rodauth-oauth 1.6.5 → 1.6.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc6a614c797762b13c8b97dc51abf5191dc09ef919e27fd394f46504b62410c7
-  data.tar.gz: 3c6003d4131e03514a5bf8acd674cc1b7d8fcacd9eada7ab98044fc3f037fc95
+  metadata.gz: 47de1ced2a621692058d69609ccb69999440ac8ca3de7f7a43f8522a81b93a20
+  data.tar.gz: 4822470b6f682648a772b8d7244000a68557875ee12ebd2126033f58128d9241
 SHA512:
-  metadata.gz: 997c1e682fc4f482d0ea367a918c4db15130535294db13f19c52c558f152eca78fd197461d74ce269e77a56b36cf465b8b7e9d2424f3b999cb6491782c8d69f6
-  data.tar.gz: 2109d08b8911e33697e08e528899d45535de16c1cc994d663324c51161fed1f6e35386849413adb6dadbb526b2b75c64522865cbdf90798042ca8e68767362cf
+  metadata.gz: 29604d9791ebdab3ea7a85a8ad05cc1ff32aaf8b73aad85b367be9cdd2ab5f199540d25b179147ef5346da7d709fcbf470aac05db6b903d80c483ce47214d399
+  data.tar.gz: 7d853b0d1a139fe2d10ec2d865493c8bdf9db313df79e4778e44943900f5634eabb03ac851a65f4f0bc31708014b037116ac46bf150b9fed8bee93fab5f9909c

data/README.md

@@ -183,7 +183,15 @@ If you're starting from scratch though, the recommendation is to stick to the de
 
 You'll have to generate HTML templates for the Oauth Authorization form.
 
-The rodauth default setup expects the roda `render` plugin to be activated; by default, it expects a `views` directory to be defined in the project root folder. The Oauth Authorization template must be therefore defined there, and it should be called `oauth_authorize.(erb|str|...)` (read the [roda `render` plugin documentation](http://roda.jeremyevans.net/rdoc/classes/Roda/RodaPlugins/Render.html) for more info about HTML templating).
+The rodauth default setup expects the roda `render` plugin to be activated; by default, it expects a `views` directory to be defined in the project root folder. The Oauth Authorization template must be therefore defined there, and it should be called `authorize.(erb|str|...)` (read the [roda `render` plugin documentation](http://roda.jeremyevans.net/rdoc/classes/Roda/RodaPlugins/Render.html) for more info about HTML templating).
+
+Start it from [the bundled template](templates/authorize.str), which is written for the `str` engine, rather than from a blank file:
+
+```
+cp "$(bundle info rodauth-oauth --path)/templates/authorize.str" views/authorize.str
+```
+
+The form posts back to the authorize endpoint, so every authorization request parameter the grant depends on has to be carried over into it. A parameter left out is dropped from the grant silently, and only surfaces later as an error at the token endpoint, which is why adapting the bundled template beats writing one from scratch. See [the authorize form docs](doc/oauth_authorize_base.rdoc) for the parts which are easiest to lose.
 
 ### OAuth applications management
 

data/doc/release_notes/1_6_6.md

@@ -0,0 +1,25 @@
+### 1.6.6
+
+#### Improvements
+
+* Authorization form params will now be exposed to the HTML rendering via the `rodauth.authorize_form_params`; this not only reduces the size of the bundled forms, but also makes it much easier to add or remove features with their own required authorize params.
+* `:oauth_jwt_base` feature: new `:oauth_jwt_iat_leeway` option (defaults to 30, as in seconds), is used now to make the JWT claim `iat` claim tolerant to clock skew. This option is used in both the `jwt` and `json/jwt` gem integrations.
+* `:oauth_pkce` feature: new `:oauth_pkce_allow_plain_method` option, which may disallow the usage of `"plain"` as a PKCE challenge method
+  * defaults to `true` in order not to break backwards compatibility, but this is going to change in a future version, so you are recommended to set it explicitly in order not to break your application in a future upgrade.
+
+#### Bugfixes
+
+* (critical) `:oauth_dynamic_client_registration` feature: `PUT /register` was incorrectly authenticating the request (responding with 200 when secret didn't match), thereby allowing anyone (else) to update application parameters.
+* (critical) `:oauth_dynamic_client_registration` feature: `PUT /register` was not hashing the client secret when hashing on the client secret was enforced.
+* `:oauth_authorization_code_grant` feature: escape untrusted values in the authorize form (hidden request params, the `"state"` in the cancel link, the client application name), in the authorize form post  POST response form, and in the device verification template.
+* token endpoint: enforce 4XX HTTP responses with JSON encoded body when there are errors (instead of making it rely on the "accept" HTTP header).
+* client authentication: fallback to `oauth_default_token_endpoint_auth_methods` when the application being authentication has no `token_endpoint_auth_method` set (instead of assuming it as "none").
+* `:oauth_dynamic_client_registration` feature: client metadata which the server does not understand is now ignored (RFC 7591 section 3.1), instead of failing the registration with an `"invalid_client_metadata"` error.
+* `:oauth_dynamic_client_registration` feature: fix typo which was exposing `client_secret` in the registration response in cases where it shouldn't.
+* `:oauth_dynamic_client_registration` feature: emit `"client_id_issued_at"` as epoch seconds instead of an ISO8601 string, as per [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.1).
+* `:oauth_dynamic_client_registration` feature: remove "registration_access_token" and "registration_client_uri" parameters from the payload (these are only valid for the OIDC counterpart).
+* `json/jwt`: decoding a JWT was bypassing claims verification.
+
+#### Security
+
+* Using `rodauth` `timing_safe_eql?` helper method, a string comparison function which is safe against timing attacks, in client secret matching and PKCE verification.

data/doc/release_notes/1_6_7.md

@@ -0,0 +1,17 @@
+### 1.6.7
+
+#### Improvements
+
+* Some new capabilities were built into `rodauth` recently, which `rodauth-oauth` now taps into:
+  * plugins are now object shape friendly, by defining ivars using `rodauth`'s `:uses_instance_variables` auth method (introduced in v2.44)
+  * `:oidc` plugin `get_oidc_param` and `get_additional_param` now have a default implementation, which raises an error (eliminates warnings).
+  * `only_json?` auth method is no longer defined (unless the `:jwt` plugin is used).
+  * some internal methods were now moved to private, instead of being needlessly exposed (eliminates security warnings).
+* a new auth method, `confidential?(oauth_application)`, was added to the `:oauth_base` plugin, which is now used internally to check in some key flows whether the OAuth client application is a public or a confidential client, as it's defined in the OAuth RFC:
+  * when using the `:oauth_dynamic_client_registration` plugin, a client secret won't be generated for public clients (same logic will be applied for client registration management endpoints).
+  * when using the `:oauth_application_management` plugin, default templates will include a client type column, and omit the client secret for public clients, where they would previously.
+
+#### Bugfixes
+
+* do not render null fields in the payload of the oauth server metadata endpoint (RFC 8414 section 2 requires omission of undefined values, so clients can apply the recommended defaults).
+* fixed regexp used for json requests (same fix as in [rodauth](https://github.com/jeremyevans/rodauth/commit/3e0d7ab2d49a5733d1afcaaf1062b8a8258aa57a))

data/lib/generators/rodauth/oauth/templates/app/views/rodauth/authorize.html.erb

@@ -3,7 +3,7 @@
     <%= image_tag rodauth.oauth_application[rodauth.oauth_applications_logo_uri_column] %>
   <% end %>
   <% application_uri = rodauth.oauth_application[rodauth.oauth_applications_homepage_url_column] %>
-  <% application_name = application_uri ? link_to(rodauth.oauth_application[rodauth.oauth_applications_name_column], application_uri) : rodauth.oauth_application[rodauth.oauth_applications_name_column] %>
+  <% application_name = application_uri ? link_to(rodauth.oauth_application[rodauth.oauth_applications_name_column], application_uri) : h(rodauth.oauth_application[rodauth.oauth_applications_name_column]) %>
   <p class="lead"><%= rodauth.authorize_page_lead(name: application_name).html_safe %></p>
 
   <div class="list-group">
@@ -37,56 +37,14 @@
         </div>
       <% end %>
     <% end %>
-    <%= hidden_field_tag :client_id, rodauth.param_or_nil("client_id") %>
-    <% %w[access_type response_type response_mode state redirect_uri].each do |oauth_param| %>
-      <% if rodauth.param_or_nil(oauth_param) %>
-        <%= hidden_field_tag oauth_param, rodauth.param_or_nil(oauth_param) %>
-      <% end %>
-    <% end %>
-    <% if rodauth.features.include?(:oauth_resource_indicators) && rodauth.resource_indicators %>
-      <% rodauth.resource_indicators.each do |resource| %>
-        <%= hidden_field_tag "resource", resource %>
-      <% end %>
-    <% end %>
-    <% if rodauth.features.include?(:oauth_pkce) %>
-      <% if rodauth.param_or_nil("code_challenge") %>
-        <%= hidden_field_tag :code_challenge, rodauth.param_or_nil("code_challenge") %>
-      <% end %>
-      <% if rodauth.param_or_nil("code_challenge_method") %>
-        <%= hidden_field_tag :code_challenge_method, rodauth.param_or_nil("code_challenge_method") %>
-      <% end %>
-    <% end %>
-    <% if rodauth.features.include?(:oidc) %>
-      <% if rodauth.param_or_nil("prompt") %>
-        <%= hidden_field_tag :prompt, rodauth.param_or_nil("prompt") %>
-      <% end %>
-      <% if rodauth.param_or_nil("nonce") %>
-        <%= hidden_field_tag :nonce, rodauth.param_or_nil("nonce") %>
-      <% end %>
-      <% if rodauth.param_or_nil("ui_locales") %>
-        <%= hidden_field_tag :ui_locales, rodauth.param_or_nil("ui_locales") %>
-      <% end %>
-      <% if rodauth.param_or_nil("claims_locales") %>
-        <%= hidden_field_tag :claims_locales, rodauth.param_or_nil("claims_locales") %>
-      <% end %>
-      <% if rodauth.param_or_nil("claims") %>
-        <%= hidden_field_tag :claims, sanitize(rodauth.param_or_nil("claims")) %>
-      <% end %>
-      <% if rodauth.param_or_nil("acr_values") %>
-        <%= hidden_field_tag :acr_values, rodauth.param_or_nil("acr_values") %>
-      <% end %>
-      <% if rodauth.param_or_nil("registration") %>
-        <%= hidden_field_tag :registration, rodauth.param_or_nil("registration") %>
-      <% end %>
-    <% end %>
-    <% if rodauth.features.include?(:oauth_dpop) %>
-      <% if rodauth.param_or_nil("dpop_jkt") %>
-        <%= hidden_field_tag :dpop_jkt, rodauth.param_or_nil("dpop_jkt") %>
-      <% end %>
+    <% rodauth.authorize_form_params.each do |field| %>
+      <%= tag(:input, type: field["type"], name: field["name"], value: field["value"]) %>
     <% end %>
   </div>
  <p class="text-center">
     <%= submit_tag rodauth.oauth_authorize_button, class: "btn btn-outline-primary" %>
-    <%= link_to rodauth.oauth_cancel_button, "#{rodauth.redirect_uri}?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request#{"&state=\#{CGI.escape(rodauth.state)}" if rodauth.param_or_nil("state") }", class: "btn btn-outline-danger" %>
+    <% cancel_url = "#{rodauth.redirect_uri}?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request" %>
+    <% cancel_url += "&state=#{CGI.escape(rodauth.param("state"))}" if rodauth.param_or_nil("state") %>
+    <%= link_to rodauth.oauth_cancel_button, cancel_url, class: "btn btn-outline-danger" %>
   </p>
 <% end %>

data/lib/generators/rodauth/oauth/templates/app/views/rodauth/oauth_application.html.erb

@@ -7,8 +7,14 @@
     <dd><%= oauth_application[rodauth.oauth_applications_description_column] %></dd>
     <dt><%= rodauth.oauth_applications_homepage_url_label %>: </dt>
     <dd><%= oauth_application[rodauth.oauth_applications_homepage_url_column] %></dd>
+    <dt><%= rodauth.oauth_applications_client_type_label %>: </dt>
+    <dd><%= rodauth.oauth_application_client_type_label(oauth_application) %></dd>
     <dt><%= rodauth.oauth_applications_client_id_label %>: </dt>
     <dd><%= oauth_application[rodauth.oauth_applications_client_id_column] %></dd>
+    <% if rodauth.confidential?(oauth_application) %>
+      <dt><%= rodauth.oauth_applications_client_secret_label %>: </dt>
+      <dd><%= oauth_application[rodauth.oauth_applications_client_secret_column] %></dd>
+    <% end %>
     <dt><%= rodauth.oauth_applications_redirect_uri_label %>: </dt>
     <dd><%= oauth_application[rodauth.oauth_applications_redirect_uri_column] %></dd>
     <dt><%= rodauth.oauth_applications_scopes_label %>: </dt>

data/lib/generators/rodauth/oauth/templates/db/migrate/create_rodauth_oauth.rb

@@ -8,7 +8,9 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       t.string :homepage_url, null: true
       t.string :redirect_uri, null: false
       t.string :client_id, null: false, index: { unique: true }
-      t.string :client_secret, null: false, index: { unique: true }
+      # change `:null` contraints to false if you want to support confidential clients only, and
+      # no scheme relying on JWT private keys advertised by the JWKs uri.
+      t.string :client_secret, null: true, index: { unique: true }
       t.string :registration_access_token, null: true
       t.string :scopes, null: false
       t.datetime :created_at, null: false, default: -> { "CURRENT_TIMESTAMP(6)" }

data/lib/rodauth/features/oauth_application_management.rb

@@ -35,8 +35,11 @@ module Rodauth
     translatable_method :oauth_applications_jwks_uri_label, "JSON Web Keys URI"
     translatable_method :oauth_applications_homepage_url_label, "Homepage URL"
     translatable_method :oauth_applications_redirect_uri_label, "Redirect URI"
-    translatable_method :oauth_applications_client_secret_label, "Client Secret"
     translatable_method :oauth_applications_client_id_label, "Client ID"
+    translatable_method :oauth_applications_client_secret_label, "Client Secret"
+    translatable_method :oauth_applications_client_type_label, "Client Type"
+    translatable_method :oauth_applications_confidential_label, "Confidential"
+    translatable_method :oauth_applications_public_label, "Public"
 
     %w[type token refresh_token expires_in revoked_at].each do |param|
       translatable_method :"oauth_grants_#{param}_label", param.gsub("_", " ").capitalize
@@ -58,9 +61,18 @@ module Rodauth
     translatable_method :oauth_no_grants_text, "No oauth grants yet!"
 
     auth_methods(
-      :oauth_application_path
+      :oauth_application_path,
+      :oauth_application_client_type_label
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@oauth_applications,
+        :@oauth_grants,
+        :@field_errors
+      )
+    end
+
     def oauth_applications_path(opts = {})
       route_path(oauth_applications_route, opts)
     end
@@ -69,6 +81,14 @@ module Rodauth
       "#{oauth_applications_path}/#{id}"
     end
 
+    def oauth_application_client_type_label(oauth_application)
+      if confidential?(oauth_application)
+        oauth_applications_confidential_label
+      else
+        oauth_applications_public_label
+      end
+    end
+
     # /oauth-applications routes
     def load_oauth_application_management_routes
       request.on(oauth_applications_route) do

data/lib/rodauth/features/oauth_authorization_code_grant.rb

@@ -116,7 +116,7 @@ module Rodauth
         <html>
           <head><title>Authorized</title></head>
           <body onload="javascript:document.forms[0].submit()">
-            <form method="post" action="#{url}">
+            <form method="post" action="#{scope.h(url)}">
               #{yield}
               <input type="submit" class="btn btn-outline-primary" value="#{scope.h(oauth_authorize_post_button)}"/>
             </form>
@@ -130,7 +130,7 @@ module Rodauth
         <html>
           <head><title></title></head>
           <body onload="javascript:document.forms[0].submit()">
-            <form method="post" action="#{url}">
+            <form method="post" action="#{scope.h(url)}">
               #{yield}
             </form>
           </body>

data/lib/rodauth/features/oauth_authorize_base.rb

@@ -30,9 +30,17 @@ module Rodauth
 
     auth_methods(
       :resource_owner_params,
-      :oauth_grants_resource_owner_columns
+      :oauth_grants_resource_owner_columns,
+      :authorize_form_params
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@error,
+        :@back_url
+      )
+    end
+
     OAUTH_ACCESS_TYPES = %w[offline online].freeze
 
     OAUTH_APPROVAL_PROMPTS = %w[force auto].freeze
@@ -73,6 +81,24 @@ module Rodauth
       end
     end
 
+    # The authorization request is validated on the GET which renders the form, and again on the
+    # POST which the resource owner submits, and the latter is a fresh request. These are the
+    # params of the authorization request which the form has to carry over into it, one entry per
+    # field, each with the "name", "value" and "type" it is rendered with. Features which introduce
+    # authorization request params of their own extend it, so a view which renders all of them
+    # keeps working as features get enabled.
+    def authorize_form_params
+      params = [{ "name" => "client_id", "value" => param("client_id"), "type" => "hidden" }]
+
+      %w[access_type response_type response_mode state redirect_uri].each do |param_name|
+        if (param_value = param_or_nil(param_name))
+          params << { "name" => param_name, "value" => param_value, "type" => "hidden" }
+        end
+      end
+
+      params
+    end
+
     private
 
     def validate_authorize_params

data/lib/rodauth/features/oauth_base.rb

@@ -34,6 +34,15 @@ module Rodauth
     auth_value_method :oauth_unique_id_generation_retries, 3
 
     auth_value_method :oauth_token_endpoint_auth_methods_supported, %w[client_secret_basic client_secret_post]
+    # An application which has no auth method of its own falls back to these, and not to every
+    # method the server supports: enabling a new method server-wide (such as "none", which requires
+    # no client authentication at all) must not turn existing confidential clients into public ones.
+    #
+    # TODO: change this to "client_secret_basic" only in a future major version, as per
+    # https://datatracker.ietf.org/doc/html/rfc7591#section-2, which defaults an omitted
+    # "token_endpoint_auth_method" to it. Doing so now would lock out "client_secret_post" clients
+    # whose application row has no auth method set.
+    auth_value_method :oauth_default_token_endpoint_auth_methods, %w[client_secret_basic client_secret_post]
     auth_value_method :oauth_grant_types_supported, %w[refresh_token]
     auth_value_method :oauth_response_types_supported, []
     auth_value_method :oauth_response_modes_supported, []
@@ -67,7 +76,7 @@ module Rodauth
       account_id
       name description scopes
       client_id client_secret
-      homepage_url redirect_uri
+      confidential homepage_url redirect_uri
       token_endpoint_auth_method grant_types response_types response_modes
       logo_uri tos_uri policy_uri jwks jwks_uri
       contacts software_id software_version
@@ -98,9 +107,7 @@ module Rodauth
 
     auth_value_method :is_authorization_server?, true
 
-    auth_value_methods(:only_json?)
-
-    auth_value_method :json_request_regexp, %r{\bapplication/(?:vnd\.api\+)?json\b}i
+    auth_value_method :json_request_regexp, %r{\Aapplication/(?:vnd\.api\+)?json\b}i
 
     # METADATA
     auth_value_method :oauth_metadata_service_documentation, nil
@@ -121,9 +128,18 @@ module Rodauth
       :oauth_unique_id_generator,
       :require_authorizable_account,
       :oauth_account_ds,
-      :oauth_application_ds
+      :oauth_application_ds,
+      :confidential?
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@json_request,
+        :@oauth_application,
+        :@authorization_token
+      )
+    end
+
     # /token
     auth_server_route(:token) do |r|
       require_oauth_application
@@ -188,6 +204,11 @@ module Rodauth
     def accepts_json?
       return true if only_json?
 
+      # the token endpoint responds in json no matter what the client asks for, including its
+      # errors, which are never bounced off the client's redirect uri.
+      # https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+      return true if request.path == token_path
+
       (accept = request.env["HTTP_ACCEPT"]) && accept =~ json_request_regexp
     end
 
@@ -219,7 +240,7 @@ module Rodauth
     end
 
     def oauth_application
-      return @oauth_application if defined?(@oauth_application)
+      return @oauth_application if @oauth_application
 
       client_id = param_or_nil("client_id")
 
@@ -228,6 +249,21 @@ module Rodauth
       @oauth_application = db[oauth_applications_table].filter(oauth_applications_client_id_column => client_id).first
     end
 
+    def confidential?(oauth_application)
+      token_endpoint_auth_method = oauth_application[oauth_applications_token_endpoint_auth_method_column]
+
+      # https://datatracker.ietf.org/doc/html/rfc7591#section-2
+      # "none": The client is a public client as defined in OAuth 2.0, Section 2.1, and does not have a client secret.
+      return false if token_endpoint_auth_method == "none"
+
+      oauth_confidential_token_endpoint_auth_methods.include?(token_endpoint_auth_method) ||
+        !(
+          # not exclusively registering implicit grant
+          Array(oauth_application[oauth_applications_grant_types_column]).include?("implicit") &&
+          Array(oauth_application[oauth_applications_response_types_column]).include?("token")
+        )
+    end
+
     def fetch_access_token
       if (token = request.params["access_token"])
         if request.post? && !(request.content_type.start_with?("application/x-www-form-urlencoded") &&
@@ -256,7 +292,7 @@ module Rodauth
     end
 
     def authorization_token
-      return @authorization_token if defined?(@authorization_token)
+      return @authorization_token if @authorization_token
 
       # check if there is a token
       access_token = fetch_access_token
@@ -315,6 +351,10 @@ module Rodauth
 
     private
 
+    def oauth_confidential_token_endpoint_auth_methods
+      %w[client_secret_basic client_secret_post]
+    end
+
     def oauth_account_ds(account_id)
       account_ds(account_id)
     end
@@ -404,10 +444,10 @@ module Rodauth
     def supports_auth_method?(oauth_application, auth_method)
       return false unless oauth_application
 
-      supported_auth_methods = if oauth_application[oauth_applications_token_endpoint_auth_method_column]
-                                 oauth_application[oauth_applications_token_endpoint_auth_method_column].split(/ +/)
+      supported_auth_methods = if (auth_methods = oauth_application[oauth_applications_token_endpoint_auth_method_column])
+                                 auth_methods.split(/ +/)
                                else
-                                 oauth_token_endpoint_auth_methods_supported
+                                 oauth_default_token_endpoint_auth_methods
                                end
 
       supported_auth_methods.include?(auth_method)
@@ -431,7 +471,11 @@ module Rodauth
       if oauth_applications_client_secret_hash_column
         BCrypt::Password.new(oauth_application[oauth_applications_client_secret_hash_column]) == secret
       else
-        oauth_application[oauth_applications_client_secret_column] == secret
+        stored_secret = oauth_application[oauth_applications_client_secret_column]
+        # A missing submitted or stored secret must never match. Without these guards, .to_s would
+        # coerce nil to "", letting an absent secret authenticate a client whose stored secret is
+        # empty/NULL. The real comparison stays constant-time via timing_safe_eql?.
+        !secret.nil? && !stored_secret.nil? && timing_safe_eql?(secret.to_s, stored_secret.to_s)
       end
     end
 
@@ -745,19 +789,22 @@ module Rodauth
       issuer = base_url
       issuer += "/#{path}" if path
 
-      {
+      payload = {
         issuer: issuer,
         token_endpoint: token_url,
         scopes_supported: oauth_application_scopes,
         response_types_supported: oauth_response_types_supported,
         response_modes_supported: oauth_response_modes_supported,
         grant_types_supported: oauth_grant_types_supported,
-        token_endpoint_auth_methods_supported: oauth_token_endpoint_auth_methods_supported,
-        service_documentation: oauth_metadata_service_documentation,
-        ui_locales_supported: oauth_metadata_ui_locales_supported,
-        op_policy_uri: oauth_metadata_op_policy_uri,
-        op_tos_uri: oauth_metadata_op_tos_uri
+        token_endpoint_auth_methods_supported: oauth_token_endpoint_auth_methods_supported
       }
+
+      # RFC 8414, section 2: unused optional metadata parameters must be omitted, not null
+      payload[:service_documentation] = oauth_metadata_service_documentation if oauth_metadata_service_documentation
+      payload[:ui_locales_supported] = oauth_metadata_ui_locales_supported if oauth_metadata_ui_locales_supported
+      payload[:op_policy_uri] = oauth_metadata_op_policy_uri if oauth_metadata_op_policy_uri
+      payload[:op_tos_uri] = oauth_metadata_op_tos_uri if oauth_metadata_op_tos_uri
+      payload
     end
 
     def redirect_response_error(error_code, message = nil)

data/lib/rodauth/features/oauth_device_code_grant.rb

@@ -38,6 +38,11 @@ module Rodauth
     auth_methods(
       :generate_user_code
     )
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@oauth_grant
+      )
+    end
 
     # /device-authorization
     auth_server_route(:device_authorization) do |r|

data/lib/rodauth/features/oauth_dpop.rb

@@ -54,6 +54,14 @@ module Rodauth
 
     auth_methods(:validate_dpop_proof_usage)
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@dpop_access_token,
+        :@dpop_claims,
+        :@dpop_thumbprint
+      )
+    end
+
     def require_oauth_authorization(*scopes)
       @dpop_access_token = fetch_access_token_from_authorization_header("dpop")
 
@@ -85,6 +93,14 @@ module Rodauth
       super
     end
 
+    def authorize_form_params
+      super.tap do |params|
+        if (param_value = param_or_nil("dpop_jkt"))
+          params << { "name" => "dpop_jkt", "value" => param_value, "type" => "hidden" }
+        end
+      end
+    end
+
     private
 
     def validate_token_params