LoginSign Up
← Back to all sparks
O

Ory Hydra

INFRA · APIS
Velocity0.0

OpenID Certified OAuth 2.0 and OpenID Connect server written in Go

www.ory.sh/hydra ↗

Hydra's 2.2 candidates rebuilt the OAuth2 flow store, then reached for verifiable credentials

oauth2openid-connectverifiable-credentialsself-hosted-identitybreaking-change
◆Current state
Ory Hydra is a self-hosted OAuth2 and OpenID Connect server. Its visible release record is the v2.2.0 candidate series from 2023, which did two substantial things: rc.2 moved authorization-code flow state out of the database and into AEAD-encrypted cookies and request parameters, a change shipped with an explicit breaking-change notice; rc.3 then added initial OIDC verifiable-credential issuance and wired logout propagation into Ory Kratos. The feed stops at a v2.2.0-pre.1 tag in February 2024.
◆Where it's heading
The through-line is reducing per-request database work in the hot authorization path — first by relocating flow state into encrypted client-side material, then by parallelizing JSON web key set generation and adding scope-claim strategies. Running underneath is tighter coupling to the rest of the Ory stack: the Kratos admin URL config and session-termination hook make Hydra less of a standalone component and more of one piece of an integrated identity suite. The verifiable-credentials work is the one thread pointing somewhere genuinely new, and it shipped against a draft specification.
◆Prediction
The candidate series points toward a v2.2.0 general release consolidating the AEAD flow change and the credential-issuance work. The feed's silence after February 2024 gives no basis for judging when, or whether the draft-stage VC support advanced.

◆Recent moves

  1. 2y ago

    v2.2.0-pre.1

    An autogenerated commit pin for the pre.1 tag, with no release notes. It marks the last movement visible on the 2.2.0 line rather than describing any change.

    View source ↗
  2. 2y ago

    v2.2.0-rc.3

    ⚡ SPARK

    The largest release in the series and the one that widens what Hydra does rather than how fast it does it: initial OIDC verifiable-credential issuance, logout propagation into Kratos sessions, and a configurable claim-mirroring opt-out. It sits on top of the flow-storage rework from rc.2 and extends the same integration push.

    View source ↗
  3. 3y ago

    v2.2.0-rc.2

    ⚡ SPARK

    The architectural pivot of the 2.2 line: authorization-code flow state moves out of the database into AEAD-encoded cookies and request parameters, cutting queries per flow. It ships with a breaking-change notice, and every later release in the series builds on this storage model.

    View source ↗
  4. 3y ago

    v2.2.0-rc.1

    A same-content precursor to rc.2, tagged one day earlier and carrying only a truncated copy of that release's opening description. Effectively superseded on arrival rather than a distinct release.

    View source ↗