curl` is already the default
61
67
 
62
68
  </details>
63
69
 
64
- <details>
65
- <summary>Complete E2E single file script against [navikt/mock-oauth2-server](https://github.com/navikt/mock-oauth2-server)</summary>
70
+ <details markdown="1">
71
+ <summary>Complete E2E single file script against mock-oauth2-server</summary>
66
72
 
67
- - E2E example using the mock test server added in v2.0.11
73
+ - E2E example uses [navikt/mock-oauth2-server](https://github.com/navikt/mock-oauth2-server), which was added in v2.0.11
74
+ - E2E example does not ship with the released gem, so clone the source to play with it.
68
75
 
69
76
  ```console
70
77
  docker compose -f docker-compose-ssl.yml up -d --wait
@@ -93,26 +100,27 @@ docker compose -f docker-compose-ssl.yml down
93
100
  Troubleshooting: validate connectivity to the mock server
94
101
 
95
102
  - Check container status and port mapping:
96
- - docker compose -f docker-compose-ssl.yml ps
103
+ - `docker compose -f docker-compose-ssl.yml ps`
97
104
  - From the host, try the discovery URL directly (this is what the example uses by default):
98
- - curl -v http://localhost:8080/default/.well-known/openid-configuration
99
- - If that fails immediately, also try: curl -v --connect-timeout 2 http://127.0.0.1:8080/default/.well-known/openid-configuration
100
- - From inside the container (to distinguish container vs host networking):
101
- - docker exec -it oauth2-mock-oauth2-server-1 curl -v http://127.0.0.1:8080/default/.well-known/openid-configuration
105
+ - `curl -v http://localhost:8080/default/.well-known/openid-configuration`
106
+ - If that fails immediately, also try: `curl -v --connect-timeout 2 http://127.0.0.1:8080/default/.well-known/openid-configuration`
107
+ - From inside the container (to distinguish container vs. host networking):
108
+ - `docker exec -it oauth2-mock-oauth2-server-1 curl -v http://127.0.0.1:8080/default/.well-known/openid-configuration`
102
109
  - Simple TCP probe from the host:
103
- - nc -vz localhost 8080 # or: ruby -rsocket -e 'TCPSocket.new("localhost",8080).close; puts "tcp ok"'
110
+ - `nc -vz localhost 8080 # or: ruby -rsocket -e 'TCPSocket.new("localhost",8080).close; puts "tcp ok"'`
104
111
  - Inspect which host port 8080 is bound to (should be 8080):
105
- - docker inspect -f '{{ (index (index .NetworkSettings.Ports "8080/tcp") 0).HostPort }}' oauth2-mock-oauth2-server-1
112
+ - `docker inspect -f '{{ (index (index .NetworkSettings.Ports "8080/tcp") 0).HostPort }}' oauth2-mock-oauth2-server-1`
106
113
  - Look at server logs for readiness/errors:
107
- - docker logs -n 200 oauth2-mock-oauth2-server-1
114
+ - `docker logs -n 200 oauth2-mock-oauth2-server-1`
108
115
  - On Linux, ensure nothing else is bound to 8080 and that firewall/SELinux aren’t blocking:
109
- - ss -ltnp | grep :8080
116
+ - `ss -ltnp | grep :8080`
110
117
 
111
118
  Notes
112
- - Discovery URL pattern is: http://localhost:8080/<realm>/.well-known/openid-configuration, where <realm> defaults to "default".
119
+
120
+ - Discovery URL pattern is: `http://localhost:8080/<realm>/.well-known/openid-configuration`, where `<realm>` defaults to `default`.
113
121
  - You can change these with env vars when running the example:
114
- - E2E_ISSUER_BASE (default: http://localhost:8080)
115
- - E2E_REALM (default: default)
122
+ - `E2E_ISSUER_BASE` (default: http://localhost:8080)
123
+ - `E2E_REALM` (default: default)
116
124
 
117
125
  </details>
118
126
 
@@ -128,107 +136,39 @@ If it seems like you are in the wrong place, you might try one of these:
128
136
 
129
137
  ## 💡 Info you can shake a stick at
130
138
 
131
- | Tokens to Remember | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace] |
132
- |-------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
133
- | Works with JRuby | ![JRuby 9.1 Compat][💎jruby-9.1i] ![JRuby 9.2 Compat][💎jruby-9.2i] ![JRuby 9.3 Compat][💎jruby-9.3i] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎10-j-wf] [![JRuby 10.0 Compat][💎jruby-c-i]][🚎11-c-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf] |
134
- | Works with Truffle Ruby | ![Truffle Ruby 22.3 Compat][💎truby-22.3i] ![Truffle Ruby 23.0 Compat][💎truby-23.0i] <br/> [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎9-t-wf] [![Truffle Ruby 24.1 Compat][💎truby-c-i]][🚎11-c-wf] |
135
- | Works with MRI Ruby 3 | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎4-lg-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎6-s-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎6-s-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎6-s-wf] [![Ruby 3.4 Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf] |
136
- | Works with MRI Ruby 2 | ![Ruby 2.2 Compat][💎ruby-2.2i] <br/> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎1-an-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎1-an-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎1-an-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎7-us-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎7-us-wf] |
137
- | Support & Community | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Discussion][⛳gg-discussions-img]][⛳gg-discussions] [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork] [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor] |
138
- | Source | [![Source on GitLab.com][📜src-gl-img]][📜src-gl] [![Source on CodeBerg.org][📜src-cb-img]][📜src-cb] [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc] |
139
- | Documentation | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![Wiki][📜wiki-img]][📜wiki] |
140
- | Compliance | [![License: MIT][📄license-img]][📄license-ref] [![Compatible with Apache Software Projects: Verified by SkyWalking Eyes][📄license-compat-img]][📄license-compat] [![📄ilo-declaration-img]][📄ilo-declaration] [![Security Policy][🔐security-img]][🔐security] [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct] [![SemVer 2.0.0][📌semver-img]][📌semver] |
141
- | Style | [![Enforced Code Style Linter][💎rlts-img]][💎rlts] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog] [![Gitmoji Commits][📌gitmoji-img]][📌gitmoji] [![Compatibility appraised by: appraisal2][💎appraisal2-img]][💎appraisal2] |
142
- | Maintainer 🎖️ | [![Follow Me on LinkedIn][💖🖇linkedin-img]][💖🖇linkedin] [![Follow Me on Ruby.Social][💖🐘ruby-mast-img]][💖🐘ruby-mast] [![Follow Me on Bluesky][💖🦋bluesky-img]][💖🦋bluesky] [![Contact Maintainer][🚂maint-contact-img]][🚂maint-contact] [![My technical writing][💖💁🏼‍♂️devto-img]][💖💁🏼‍♂️devto] |
143
- | `...` 💖 | [![Find Me on WellFound:][💖✌️wellfound-img]][💖✌️wellfound] [![Find Me on CrunchBase][💖💲crunchbase-img]][💖💲crunchbase] [![My LinkTree][💖🌳linktree-img]][💖🌳linktree] [![More About Me][💖💁🏼‍♂️aboutme-img]][💖💁🏼‍♂️aboutme] [🧊][💖🧊berg] [🐙][💖🐙hub] [🛖][💖🛖hut] [🧪][💖🧪lab] |
139
+ | Tokens to Remember | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace] |
140
+ |-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
141
+ | Works with JRuby | ![JRuby 9.1 Compat][💎jruby-9.1i] ![JRuby 9.2 Compat][💎jruby-9.2i] ![JRuby 9.3 Compat][💎jruby-9.3i] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎10-j-wf] [![JRuby 10.0 Compat][💎jruby-c-i]][🚎11-c-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf] |
142
+ | Works with Truffle Ruby | ![Truffle Ruby 22.3 Compat][💎truby-22.3i] ![Truffle Ruby 23.0 Compat][💎truby-23.0i] ![Truffle Ruby 23.1 Compat][💎truby-23.1i] <br/> [![Truffle Ruby 24.1 Compat][💎truby-c-i]][🚎11-c-wf] |
143
+ | Works with MRI Ruby 3 | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎4-lg-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎6-s-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎6-s-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎6-s-wf] [![Ruby 3.4 Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf] |
144
+ | Works with MRI Ruby 2 | ![Ruby 2.2 Compat][💎ruby-2.2i] <br/> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎1-an-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎1-an-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎1-an-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎7-us-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎7-us-wf] |
145
+ | Support & Community | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼‍🏫expsup-upwork-img]][👨🏼‍🏫expsup-upwork] [![Get help from me on Codementor][👨🏼‍🏫expsup-codementor-img]][👨🏼‍🏫expsup-codementor] |
146
+ | Source | [![Source on GitLab.com][📜src-gl-img]][📜src-gl] [![Source on CodeBerg.org][📜src-cb-img]][📜src-cb] [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc] |
147
+ | Documentation | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![GitLab Wiki][📜gl-wiki-img]][📜gl-wiki] [![GitHub Wiki][📜gh-wiki-img]][📜gh-wiki] |
148
+ | Compliance | [![License: MIT][📄license-img]][📄license-ref] [![Compatible with Apache Software Projects: Verified by SkyWalking Eyes][📄license-compat-img]][📄license-compat] [![📄ilo-declaration-img]][📄ilo-declaration] [![Security Policy][🔐security-img]][🔐security] [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct] [![SemVer 2.0.0][📌semver-img]][📌semver] |
149
+ | Style | [![Enforced Code Style Linter][💎rlts-img]][💎rlts] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog] [![Gitmoji Commits][📌gitmoji-img]][📌gitmoji] [![Compatibility appraised by: appraisal2][💎appraisal2-img]][💎appraisal2] |
150
+ | Maintainer 🎖️ | [![Follow Me on LinkedIn][💖🖇linkedin-img]][💖🖇linkedin] [![Follow Me on Ruby.Social][💖🐘ruby-mast-img]][💖🐘ruby-mast] [![Follow Me on Bluesky][💖🦋bluesky-img]][💖🦋bluesky] [![Contact Maintainer][🚂maint-contact-img]][🚂maint-contact] [![My technical writing][💖💁🏼‍♂️devto-img]][💖💁🏼‍♂️devto] |
151
+ | `...` 💖 | [![Find Me on WellFound:][💖✌️wellfound-img]][💖✌️wellfound] [![Find Me on CrunchBase][💖💲crunchbase-img]][💖💲crunchbase] [![My LinkTree][💖🌳linktree-img]][💖🌳linktree] [![More About Me][💖💁🏼‍♂️aboutme-img]][💖💁🏼‍♂️aboutme] [🧊][💖🧊berg] [🐙][💖🐙hub] [🛖][💖🛖hut] [🧪][💖🧪lab] |
144
152
 
145
153
  ### Compatibility
146
154
 
147
- * Operating Systems: Linux, MacOS, Windows
148
- * MRI Ruby @ v2.3, v2.4, v2.5, v2.6, v2.7, v3.0, v3.1, v3.2, v3.3, v3.4, HEAD
149
- * NOTE: This gem may still _install_ and _run_ on ruby v2.2, but vanilla GitHub Actions no longer supports testing against it, so YMMV. Accept patches so long as they don't break the platforms that do run in CI.
150
- * JRuby @ v9.4, v10.0, HEAD
151
- * NOTE: This gem may still _install_ and _run_ on JRuby v9.2 and v9.3, but they are EOL, builds are flaky, and GitHub Actions [doesn't have][GHA-continue-on-error-ui] a proper [`allow-failures` feature][GHA-allow-failure], and until they do flaky EOL-platform builds get dropped, so YMMV. Accept patches so long as they don't break the platforms that do run in CI.
152
- * TruffleRuby @ v23.1, v24.1, HEAD
153
- * NOTE: This gem may still _install_ and _run_ on Truffleruby v22.3 and v23.0, but they are EOL, builds are flaky, and GitHub Actions [doesn't have][GHA-continue-on-error-ui] a proper [`allow-failures` feature][GHA-allow-failure], and until they do flaky EOL-platform builds get dropped, so YMMV. Accept patches so long as they don't break the platforms that do run in CI.
154
- * gem `faraday` @ v0, v1, v2, HEAD ⏩️ [lostisland/faraday](https://github.com/lostisland/faraday)
155
- * gem `jwt` @ v1, v2, v3, HEAD ⏩️ [jwt/ruby-jwt](https://github.com/jwt/ruby-jwt)
156
- * gem `logger` @ v1.2, v1.5, v1.7, HEAD ⏩️ [ruby/logger](https://github.com/ruby/logger)
157
- * gem `multi_xml` @ v0.5, v0.6, v0.7, HEAD ⏩️ [sferik/multi_xml](https://github.com/sferik/multi_xml)
158
- * gem `rack` @ v1.2, v1.6, v2, v3, HEAD ⏩️ [rack/rack](https://github.com/rack/rack)
159
- * gem `snaky_hash` @ v2, HEAD ⏩️ [ruby-oauth/snaky_hash](https://gitlab.com/ruby-oauth/snaky_hash)
160
- * gem `version_gem` @ v1, HEAD ⏩️ [ruby-oauth/version_gem](https://gitlab.com/ruby-oauth/version_gem)
161
-
162
- The last two were extracted from this gem. They are part of the `ruby-oauth` org,
163
- and are developed in tight collaboration with this gem.
164
-
165
- Also, where reasonable, tested against the runtime dependencies of those dependencies:
166
-
167
- * gem `hashie` @ v0, v1, v2, v3, v4, v5, HEAD ⏩️ [hashie/hashie](https://github.com/hashie/hashie)
168
-
169
- [GHA-continue-on-error-ui]: https://github.com/actions/runner/issues/2347#issuecomment-2653479732
170
- [GHA-allow-failure]: https://github.com/orgs/community/discussions/15452
171
-
172
- #### Upgrading Runtime Gem Dependencies
173
-
174
- This project sits underneath a large portion of the authorization systems on the internet.
175
- According to GitHub's project tracking, which I believe only reports on public projects,
176
- [100,000+ projects](https://github.com/ruby-oauth/oauth2/network/dependents), and
177
- [500+ packages](https://github.com/ruby-oauth/oauth2/network/dependents?dependent_type=PACKAGE) depend on this project.
178
-
179
- That means it is painful for the Ruby community when this gem forces updates to its runtime dependencies.
180
-
181
- As a result, great care, and a lot of time, have been invested to ensure this gem is working with all the
182
- leading versions per each minor version of Ruby of all the runtime dependencies it can install with.
183
-
184
- What does that mean specifically for the runtime dependencies?
185
-
186
- We have 100% test coverage of lines and branches, and this test suite runs across a very large matrix.
187
- It wouldn't be possible without appraisal2.
155
+ Compatible with MRI Ruby 2.2.0+, and concordant releases of JRuby, and TruffleRuby.
188
156
 
189
157
  | 🚚 _Amazing_ test matrix was brought to you by | 🔎 appraisal2 🔎 and the color 💚 green 💚 |
190
158
  |------------------------------------------------|--------------------------------------------------------|
191
159
  | 👟 Check it out! | ✨ [github.com/appraisal-rb/appraisal2][💎appraisal2] ✨ |
192
160
 
193
- #### You should upgrade this gem with confidence\*.
194
-
195
- - This gem follows a _strict & correct_ (according to the maintainer of SemVer; [more info][sv-pub-api]) interpretation of SemVer.
196
- - Dropping support for **any** of the runtime dependency versions above will be a major version bump.
197
- - If you aren't on one of the minor versions above, make getting there a priority.
198
- - You should upgrade the dependencies of this gem with confidence\*.
199
- - Please do upgrade, and then, when it goes smooth as butter [please sponsor me][🖇sponsor]. Thanks!
200
-
201
- [sv-pub-api]: #-versioning
202
-
203
- \* MIT license; The only guarantees I make are for [enterprise support](#enterprise-support).
204
-
205
- <details>
206
- <summary>Standard Library Dependencies</summary>
207
-
208
- The various versions of each are tested via the Ruby test matrix, along with whatever Ruby includes them.
209
-
210
- * base64
211
- * cgi
212
- * json
213
- * time
214
- * logger (removed from stdlib in Ruby 3.5 so added as runtime dependency in v2.0.10)
215
-
216
- If you use a gem version of a core Ruby library it should work fine!
217
-
218
- </details>
219
-
220
161
  ### Federated DVCS
221
162
 
222
- <details>
223
- <summary>Find this repo on other forges</summary>
163
+ <details markdown="1">
164
+ <summary>Find this repo on federated forges (Coming soon!)</summary>
224
165
 
225
- | Federated [DVCS][💎d-in-dvcs] Repository | Status | Issues | PRs | Wiki | CI | Discussions |
226
- |-----------------------------------------------|-----------------------------------------------------------------------|---------------------------|--------------------------|---------------------------|--------------------------|------------------------------|
227
- | 🧪 [ruby-oauth/oauth2 on GitLab][📜src-gl] | The Truth | [💚][🤝gl-issues] | [💚][🤝gl-pulls] | [💚][📜wiki] | 🏀 Tiny Matrix | ➖ |
228
- | 🧊 [ruby-oauth/oauth2 on CodeBerg][📜src-cb] | An Ethical Mirror ([Donate][🤝cb-donate]) | [💚][🤝cb-issues] | [💚][🤝cb-pulls] | ➖ | ⭕️ No Matrix | ➖ |
229
- | 🐙 [ruby-oauth/oauth2 on GitHub][📜src-gh] | Another Mirror | [💚][🤝gh-issues] | [💚][🤝gh-pulls] | ➖ | 💯 Full Matrix | [💚][gh-discussions] |
230
- | 🤼 [OAuth Ruby Google Group][⛳gg-discussions] | "Active" | ➖ | ➖ | ➖ | ➖ | [💚][⛳gg-discussions] |
231
- | 🎮️ [Discord Server][✉️discord-invite] | [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] | [Let's][✉️discord-invite] | [talk][✉️discord-invite] | [about][✉️discord-invite] | [this][✉️discord-invite] | [library!][✉️discord-invite] |
166
+ | Federated [DVCS][💎d-in-dvcs] Repository | Status | Issues | PRs | Wiki | CI | Discussions |
167
+ |-------------------------------------------------|-----------------------------------------------------------------------|---------------------------|--------------------------|---------------------------|--------------------------|------------------------------|
168
+ | 🧪 [ruby-oauth/oauth2 on GitLab][📜src-gl] | The Truth | [💚][🤝gl-issues] | [💚][🤝gl-pulls] | [💚][📜gl-wiki] | 🐭 Tiny Matrix | ➖ |
169
+ | 🧊 [ruby-oauth/oauth2 on CodeBerg][📜src-cb] | An Ethical Mirror ([Donate][🤝cb-donate]) | [💚][🤝cb-issues] | [💚][🤝cb-pulls] | ➖ | ⭕️ No Matrix | ➖ |
170
+ | 🐙 [ruby-oauth/oauth2 on GitHub][📜src-gh] | Another Mirror | [💚][🤝gh-issues] | [💚][🤝gh-pulls] | [💚][📜gh-wiki] | 💯 Full Matrix | [💚][gh-discussions] |
171
+ | 🎮️ [Discord Server][✉️discord-invite] | [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] | [Let's][✉️discord-invite] | [talk][✉️discord-invite] | [about][✉️discord-invite] | [this][✉️discord-invite] | [library!][✉️discord-invite] |
232
172
 
233
173
  </details>
234
174
 
@@ -238,7 +178,7 @@ If you use a gem version of a core Ruby library it should work fine!
238
178
 
239
179
  Available as part of the Tidelift Subscription.
240
180
 
241
- <details>
181
+ <details markdown="1">
242
182
  <summary>Need enterprise-level guarantees?</summary>
243
183
 
244
184
  The maintainers of this and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use.
@@ -257,143 +197,6 @@ Alternatively:
257
197
 
258
198
  </details>
259
199
 
260
- ## 🚀 Release Documentation
261
-
262
- ### Version 2.0.x
263
-
264
- <details>
265
- <summary>2.0.x CHANGELOG and README</summary>
266
-
267
- | Version | Release Date | CHANGELOG | README |
268
- |---------|--------------|---------------------------------------|---------------------------------|
269
- | 2.0.17 | 2025-09-15 | [v2.0.17 CHANGELOG][2.0.17-changelog] | [v2.0.17 README][2.0.17-readme] |
270
- | 2.0.16 | 2025-09-14 | [v2.0.16 CHANGELOG][2.0.16-changelog] | [v2.0.16 README][2.0.16-readme] |
271
- | 2.0.15 | 2025-09-08 | [v2.0.15 CHANGELOG][2.0.15-changelog] | [v2.0.15 README][2.0.15-readme] |
272
- | 2.0.14 | 2025-08-31 | [v2.0.14 CHANGELOG][2.0.14-changelog] | [v2.0.14 README][2.0.14-readme] |
273
- | 2.0.13 | 2025-08-30 | [v2.0.13 CHANGELOG][2.0.13-changelog] | [v2.0.13 README][2.0.13-readme] |
274
- | 2.0.12 | 2025-05-31 | [v2.0.12 CHANGELOG][2.0.12-changelog] | [v2.0.12 README][2.0.12-readme] |
275
- | 2.0.11 | 2025-05-23 | [v2.0.11 CHANGELOG][2.0.11-changelog] | [v2.0.11 README][2.0.11-readme] |
276
- | 2.0.10 | 2025-05-17 | [v2.0.10 CHANGELOG][2.0.10-changelog] | [v2.0.10 README][2.0.10-readme] |
277
- | 2.0.9 | 2022-09-16 | [v2.0.9 CHANGELOG][2.0.9-changelog] | [v2.0.9 README][2.0.9-readme] |
278
- | 2.0.8 | 2022-09-01 | [v2.0.8 CHANGELOG][2.0.8-changelog] | [v2.0.8 README][2.0.8-readme] |
279
- | 2.0.7 | 2022-08-22 | [v2.0.7 CHANGELOG][2.0.7-changelog] | [v2.0.7 README][2.0.7-readme] |
280
- | 2.0.6 | 2022-07-13 | [v2.0.6 CHANGELOG][2.0.6-changelog] | [v2.0.6 README][2.0.6-readme] |
281
- | 2.0.5 | 2022-07-07 | [v2.0.5 CHANGELOG][2.0.5-changelog] | [v2.0.5 README][2.0.5-readme] |
282
- | 2.0.4 | 2022-07-01 | [v2.0.4 CHANGELOG][2.0.4-changelog] | [v2.0.4 README][2.0.4-readme] |
283
- | 2.0.3 | 2022-06-28 | [v2.0.3 CHANGELOG][2.0.3-changelog] | [v2.0.3 README][2.0.3-readme] |
284
- | 2.0.2 | 2022-06-24 | [v2.0.2 CHANGELOG][2.0.2-changelog] | [v2.0.2 README][2.0.2-readme] |
285
- | 2.0.1 | 2022-06-22 | [v2.0.1 CHANGELOG][2.0.1-changelog] | [v2.0.1 README][2.0.1-readme] |
286
- | 2.0.0 | 2022-06-21 | [v2.0.0 CHANGELOG][2.0.0-changelog] | [v2.0.0 README][2.0.0-readme] |
287
-
288
- </details>
289
-
290
- [2.0.17-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2017---2025-09-15
291
- [2.0.16-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2016---2025-09-14
292
- [2.0.15-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2015---2025-09-08
293
- [2.0.14-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2014---2025-08-31
294
- [2.0.13-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2013---2025-08-30
295
- [2.0.12-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2012---2025-05-31
296
- [2.0.11-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2011---2025-05-23
297
- [2.0.10-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2010---2025-05-17
298
- [2.0.9-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#209---2022-09-16
299
- [2.0.8-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#208---2022-09-01
300
- [2.0.7-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#207---2022-08-22
301
- [2.0.6-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#206---2022-07-13
302
- [2.0.5-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#205---2022-07-07
303
- [2.0.4-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#204---2022-07-01
304
- [2.0.3-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#203---2022-06-28
305
- [2.0.2-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#202---2022-06-24
306
- [2.0.1-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#201---2022-06-22
307
- [2.0.0-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#200---2022-06-21
308
-
309
- [2.0.17-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.17/README.md
310
- [2.0.16-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.16/README.md
311
- [2.0.15-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.15/README.md
312
- [2.0.14-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.14/README.md
313
- [2.0.13-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.13/README.md
314
- [2.0.12-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.12/README.md
315
- [2.0.11-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.11/README.md
316
- [2.0.10-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.10/README.md
317
- [2.0.9-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.9/README.md
318
- [2.0.8-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.8/README.md
319
- [2.0.7-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.7/README.md
320
- [2.0.6-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.6/README.md
321
- [2.0.5-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.5/README.md
322
- [2.0.4-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.4/README.md
323
- [2.0.3-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.3/README.md
324
- [2.0.2-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.2/README.md
325
- [2.0.1-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.1/README.md
326
- [2.0.0-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.0/README.md
327
-
328
- ### Older Releases
329
-
330
- <details>
331
- <summary>1.4.x CHANGELOGs and READMEs</summary>
332
-
333
- | Version | Release Date | CHANGELOG | README |
334
- |---------|--------------|---------------------------------------|---------------------------------|
335
- | 1.4.11 | Sep 16, 2022 | [v1.4.11 CHANGELOG][1.4.11-changelog] | [v1.4.11 README][1.4.11-readme] |
336
- | 1.4.10 | Jul 1, 2022 | [v1.4.10 CHANGELOG][1.4.10-changelog] | [v1.4.10 README][1.4.10-readme] |
337
- | 1.4.9 | Feb 20, 2022 | [v1.4.9 CHANGELOG][1.4.9-changelog] | [v1.4.9 README][1.4.9-readme] |
338
- | 1.4.8 | Feb 18, 2022 | [v1.4.8 CHANGELOG][1.4.8-changelog] | [v1.4.8 README][1.4.8-readme] |
339
- | 1.4.7 | Mar 19, 2021 | [v1.4.7 CHANGELOG][1.4.7-changelog] | [v1.4.7 README][1.4.7-readme] |
340
- | 1.4.6 | Mar 19, 2021 | [v1.4.6 CHANGELOG][1.4.6-changelog] | [v1.4.6 README][1.4.6-readme] |
341
- | 1.4.5 | Mar 18, 2021 | [v1.4.5 CHANGELOG][1.4.5-changelog] | [v1.4.5 README][1.4.5-readme] |
342
- | 1.4.4 | Feb 12, 2020 | [v1.4.4 CHANGELOG][1.4.4-changelog] | [v1.4.4 README][1.4.4-readme] |
343
- | 1.4.3 | Jan 29, 2020 | [v1.4.3 CHANGELOG][1.4.3-changelog] | [v1.4.3 README][1.4.3-readme] |
344
- | 1.4.2 | Oct 1, 2019 | [v1.4.2 CHANGELOG][1.4.2-changelog] | [v1.4.2 README][1.4.2-readme] |
345
- | 1.4.1 | Oct 13, 2018 | [v1.4.1 CHANGELOG][1.4.1-changelog] | [v1.4.1 README][1.4.1-readme] |
346
- | 1.4.0 | Jun 9, 2017 | [v1.4.0 CHANGELOG][1.4.0-changelog] | [v1.4.0 README][1.4.0-readme] |
347
- </details>
348
-
349
- [1.4.11-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#1411---2022-09-16
350
- [1.4.10-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#1410---2022-07-01
351
- [1.4.9-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#149---2022-02-20
352
- [1.4.8-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#148---2022-02-18
353
- [1.4.7-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#147---2021-03-19
354
- [1.4.6-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#146---2021-03-19
355
- [1.4.5-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#145---2021-03-18
356
- [1.4.4-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#144---2020-02-12
357
- [1.4.3-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#143---2020-01-29
358
- [1.4.2-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#142---2019-10-01
359
- [1.4.1-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#141---2018-10-13
360
- [1.4.0-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#140---2017-06-09
361
-
362
- [1.4.11-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.11/README.md
363
- [1.4.10-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.10/README.md
364
- [1.4.9-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.9/README.md
365
- [1.4.8-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.8/README.md
366
- [1.4.7-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.7/README.md
367
- [1.4.6-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.6/README.md
368
- [1.4.5-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.5/README.md
369
- [1.4.4-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.4/README.md
370
- [1.4.3-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.3/README.md
371
- [1.4.2-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.2/README.md
372
- [1.4.1-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.1/README.md
373
- [1.4.0-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.0/README.md
374
-
375
- <details>
376
- <summary>1.3.x Readmes</summary>
377
-
378
- | Version | Release Date | Readme |
379
- |---------|--------------|--------------------------------------------------------------|
380
- | 1.3.1 | Mar 3, 2017 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.3.1/README.md |
381
- | 1.3.0 | Dec 27, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.3.0/README.md |
382
-
383
- </details>
384
-
385
- <details>
386
- <summary>&le;= 1.2.x Readmes (2016 and before)</summary>
387
-
388
- | Version | Release Date | Readme |
389
- |---------|--------------|--------------------------------------------------------------|
390
- | 1.2.0 | Jun 30, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.2.0/README.md |
391
- | 1.1.0 | Jan 30, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.1.0/README.md |
392
- | 1.0.0 | May 23, 2014 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.0.0/README.md |
393
- | < 1.0.0 | Find here | https://gitlab.com/ruby-oauth/oauth2/-/tags |
394
-
395
- </details>
396
-
397
200
  ## ✨ Installation
398
201
 
399
202
  Install the gem and add to the application's Gemfile by executing:
@@ -410,7 +213,7 @@ gem install oauth2
410
213
 
411
214
  ### 🔒 Secure Installation
412
215
 
413
- <details>
216
+ <details markdown="1">
414
217
  <summary>For Medium or High Security Installations</summary>
415
218
 
416
219
  This gem is cryptographically signed, and has verifiable [SHA-256 and SHA-512][💎SHA_checksums] checksums by
@@ -439,6 +242,8 @@ If you want to up your security game full-time:
439
242
  bundle config set --global trust-policy MediumSecurity
440
243
  ```
441
244
 
245
+ `MediumSecurity` instead of `HighSecurity` is necessary if not all the gems you use are signed.
246
+
442
247
  NOTE: Be prepared to track down certs for signed gems and add them the same way you added mine.
443
248
 
444
249
  </details>
@@ -476,7 +281,7 @@ Compatibility is further distinguished as "Best Effort Support" or "Incidental S
476
281
  This gem will install on Ruby versions >= v2.2 for 2.x releases.
477
282
  See `1-4-stable` branch for older rubies.
478
283
 
479
- <details>
284
+ <details markdown="1">
480
285
  <summary>Ruby Engine Compatibility Policy</summary>
481
286
 
482
287
  This gem is tested against MRI, JRuby, and Truffleruby.
@@ -484,15 +289,16 @@ Each of those has varying versions that target a specific version of MRI Ruby.
484
289
  This gem should work in the just-listed Ruby engines according to the targeted MRI compatibility in the table below.
485
290
  If you would like to add support for additional engines,
486
291
  see [gemfiles/README.md](gemfiles/README.md), then submit a PR to the correct maintenance branch as according to the table below.
292
+
487
293
  </details>
488
294
 
489
- <details>
295
+ <details markdown="1">
490
296
  <summary>Ruby Version Compatibility Policy</summary>
491
297
 
492
298
  If something doesn't work on one of these interpreters, it's a bug.
493
299
 
494
300
  This library may inadvertently work (or seem to work) on other Ruby
495
- implementations, however support will only be provided for the versions listed
301
+ implementations; however, support will only be provided for the versions listed
496
302
  above.
497
303
 
498
304
  If you would like this library to support another Ruby version, you may
@@ -501,6 +307,7 @@ run and pass on that implementation. When something breaks on your
501
307
  implementation, you will be responsible for providing patches in a timely
502
308
  fashion. If critical issues for a particular implementation exist at the time
503
309
  of a major release, support for that Ruby version may be dropped.
310
+
504
311
  </details>
505
312
 
506
313
  | | Ruby OAuth2 Version | Maintenance Branch | Targeted Support | Best Effort Support | Incidental Support |
@@ -510,37 +317,48 @@ of a major release, support for that Ruby version may be dropped.
510
317
  | 3️⃣ | older | N/A | Best of luck to you! | Please upgrade! | |
511
318
 
512
319
  NOTE: The 1.4 series will only receive critical security updates.
513
- See [SECURITY.md][🔐security].
320
+ See [SECURITY.md][🔐security] and [IRP.md][🔐irp].
514
321
 
515
322
  ## ⚙️ Configuration
516
323
 
517
- You can turn on additional warnings.
324
+ Global settings for the library:
518
325
 
519
326
  ```ruby
520
327
  OAuth2.configure do |config|
521
- # Turn on a warning like:
522
- # OAuth2::AccessToken.from_hash: `hash` contained more than one 'token' key
523
328
  config.silence_extra_tokens_warning = false # default: true
524
- # Set to true if you want to also show warnings about no tokens
525
- config.silence_no_tokens_warning = false # default: true,
329
+ config.silence_no_tokens_warning = false # default: true
526
330
  end
527
331
  ```
528
332
 
529
- The "extra tokens" problem comes from ambiguity in the spec about which token is the right token.
530
- Some OAuth 2.0 standards legitimately have multiple tokens.
531
- You may need to subclass `OAuth2::AccessToken`, or write your own custom alternative to it, and pass it in.
532
- Specify your custom class with the `access_token_class` option.
333
+ Filtering-related settings:
533
334
 
534
- If you only need one token you can, as of v2.0.10,
535
- specify the exact token name you want to extract via the `OAuth2::AccessToken` using
536
- the `token_name` option.
335
+ ```ruby
336
+ OAuth2.configure do |config|
337
+ config.filtered_label = "[REDACTED]" # default: "[FILTERED]"
338
+ config.filtered_debug_keys += ["client_assertion"]
339
+ end
340
+ ```
537
341
 
538
- You'll likely need to do some source diving.
539
- This gem has 100% test coverage for lines and branches, so the specs are a great place to look for ideas.
540
- If you have time and energy please contribute to the documentation!
342
+ - `filtered_label` controls the placeholder used when sensitive values are filtered from inspected objects and debug logging output.
343
+ - `filtered_debug_keys` controls which key names have their values redacted from debug logging output when `OAUTH_DEBUG=true`.
344
+ - Debug logging remains opt-in and should still be used cautiously in production environments.
541
345
 
542
346
  ## 🔧 Basic Usage
543
347
 
348
+ ### Client Initialization Options
349
+
350
+ `OAuth2::Client.new` accepts several options:
351
+
352
+ - `:site`: The base URL for the OAuth 2.0 provider.
353
+ - `:authorize_url`: The authorization endpoint (default: `"oauth/authorize"`).
354
+ - `:token_url`: The token endpoint (default: `"oauth/token"`).
355
+ - `:auth_scheme`: The authentication scheme (`:basic_auth`, `:request_body`, `:tls_client_auth`, `:private_key_jwt`). Default is `:basic_auth`.
356
+ - `:connection_opts`: Options for the underlying Faraday connection (timeouts, proxy, etc.).
357
+ - `:raise_errors`: Whether to raise `OAuth2::Error` on 400+ responses (default: `true`).
358
+
359
+ <details markdown="1">
360
+ <summary><em>authorize_url</em> and <em>token_url</em></summary>
361
+
544
362
  ### `authorize_url` and `token_url` are on site root (Just Works!)
545
363
 
546
364
  ```ruby
@@ -558,7 +376,7 @@ response.class.name
558
376
 
559
377
  ### Relative `authorize_url` and `token_url` (Not on site root, Just Works!)
560
378
 
561
- In above example, the default Authorization URL is `oauth/authorize` and default Access Token URL is `oauth/token`, and, as they are missing a leading `/`, both are relative.
379
+ In the above example, the default Authorization URL is `oauth/authorize` and default Access Token URL is `oauth/token`, and, as they are missing a leading `/`, both are relative.
562
380
 
563
381
  ```ruby
564
382
  client = OAuth2::Client.new("client_id", "client_secret", site: "https://example.org/nested/directory/on/your/server")
@@ -586,6 +404,25 @@ client.class.name
586
404
  # => OAuth2::Client
587
405
  ```
588
406
 
407
+ </details>
408
+
409
+ ### Advanced Initializers
410
+
411
+ ```ruby
412
+ client = OAuth2::Client.new(id, secret, site: site) do |faraday|
413
+ faraday.request(:url_encoded)
414
+ faraday.adapter(:net_http_persistent)
415
+ end
416
+ ```
417
+
418
+ ### AccessToken Features
419
+
420
+ Instances of `OAuth2::AccessToken` handle request signing and token expiration.
421
+
422
+ - **Snake Case & Indifferent Access**: `response.parsed` returns a `SnakyHash` allowing access via string/symbol and snake_case keys even if the provider returns CamelCase.
423
+ - **Auto-Refresh**: You can manually check `token.expired?` and call `token.refresh`.
424
+ - **Serialization**: Persist tokens using `token.to_hash` and restore via `OAuth2::AccessToken.from_hash(client, hash)`.
425
+
589
426
  ### snake_case and indifferent access in Response#parsed
590
427
 
591
428
  ```ruby
@@ -637,7 +474,11 @@ These extensions work regardless of whether you used the global or discrete conf
637
474
 
638
475
  There are a few hacks you may need in your class to support Ruby < 2.4.2 or < 2.6.
639
476
  They are likely not needed if you are on a newer Ruby.
640
- See [response_spec.rb](https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb) if you need to study the hacks for older Rubies.
477
+ Expand the examples below, or the [ruby-oauth/snaky_hash](https://gitlab.com/ruby-oauth/snaky_hash) gem,
478
+ or [response_spec.rb](https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb), for more ideas, especially if you need to study the hacks for older Rubies.
479
+
480
+ <details markdown="1">
481
+ <summary>See Examples</summary>
641
482
 
642
483
  ```ruby
643
484
  class MySnakyHash < SnakyHash::StringKeyed
@@ -693,7 +534,7 @@ class MySnakyHash < SnakyHash::StringKeyed
693
534
  end
694
535
  ```
695
536
 
696
- See [response_spec.rb](https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb), or the [ruby-oauth/snaky_hash](https://gitlab.com/ruby-oauth/snaky_hash) gem for more ideas.
537
+ </details>
697
538
 
698
539
  #### Prefer camelCase over snake_case? => snaky: false
699
540
 
@@ -706,7 +547,7 @@ response.parsed["additionalData"] # => "additional"
706
547
  response.parsed.class.name # => Hash (just, regular old Hash)
707
548
  ```
708
549
 
709
- <details>
550
+ <details markdown="1">
710
551
  <summary>Debugging & Logging</summary>
711
552
 
712
553
  Set an environment variable as per usual (e.g. with [dotenv](https://github.com/bkeepers/dotenv)).
@@ -719,6 +560,13 @@ ENV["OAUTH_DEBUG"] = "true"
719
560
  By default, debug output will go to `$stdout`. This can be overridden when
720
561
  initializing your OAuth2::Client.
721
562
 
563
+ Sensitive values are filtered from debug logging output using:
564
+
565
+ - `OAuth2.config[:filtered_label]`
566
+ - `OAuth2.config[:filtered_debug_keys]`
567
+
568
+ Debug logging remains opt-in and should still be used cautiously in production environments.
569
+
722
570
  ```ruby
723
571
  require "oauth2"
724
572
  client = OAuth2::Client.new(
@@ -728,17 +576,33 @@ client = OAuth2::Client.new(
728
576
  logger: Logger.new("example.log", "weekly"),
729
577
  )
730
578
  ```
579
+
731
580
  </details>
732
581
 
582
+ ### Request Target Trust Boundaries
583
+
584
+ This gem supports request flows that can involve absolute URLs in addition to relative paths.
585
+ That flexibility can expand trust boundaries when a token-bearing client is asked to send requests
586
+ to caller-provided targets.
587
+
588
+ Practical guidance:
589
+
590
+ - prefer relative paths where practical
591
+ - do not pass untrusted absolute URLs into token-bearing clients
592
+ - validate or allowlist request targets at the application layer today if your deployment has strict trust-boundary requirements
593
+
594
+ This release line does not yet enforce same-host or allowlist request policy automatically.
595
+ If stricter outbound request controls are needed, they should currently be implemented by the calling application.
596
+
733
597
  ### OAuth2::Response
734
598
 
735
599
  The `AccessToken` methods `#get`, `#post`, `#put` and `#delete` and the generic `#request`
736
- will return an instance of the #OAuth2::Response class.
600
+ will return an instance of the `OAuth2::Response` class.
737
601
 
738
602
  This instance contains a `#parsed` method that will parse the response body and
739
603
  return a Hash-like [`SnakyHash::StringKeyed`](https://gitlab.com/ruby-oauth/snaky_hash/-/blob/main/lib/snaky_hash/string_keyed.rb) if the `Content-Type` is `application/x-www-form-urlencoded` or if
740
- the body is a JSON object. It will return an Array if the body is a JSON
741
- array. Otherwise, it will return the original body string.
604
+ the body is a JSON object. It will return an Array if the body is a JSON
605
+ array. Otherwise, it will return the original body string.
742
606
 
743
607
  The original response body, headers, and status can be accessed via their
744
608
  respective methods.
@@ -751,16 +615,20 @@ a hash of the values), or `from_kvform` (if you have an
751
615
  `application/x-www-form-urlencoded` encoded string of the values).
752
616
 
753
617
  Options (since v2.0.x unless noted):
754
- - expires_latency (Integer | nil): Seconds to subtract from expires_in when computing #expired? to offset latency.
755
- - token_name (String | Symbol | nil): When multiple token-like fields exist in responses, select the field name to use as the access token (since v2.0.10).
756
- - mode (Symbol | Proc | Hash): Controls how the token is transmitted on requests made via this AccessToken instance.
757
- - :header — Send as Authorization: Bearer <token> header (default and preferred by OAuth 2.1 draft guidance).
758
- - :query — Send as access_token query parameter (discouraged in general, but required by some providers).
618
+
619
+ - `expires_latency` (Integer | nil): Seconds to subtract from expires_in when computing #expired? to offset latency.
620
+ - `token_name` (String | Symbol | nil): When multiple token-like fields exist in responses, select the field name to use as the access token (since v2.0.10).
621
+ - `mode` (Symbol | Proc | Hash): Controls how the token is transmitted on requests made via this AccessToken instance.
622
+ - `:header` — Send as Authorization: Bearer <token> header (default and preferred by OAuth 2.1 draft guidance).
623
+ - `:query` — Send as access_token query parameter (discouraged in general, but required by some providers).
759
624
  - Verb-dependent (since v2.0.15): Provide either:
760
- - a Proc taking |verb| and returning :header or :query, or
761
- - a Hash with verb symbols as keys, for example: {get: :query, post: :header, delete: :header}.
625
+ - a `Proc` taking `|verb|` and returning `:header` or `:query`, or
626
+ - a `Hash` with verb symbols as keys, for example `{get: :query, post: :header, delete: :header}`.
762
627
 
763
- Note: Verb-dependent mode was added in v2.0.15 to support providers like Instagram that require query mode for GET and header mode for POST/DELETE.
628
+ Note: Verb-dependent mode supports providers like Instagram that require query mode for `GET` and header mode for `POST`/`DELETE`
629
+
630
+ - Verb-dependent mode via `Proc` was added in v2.0.15
631
+ - Verb-dependent mode via `Hash` was added in v2.0.16
764
632
 
765
633
  ### OAuth2::Error
766
634
 
@@ -776,15 +644,23 @@ Response instance will contain the `OAuth2::Error` instance.
776
644
 
777
645
  ### Authorization Grants
778
646
 
779
- Note on OAuth 2.1 (draft):
780
- - PKCE is required for all OAuth clients using the authorization code flow (especially public clients). Implement PKCE in your app when required by your provider. See RFC 7636 and RFC 8252.
781
- - Redirect URIs must be compared using exact string matching by the Authorization Server.
782
- - The Implicit grant (response_type=token) and the Resource Owner Password Credentials grant are omitted from OAuth 2.1; they remain here for OAuth 2.0 compatibility but should be avoided for new apps.
783
- - Bearer tokens in the query string are omitted due to security risks; prefer Authorization header usage.
784
- - Refresh tokens for public clients must either be sender-constrained (e.g., DPoP/MTLS) or one-time use.
785
- - The definitions of public and confidential clients are simplified to refer only to whether the client has credentials.
647
+ Currently, the Authorization Code, Implicit, Resource Owner Password Credentials, Client Credentials, and Assertion
648
+ authentication grant types have helper strategy classes that simplify client
649
+ use. They are available via the [`#auth_code`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/auth_code.rb),
650
+ [`#implicit`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/implicit.rb),
651
+ [`#password`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/password.rb),
652
+ [`#client_credentials`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/client_credentials.rb), and
653
+ [`#assertion`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/assertion.rb) methods respectively.
654
+
655
+ #### OAuth 2.1 (draft) Note:
656
+
657
+ - **PKCE** is required for all OAuth clients using the authorization code flow (especially public clients). Implement PKCE in your app when required by your provider. See RFC 7636 and RFC 8252.
658
+ - **Implicit grant** (response_type=token) and **Resource Owner Password Credentials grant** are omitted from OAuth 2.1; they remain here for OAuth 2.0 compatibility but should be avoided for new apps.
659
+ - **Redirect URIs** must be compared using exact string matching by the Authorization Server.
660
+
661
+ <details markdown="1">
662
+ <summary>OAuth 2.1 (draft) References</summary>
786
663
 
787
- References:
788
664
  - OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13
789
665
  - Aaron Parecki: https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1
790
666
  - FusionAuth: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1
@@ -792,15 +668,10 @@ References:
792
668
  - Video: https://www.youtube.com/watch?v=g_aVPdwBTfw
793
669
  - Differences overview: https://fusionauth.io/learn/expert-advice/oauth/differences-between-oauth-2-oauth-2-1/
794
670
 
795
- Currently, the Authorization Code, Implicit, Resource Owner Password Credentials, Client Credentials, and Assertion
796
- authentication grant types have helper strategy classes that simplify client
797
- use. They are available via the [`#auth_code`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/auth_code.rb),
798
- [`#implicit`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/implicit.rb),
799
- [`#password`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/password.rb),
800
- [`#client_credentials`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/client_credentials.rb), and
801
- [`#assertion`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/assertion.rb) methods respectively.
671
+ </details>
802
672
 
803
673
  These aren't full examples, but demonstrative of the differences between usage for each strategy.
674
+
804
675
  ```ruby
805
676
  auth_url = client.auth_code.authorize_url(redirect_uri: "http://localhost:8080/oauth/callback")
806
677
  access = client.auth_code.get_token("code_value", redirect_uri: "http://localhost:8080/oauth/callback")
@@ -884,7 +755,7 @@ access = client.password.get_token("jdoe", "s3cret", scope: "read")
884
755
 
885
756
  #### Examples
886
757
 
887
- <details>
758
+ <details markdown="1">
888
759
  <summary>JHipster UAA (Spring Cloud) password grant example (legacy; avoid when possible)</summary>
889
760
 
890
761
  ```ruby
@@ -925,20 +796,30 @@ puts access.to_hash # full token response
925
796
  ```
926
797
 
927
798
  Notes:
799
+
928
800
  - Resource Owner Password Credentials (ROPC) is deprecated in OAuth 2.1 and discouraged. Prefer Authorization Code + PKCE.
929
801
  - If your deployment strictly demands the X-XSRF-TOKEN header, first fetch it from an endpoint that sets the XSRF-TOKEN cookie (often "/" or a login page) and pass it to headers.
930
802
  - For Basic auth, auth_scheme: :basic_auth handles the Authorization header; you do not need to base64-encode manually.
931
803
 
932
804
  </details>
933
805
 
934
- ### Instagram API (verb‑dependent token mode)
806
+ ### Verb‑dependent Token Mode
935
807
 
936
808
  Providers like Instagram require the access token to be sent differently depending on the HTTP verb:
809
+
937
810
  - GET requests: token must be in the query string (?access_token=...)
938
811
  - POST/DELETE requests: token must be in the Authorization header (Bearer ...)
939
812
 
940
813
  Since v2.0.15, you can configure an AccessToken with a verb‑dependent mode. The gem will choose how to send the token based on the request method.
941
814
 
815
+ Tips:
816
+
817
+ - Avoid query‑string bearer tokens unless required by your provider. Instagram explicitly requires it for `GET` requests.
818
+ - If you need a custom rule, you can pass a `Proc` for `mode`, e.g. `mode: ->(verb) { verb == :get ? :query : :header }`.
819
+
820
+ <details markdown="1">
821
+ <summary>Instagram API Example</summary>
822
+
942
823
  Example: exchanging and refreshing long‑lived Instagram tokens, and making API calls
943
824
 
944
825
  ```ruby
@@ -997,9 +878,7 @@ me = long_lived.get("/me", params: {fields: "id,username"}).parsed
997
878
  # long_lived.post("/me/media", body: {image_url: "https://...", caption: "hello"})
998
879
  ```
999
880
 
1000
- Tips:
1001
- - Avoid query‑string bearer tokens unless required by your provider. Instagram explicitly requires it for GET.
1002
- - If you need a custom rule, you can pass a Proc for mode, e.g. mode: ->(verb) { verb == :get ? :query : :header }.
881
+ </details>
1003
882
 
1004
883
  ### Refresh Tokens
1005
884
 
@@ -1104,16 +983,17 @@ resp = access.get("/v1/protected")
1104
983
  ```
1105
984
 
1106
985
  Notes:
1107
- - Files must contain the appropriate PEMs. The private key may be encrypted; if so, pass a password to OpenSSL::PKey::RSA.new(File.read(path), ENV["KEY_PASSWORD"]).
986
+
987
+ - Files must contain the appropriate PEMs. The private key may be encrypted; if so, pass a password to `OpenSSL::PKey::RSA.new(File.read(path), ENV["KEY_PASSWORD"])`.
1108
988
  - If your certificate and key are in a PKCS#12/PFX bundle, you can load them like:
1109
- - p12 = OpenSSL::PKCS12.new(File.read("client.p12"), ENV["P12_PASSWORD"])
1110
- - client_cert = p12.certificate; client_key = p12.key
989
+ - `p12 = OpenSSL::PKCS12.new(File.read("client.p12"), ENV["P12_PASSWORD"])`
990
+ - `client_cert = p12.certificate; client_key = p12.key`
1111
991
  - Server trust:
1112
- - If your environment does not have system CAs, specify ca_file or ca_path inside the ssl: hash.
1113
- - Keep verify: true in production. Set verify: false only for local testing.
1114
- - Faraday adapter: Any adapter that supports Ruby’s OpenSSL should work. net_http (default) and net_http_persistent are common choices.
992
+ - If your environment does not have system CAs, specify `ca_file` or `ca_path` inside the `ssl:` hash.
993
+ - Keep `verify: true` in production. Set `verify: false` only for local testing.
994
+ - Faraday adapter: Any adapter that supports Ruby’s OpenSSL should work. `net_http` (default) and `net_http_persistent` are common choices.
1115
995
  - Scope of mTLS: The SSL client cert is applied to any HTTPS request made by this client (token and resource requests) to the configured site base URL (and absolute URLs you call with the same client).
1116
- - OIDC tie-in: Some OPs require tls_client_auth at the token endpoint per OIDC/OAuth specifications. That is enabled via auth_scheme: :tls_client_auth as shown above.
996
+ - OIDC tie-in: Some OPs require tls_client_auth at the token endpoint per OIDC/OAuth specifications. That is enabled via `auth_scheme: :tls_client_auth` as shown above.
1117
997
 
1118
998
  #### Authentication schemes for the token request
1119
999
 
@@ -1145,9 +1025,9 @@ client = OAuth2::Client.new(
1145
1025
  end
1146
1026
  ```
1147
1027
 
1148
- ##### Using flat query params (Faraday::FlatParamsEncoder)
1028
+ ##### Using flat query params (`Faraday::FlatParamsEncoder`)
1149
1029
 
1150
- Some APIs expect repeated key parameters to be sent as flat params rather than arrays. Faraday provides FlatParamsEncoder for this purpose. You can configure the oauth2 client to use it when building requests.
1030
+ Some APIs expect repeated key parameters to be sent as flat params rather than arrays. Faraday provides `FlatParamsEncoder` for this purpose. You can configure the oauth2 client to use it when building requests.
1151
1031
 
1152
1032
  ```ruby
1153
1033
  require "faraday"
@@ -1239,11 +1119,12 @@ access = client.get_token({
1239
1119
  })
1240
1120
  ```
1241
1121
 
1242
- ### OpenID Connect (OIDC) Notes
1122
+ ### OpenID Connect (OIDC)
1243
1123
 
1244
- - If the token response includes an `id_token` (a JWT), this gem surfaces it but does not validate the signature. Use a JWT library and your provider's JWKs to verify it.
1245
- - For private_key_jwt client authentication, provide `auth_scheme: :private_key_jwt` and ensure your key configuration matches the provider requirements.
1246
- - See [OIDC.md](OIDC.md) for a more complete OIDC overview, example, and links to the relevant specifications.
1124
+ - If the token response includes an `id_token` (a JWT), this gem surfaces it in `token.params['id_token']`.
1125
+ - **Note**: This gem does **not** validate the signature of the `id_token`. You must use a JWT library (like the `jwt` [gem](https://github.com/jwt/ruby-jwt)) and your provider's JWKs to verify it.
1126
+ - For `private_key_jwt` client authentication, provide `auth_scheme: :private_key_jwt` and ensure your key configuration matches the provider requirements.
1127
+ - See [OIDC.md](OIDC.md) for a more complete OIDC overview and examples.
1247
1128
 
1248
1129
  ### Debugging
1249
1130
 
@@ -1277,26 +1158,33 @@ and [Tidelift][🏙️entsup-tidelift].
1277
1158
 
1278
1159
  ### Open Collective for Individuals
1279
1160
 
1161
+ Support us with a monthly donation and help us continue our activities. [[Become a backer](https://opencollective.com/ruby-oauth#backer)]
1162
+
1163
+ NOTE: [kettle-readme-backers][kettle-readme-backers] updates this list every day, automatically.
1164
+
1280
1165
  <!-- OPENCOLLECTIVE-INDIVIDUALS:START -->
1281
1166
  No backers yet. Be the first!
1282
1167
  <!-- OPENCOLLECTIVE-INDIVIDUALS:END -->
1283
1168
 
1284
- Support us with a monthly donation and help us continue our activities. [[Become a backer](https://opencollective.com/ruby-oauth#backer)]
1285
-
1286
1169
  ### Open Collective for Organizations
1287
1170
 
1171
+ Become a sponsor and get your logo on our README on GitHub with a link to your site. [[Become a sponsor](https://opencollective.com/ruby-oauth#sponsor)]
1172
+
1173
+ NOTE: [kettle-readme-backers][kettle-readme-backers] updates this list every day, automatically.
1174
+
1288
1175
  <!-- OPENCOLLECTIVE-ORGANIZATIONS:START -->
1289
1176
  No sponsors yet. Be the first!
1177
+
1178
+ ### Open Collective for Donors
1179
+
1180
+ [Bill Woika](https://opencollective.com/bill-woika)
1290
1181
  <!-- OPENCOLLECTIVE-ORGANIZATIONS:END -->
1291
1182
 
1292
- Become a sponsor and get your logo on our README on GitHub with a link to your site. [[Become a sponsor](https://opencollective.com/ruby-oauth#sponsor)]
1183
+ [kettle-readme-backers]: https://github.com/ruby-oauth/oauth2/blob/main/exe/kettle-readme-backers
1293
1184
 
1294
1185
  ### Another way to support open-source
1295
1186
 
1296
- > How wonderful it is that nobody need wait a single moment before starting to improve the world.<br/>
1297
- >—Anne Frank
1298
-
1299
- I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small. Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions — totaling 79 hours of FLOSS coding over just the past seven days, a pretty regular week for me. I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).
1187
+ I’m driven by a passion to foster a thriving open-source community – a space where people can tackle complex problems, no matter how small. Revitalizing libraries that have fallen into disrepair, and building new libraries focused on solving real-world challenges, are my passions. I was recently affected by layoffs, and the tech jobs market is unwelcoming. I’m reaching out here because your support would significantly aid my efforts to provide for my family, and my farm (11 🐔 chickens, 2 🐶 dogs, 3 🐰 rabbits, 8 🐈‍ cats).
1300
1188
 
1301
1189
  If you work at a company that uses my work, please encourage them to support me as a corporate sponsor. My work on gems you use might show up in `bundle fund`.
1302
1190
 
@@ -1304,14 +1192,14 @@ I’m developing a new library, [floss_funding][🖇floss-funding-gem], designed
1304
1192
 
1305
1193
  **[Floss-Funding.dev][🖇floss-funding.dev]: 👉️ No network calls. 👉️ No tracking. 👉️ No oversight. 👉️ Minimal crypto hashing. 💡 Easily disabled nags**
1306
1194
 
1307
- [![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate to my FLOSS or refugee efforts at ko-fi.com][🖇kofi-img]][🖇kofi] [![Donate to my FLOSS or refugee efforts using Patreon][🖇patreon-img]][🖇patreon]
1195
+ [![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate on Polar][🖇polar-img]][🖇polar] [![Donate to my FLOSS efforts at ko-fi.com][🖇kofi-img]][🖇kofi] [![Donate to my FLOSS efforts using Patreon][🖇patreon-img]][🖇patreon]
1308
1196
 
1309
1197
  ## 🔐 Security
1310
1198
 
1311
1199
  To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security).
1312
1200
  Tidelift will coordinate the fix and disclosure.
1313
1201
 
1314
- For more see [SECURITY.md][🔐security].
1202
+ For more see [SECURITY.md][🔐security], [THREAT_MODEL.md][🔐threat-model], and [IRP.md][🔐irp].
1315
1203
 
1316
1204
  ## 🤝 Contributing
1317
1205
 
@@ -1329,11 +1217,11 @@ See [CONTRIBUTING.md][🤝contributing].
1329
1217
 
1330
1218
  ### Code Coverage
1331
1219
 
1332
- [![Coverage Graph][🔑codecov-g]][🔑codecov]
1220
+ [![Coverage Graph][🏀codecov-g]][🏀codecov]
1333
1221
 
1334
- [![Coveralls Test Coverage][🔑coveralls-img]][🔑coveralls]
1222
+ [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls]
1335
1223
 
1336
- [![QLTY Test Coverage][🔑qlty-covi]][🔑qlty-cov]
1224
+ [![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov]
1337
1225
 
1338
1226
  ### 🪇 Code of Conduct
1339
1227
 
@@ -1383,12 +1271,11 @@ For example:
1383
1271
  spec.add_dependency("oauth2", "~> 2.0")
1384
1272
  ```
1385
1273
 
1386
- <details>
1274
+ <details markdown="1">
1387
1275
  <summary>📌 Is "Platform Support" part of the public API? More details inside.</summary>
1388
1276
 
1389
1277
  SemVer should, IMO, but doesn't explicitly, say that dropping support for specific Platforms
1390
- is a *breaking change* to an API.
1391
- It is obvious to many, but not all, and since the spec is silent, the bike shedding is endless.
1278
+ is a *breaking change* to an API, and for that reason the bike shedding is endless.
1392
1279
 
1393
1280
  To get a better understanding of how SemVer is intended to work over a project's lifetime,
1394
1281
  read this article from the creator of SemVer:
@@ -1409,7 +1296,7 @@ See [LICENSE.txt][📄license] for the official [Copyright Notice][📄copyright
1409
1296
 
1410
1297
  <ul>
1411
1298
  <li>
1412
- Copyright (c) 2017–2025 Peter H. Boling, of
1299
+ Copyright (c) 2017 – 2026 Peter H. Boling, of
1413
1300
  <a href="https://discord.gg/3qme4XHNKN">
1414
1301
  Galtzo.com
1415
1302
  <picture>
@@ -1418,15 +1305,15 @@ See [LICENSE.txt][📄license] for the official [Copyright Notice][📄copyright
1418
1305
  </a>, and oauth2 contributors.
1419
1306
  </li>
1420
1307
  <li>
1421
- Copyright (c) 2011-2013 Michael Bleigh and Intridea, Inc.
1308
+ Copyright (c) 2011 - 2013 Michael Bleigh and Intridea, Inc.
1422
1309
  </li>
1423
1310
  </ul>
1424
1311
 
1425
1312
  ## 🤑 A request for help
1426
1313
 
1427
1314
  Maintainers have teeth and need to pay their dentists.
1428
- After getting laid off in an RIF in March and filled with many dozens of rejections,
1429
- I'm now spending ~60+ hours a week building open source tools.
1315
+ After getting laid off in an RIF in March, and encountering difficulty finding a new one,
1316
+ I began spending most of my time building open source tools.
1430
1317
  I'm hoping to be able to pay for my kids' health insurance this month,
1431
1318
  so if you value the work I am doing, I need your support.
1432
1319
  Please consider sponsoring me or the project.
@@ -1437,7 +1324,7 @@ To join the community or get help 👇️ Join the Discord.
1437
1324
 
1438
1325
  To say "thanks!" ☝️ Join the Discord or 👇️ send money.
1439
1326
 
1440
- [![Sponsor ruby-oauth/oauth2 on Open Source Collective][🖇osc-all-bottom-img]][🖇osc] 💌 [![Sponsor me on GitHub Sponsors][🖇sponsor-bottom-img]][🖇sponsor] 💌 [![Sponsor me on Liberapay][⛳liberapay-bottom-img]][⛳liberapay-img] 💌 [![Donate on PayPal][🖇paypal-bottom-img]][🖇paypal-img]
1327
+ [![Sponsor ruby-oauth/oauth2 on Open Source Collective][🖇osc-all-bottom-img]][🖇osc] 💌 [![Sponsor me on GitHub Sponsors][🖇sponsor-bottom-img]][🖇sponsor] 💌 [![Sponsor me on Liberapay][⛳liberapay-bottom-img]][⛳liberapay] 💌 [![Donate on PayPal][🖇paypal-bottom-img]][🖇paypal]
1441
1328
 
1442
1329
  ### Please give the project a star ⭐ ♥.
1443
1330
 
@@ -1485,7 +1372,7 @@ Thanks for RTFM. ☺️
1485
1372
  [✇bundle-group-pattern]: https://gist.github.com/pboling/4564780
1486
1373
  [⛳️gem-namespace]: https://github.com/ruby-oauth/oauth2
1487
1374
  [⛳️namespace-img]: https://img.shields.io/badge/namespace-OAuth2-3C2D2D.svg?style=square&logo=ruby&logoColor=white
1488
- [⛳️gem-name]: https://rubygems.org/gems/oauth2
1375
+ [⛳️gem-name]: https://bestgems.org/gems/oauth2
1489
1376
  [⛳️name-img]: https://img.shields.io/badge/name-oauth2-3C2D2D.svg?style=square&logo=rubygems&logoColor=red
1490
1377
  [⛳️tag-img]: https://img.shields.io/github/tag/ruby-oauth/oauth2.svg
1491
1378
  [⛳️tag]: http://github.com/ruby-oauth/oauth2/releases
@@ -1530,22 +1417,22 @@ Thanks for RTFM. ☺️
1530
1417
  [📜src-gh]: https://github.com/ruby-oauth/oauth2
1531
1418
  [📜docs-cr-rd-img]: https://img.shields.io/badge/RubyDoc-Current_Release-943CD2?style=for-the-badge&logo=readthedocs&logoColor=white
1532
1419
  [📜docs-head-rd-img]: https://img.shields.io/badge/YARD_on_Galtzo.com-HEAD-943CD2?style=for-the-badge&logo=readthedocs&logoColor=white
1533
- [📜wiki]: https://gitlab.com/ruby-oauth/oauth2/-/wikis/home
1534
- [📜wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&logo=Wiki&logoColor=white
1535
- [👽dl-rank]: https://rubygems.org/gems/oauth2
1420
+ [📜gl-wiki]: https://gitlab.com/ruby-oauth/oauth2/-/wikis/home
1421
+ [📜gh-wiki]: https://github.com/ruby-oauth/oauth2/wiki
1422
+ [📜gl-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&logo=gitlab&logoColor=white
1423
+ [📜gh-wiki-img]: https://img.shields.io/badge/wiki-examples-943CD2.svg?style=for-the-badge&logo=github&logoColor=white
1424
+ [👽dl-rank]: https://bestgems.org/gems/oauth2
1536
1425
  [👽dl-ranki]: https://img.shields.io/gem/rd/oauth2.svg
1537
- [👽oss-help]: https://www.codetriage.com/ruby-oauth/oauth2
1538
- [👽oss-helpi]: https://www.codetriage.com/ruby-oauth/oauth2/badges/users.svg
1539
- [👽version]: https://rubygems.org/gems/oauth2
1426
+ [👽version]: https://bestgems.org/gems/oauth2
1540
1427
  [👽versioni]: https://img.shields.io/gem/v/oauth2.svg
1541
- [🔑qlty-mnt]: https://qlty.sh/gh/ruby-oauth/projects/oauth2
1542
- [🔑qlty-mnti]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/maintainability.svg
1543
- [🔑qlty-cov]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/metrics/code?sort=coverageRating
1544
- [🔑qlty-covi]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/coverage.svg
1545
- [🔑codecov]: https://codecov.io/gh/ruby-oauth/oauth2
1546
- [🔑codecovi]: https://codecov.io/gh/ruby-oauth/oauth2/graph/badge.svg
1547
- [🔑coveralls]: https://coveralls.io/github/ruby-oauth/oauth2?branch=main
1548
- [🔑coveralls-img]: https://coveralls.io/repos/github/ruby-oauth/oauth2/badge.svg?branch=main
1428
+ [🏀qlty-mnt]: https://qlty.sh/gh/ruby-oauth/projects/oauth2
1429
+ [🏀qlty-mnti]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/maintainability.svg
1430
+ [🏀qlty-cov]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/metrics/code?sort=coverageRating
1431
+ [🏀qlty-covi]: https://qlty.sh/gh/ruby-oauth/projects/oauth2/coverage.svg
1432
+ [🏀codecov]: https://codecov.io/gh/ruby-oauth/oauth2
1433
+ [🏀codecovi]: https://codecov.io/gh/ruby-oauth/oauth2/graph/badge.svg
1434
+ [🏀coveralls]: https://coveralls.io/github/ruby-oauth/oauth2?branch=main
1435
+ [🏀coveralls-img]: https://coveralls.io/repos/github/ruby-oauth/oauth2/badge.svg?branch=main
1549
1436
  [🖐codeQL]: https://github.com/ruby-oauth/oauth2/security/code-scanning
1550
1437
  [🖐codeQL-img]: https://github.com/ruby-oauth/oauth2/actions/workflows/codeql-analysis.yml/badge.svg
1551
1438
  [🚎1-an-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/ancient.yml
@@ -1564,8 +1451,6 @@ Thanks for RTFM. ☺️
1564
1451
  [🚎7-us-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/unsupported.yml/badge.svg
1565
1452
  [🚎8-ho-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/hoary.yml
1566
1453
  [🚎8-ho-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/hoary.yml/badge.svg
1567
- [🚎9-t-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/truffle.yml
1568
- [🚎9-t-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/truffle.yml/badge.svg
1569
1454
  [🚎10-j-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml
1570
1455
  [🚎10-j-wfi]: https://github.com/ruby-oauth/oauth2/actions/workflows/jruby.yml/badge.svg
1571
1456
  [🚎11-c-wf]: https://github.com/ruby-oauth/oauth2/actions/workflows/current.yml
@@ -1594,7 +1479,7 @@ Thanks for RTFM. ☺️
1594
1479
  [💎ruby-headi]: https://img.shields.io/badge/Ruby-HEAD-CC342D?style=for-the-badge&logo=ruby&logoColor=blue
1595
1480
  [💎truby-22.3i]: https://img.shields.io/badge/Truffle_Ruby-22.3_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=pink
1596
1481
  [💎truby-23.0i]: https://img.shields.io/badge/Truffle_Ruby-23.0_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=pink
1597
- [💎truby-23.1i]: https://img.shields.io/badge/Truffle_Ruby-23.1-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
1482
+ [💎truby-23.1i]: https://img.shields.io/badge/Truffle_Ruby-23.1_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=pink
1598
1483
  [💎truby-c-i]: https://img.shields.io/badge/Truffle_Ruby-current-34BCB1?style=for-the-badge&logo=ruby&logoColor=green
1599
1484
  [💎truby-headi]: https://img.shields.io/badge/Truffle_Ruby-HEAD-34BCB1?style=for-the-badge&logo=ruby&logoColor=blue
1600
1485
  [💎jruby-9.1i]: https://img.shields.io/badge/JRuby-9.1_(%F0%9F%9A%ABCI)-AABBCC?style=for-the-badge&logo=ruby&logoColor=red
@@ -1611,7 +1496,7 @@ Thanks for RTFM. ☺️
1611
1496
  [🤝cb-pulls]: https://codeberg.org/ruby-oauth/oauth2/pulls
1612
1497
  [🤝cb-donate]: https://donate.codeberg.org/
1613
1498
  [🤝contributing]: CONTRIBUTING.md
1614
- [🔑codecov-g]: https://codecov.io/gh/ruby-oauth/oauth2/graphs/tree.svg
1499
+ [🏀codecov-g]: https://codecov.io/gh/ruby-oauth/oauth2/graphs/tree.svg
1615
1500
  [🖐contrib-rocks]: https://contrib.rocks
1616
1501
  [🖐contributors]: https://github.com/ruby-oauth/oauth2/graphs/contributors
1617
1502
  [🖐contributors-img]: https://contrib.rocks/image?repo=ruby-oauth/oauth2
@@ -1626,12 +1511,16 @@ Thanks for RTFM. ☺️
1626
1511
  [📌changelog]: CHANGELOG.md
1627
1512
  [📗keep-changelog]: https://keepachangelog.com/en/1.0.0/
1628
1513
  [📗keep-changelog-img]: https://img.shields.io/badge/keep--a--changelog-1.0.0-34495e.svg?style=flat
1629
- [📌gitmoji]:https://gitmoji.dev
1630
- [📌gitmoji-img]:https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
1514
+ [📌gitmoji]: https://gitmoji.dev
1515
+ [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
1631
1516
  [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
1632
- [🧮kloc-img]: https://img.shields.io/badge/KLOC-0.526-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
1517
+ [🧮kloc-img]: https://img.shields.io/badge/KLOC-0.515-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
1633
1518
  [🔐security]: SECURITY.md
1634
1519
  [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
1520
+ [🔐irp]: IRP.md
1521
+ [🔐irp-img]: https://img.shields.io/badge/IRP-259D6C.svg?style=flat
1522
+ [🔐threat-model]: THREAT_MODEL.md
1523
+ [🔐threat-model-img]: https://img.shields.io/badge/threat-model-259D6C.svg?style=flat
1635
1524
  [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year
1636
1525
  [📄license]: LICENSE.txt
1637
1526
  [📄license-ref]: https://opensource.org/licenses/MIT
@@ -1659,12 +1548,3 @@ Thanks for RTFM. ☺️
1659
1548
  <a rel="me" alt="Follow me on FLOSS.social" href="https://floss.social/@galtzo"><img src="https://img.shields.io/mastodon/follow/110304921404405715?domain=https://floss.social&style=social&label=Follow%20@galtzo%20on%20Floss.social"></a>
1660
1549
 
1661
1550
  </details>
1662
-
1663
-
1664
- <details>
1665
- <summary>Broken badges</summary>
1666
-
1667
- [![Coverage Graph][🔑codecov-g]][🔑codecov]
1668
- [![CodeCov Test Coverage][🔑codecovi]][🔑codecov]
1669
-
1670
- </details>