| 3.10.6 (opens in API7 Gateway docs) | 2026-08-25 | Fix | Fixed issue: An identity provider that redirected back with error=temporarily_unavailable — which the specification defines as a transient condition — made the gateway answer HTTP 500. The authentication flow is now r… (opens in API7 Gateway docs) |
| 3.10.6 (opens in API7 Gateway docs) | 2026-08-25 | Fix | Fixed issue: required_scopes, claim_validator.audience.match_with_client_id and issuer validation were not applied in every case, letting through requests the configuration should have rejected. See Upgrade Notes. (opens in API7 Gateway docs) |
| 3.10.5 (opens in API7 Gateway docs) | 2026-08-11 | Feature | Added support for DPoP sender-constrained tokens (RFC 9449). When dpop.enabled is set, the gateway signs a DPoP proof with dpop.private_key for the token request and advertises the matching dpop.public_jwk, binding th… (opens in API7 Gateway docs) |
| 3.10.5 (opens in API7 Gateway docs) | 2026-08-11 | Feature | Added support for Pushed Authorization Requests (PAR, RFC 9126). When par.enabled is set, the gateway sends the full authorization request to the identity provider's PAR endpoint over a back channel and redirects the… (opens in API7 Gateway docs) |
| 3.10.5 (opens in API7 Gateway docs) | 2026-08-11 | Fix | Fixed issue: An Authorization header with leading or trailing whitespace was rejected in bearer_only mode, because the whitespace was carried into the extracted token. The header is now trimmed before the token is read. (opens in API7 Gateway docs) |
| 3.10.4 (opens in API7 Gateway docs) | 2026-07-27 | Feature | Added set_raw_id_token_header. When enabled, the raw ID token issued by the identity provider is forwarded to the upstream service in the X-Raw-ID-Token header, so the upstream can verify the token signature itself in… (opens in API7 Gateway docs) |
| 3.10.4 (opens in API7 Gateway docs) | 2026-07-27 | Fix | Fixed issue: An empty JSON array in the identity provider's user info (for example "roles": []) was re-encoded as an empty object ({}) in the X-Userinfo header on requests served from an existing session, so upstream… (opens in API7 Gateway docs) |
| 3.10.4 (opens in API7 Gateway docs) | 2026-07-27 | Fix | Fixed issue: Delivering an authorization callback whose state no longer matched the session — for example after starting a second login flow in the same browser — returned HTTP 500. The gateway now redirects to the or… (opens in API7 Gateway docs) |
| 3.10.3 (opens in API7 Gateway docs) | 2026-07-14 | Fix | Fixed issue: refresh_session_interval incorrectly defaulted to 900, enabling silent re-authentication even when users did not configure it. The default is removed (see Upgrade Notes). (opens in API7 Gateway docs) |
| 3.10.2 (opens in API7 Gateway docs) | 2026-06-29 | Feature | Added Redis as a session storage backend. Set session.storage to redis and configure session.redis (host, port, and related options) to store sessions in Redis instead of in the session cookie; cookie remains the defa… (opens in API7 Gateway docs) |
| 3.10.2 (opens in API7 Gateway docs) | 2026-06-29 | Change | openid-connect: session.redis.password (opens in API7 Gateway docs) |
| 3.10.1 (opens in API7 Gateway docs) | 2026-06-15 | Feature | client_secret is now optional for flows that only verify tokens locally and never call the identity provider (bearer_only with public_key or use_jwks, private_key_jwt, and public-client PKCE). It remains required for… (opens in API7 Gateway docs) |
| 3.10.1 (opens in API7 Gateway docs) | 2026-06-15 | Feature | Exposed the lua-resty-session options under session (cookie name, path, domain, secure, http_only, same_site, and the idling, rolling, and absolute timeouts), so you can customize the session cookie name and set sessi… (opens in API7 Gateway docs) |
| 3.10.1 (opens in API7 Gateway docs) | 2026-06-15 | Change | openid-connect: session.secret (opens in API7 Gateway docs) |
| 3.9.19 (opens in API7 Gateway docs) | 2026-08-26 | Fix | Fixed issue: An identity provider that redirected back with error=temporarily_unavailable — which the specification defines as a transient condition — made the gateway answer HTTP 500. The authentication flow is now r… (opens in API7 Gateway docs) |
| 3.9.19 (opens in API7 Gateway docs) | 2026-08-26 | Fix | Fixed issue: required_scopes, claim_validator.audience.match_with_client_id and issuer validation were not applied in every case, letting through requests the configuration should have rejected. See Upgrade Notes. (opens in API7 Gateway docs) |
| 3.9.18 (opens in API7 Gateway docs) | 2026-08-12 | Feature | Added support for DPoP sender-constrained tokens (RFC 9449). When dpop.enabled is set, the gateway signs a DPoP proof with dpop.private_key for the token request and advertises the matching dpop.public_jwk, binding th… (opens in API7 Gateway docs) |
| 3.9.18 (opens in API7 Gateway docs) | 2026-08-12 | Feature | Added support for Pushed Authorization Requests (PAR, RFC 9126). When par.enabled is set, the gateway sends the full authorization request to the identity provider's PAR endpoint over a back channel and redirects the… (opens in API7 Gateway docs) |
| 3.9.18 (opens in API7 Gateway docs) | 2026-08-12 | Fix | Fixed issue: An Authorization header with leading or trailing whitespace was rejected in bearer_only mode, because the whitespace was carried into the extracted token. The header is now trimmed before the token is read. (opens in API7 Gateway docs) |
| 3.9.17 (opens in API7 Gateway docs) | 2026-07-28 | Feature | Added set_raw_id_token_header. When enabled, the raw ID token issued by the identity provider is forwarded to the upstream service in the X-Raw-ID-Token header, so the upstream can verify the token signature itself in… (opens in API7 Gateway docs) |
| 3.9.17 (opens in API7 Gateway docs) | 2026-07-28 | Fix | Fixed issue: An empty JSON array in the identity provider's user info (for example "roles": []) was re-encoded as an empty object ({}) in the X-Userinfo header on requests served from an existing session, so upstream… (opens in API7 Gateway docs) |
| 3.9.17 (opens in API7 Gateway docs) | 2026-07-28 | Fix | Fixed issue: Delivering an authorization callback whose state no longer matched the session — for example after starting a second login flow in the same browser — returned HTTP 500. The gateway now redirects to the or… (opens in API7 Gateway docs) |
| 3.9.16 (opens in API7 Gateway docs) | 2026-07-10 | Fix | Fixed issue: refresh_session_interval incorrectly defaulted to 900, enabling silent re-authentication even when users did not configure it. The default is removed (see Upgrade Notes). (opens in API7 Gateway docs) |
| 3.9.15 (opens in API7 Gateway docs) | 2026-06-22 | Feature | Added Redis as a session storage backend. Set session.storage to redis (the default remains cookie) and configure the connection under session.redis (host, port, authentication, database, key prefix, TLS, and timeouts… (opens in API7 Gateway docs) |
| 3.9.14 (opens in API7 Gateway docs) | 2026-06-15 | Feature | Added support for the lua-resty-session session options (such as cookie_name and cookie_path), so the session cookie can be customized. (opens in API7 Gateway docs) |
| 3.9.14 (opens in API7 Gateway docs) | 2026-06-15 | Feature | client_secret is now optional for local JWT verification modes (for example bearer_only with public_key, use_jwks, or private_key_jwt), where a client secret is not required. (opens in API7 Gateway docs) |
| 3.9.14 (opens in API7 Gateway docs) | 2026-06-15 | Fix | Fixed issue: The openid-connect exemption that allows omitting client_secret was applied too broadly. It is now scoped to the OIDC flows that genuinely do not require a client secret. (opens in API7 Gateway docs) |
| 3.9.14 (opens in API7 Gateway docs) | 2026-06-15 | Change | OpenID Connect: session.secret (opens in API7 Gateway docs) |
| 3.9.13 (opens in API7 Gateway docs) | 2026-05-22 | Fix | Fixed issue: Client-supplied identity headers (X-Access-Token, X-Userinfo, X-ID-Token, X-Refresh-Token) could be forwarded upstream instead of values validated by the plugin. These headers are now cleared or overwritt… (opens in API7 Gateway docs) |
| 3.9.13 (opens in API7 Gateway docs) | 2026-05-22 | Fix | Fixed issue: The OpenID Connect plugin code editor could collapse or become unreachable on small or highly zoomed viewports. (opens in API7 Gateway docs) |
| 3.9.11 (opens in API7 Gateway docs) | 2026-04-30 | Feature | All plugins now support $secret:// and $env:// references in any configuration field automatically. Previously, only a handful of plugins (jwt-auth, openid-connect, limit-count, authz-keycloak, csrf, limit-req, limit-… (opens in API7 Gateway docs) |
| 3.9.10 (opens in API7 Gateway docs) | 2026-04-22 | Feature | Added OpenID Connect quick start presets with pre-filled configuration templates for common identity providers, simplifying initial OIDC plugin setup. (opens in API7 Gateway docs) |
| 3.9.10 (opens in API7 Gateway docs) | 2026-04-22 | Change | OpenID Connect: client_rsa_private_key (opens in API7 Gateway docs) |
| 3.9.2 (opens in API7 Gateway docs) | 2026-01-19 | Feature | Supported validating claims by configuring claim_schema. (opens in API7 Gateway docs) |
| 3.9.2 (opens in API7 Gateway docs) | 2026-01-19 | Change | The session.secret field is now required when bearer_only is false (the default). Previously, if not configured, a random secret was automatically generated on each data plane instance, which prevented sessions from b… (opens in API7 Gateway docs) |
| 3.8.19 (opens in API7 Gateway docs) | 2025-12-09 | Feature | Added support for the ${external_user.*} built-in variable to retrieve values from external user information. The variable is injected by the openid-connect plugin and developer portal OAuth authentication. (opens in API7 Gateway docs) |
| 3.8.6 (opens in API7 Gateway docs) | 2025-06-27 | Fix | Fixed issue: Sessions not properly closed on errors, leading to resource leaks. (opens in API7 Gateway docs) |
| 3.7.1 (opens in API7 Gateway docs) | 2025-03-14 | Fix | Fixed issue: Cannot configuring verify issuer. (opens in API7 Gateway docs) |
| 3.7.1 (opens in API7 Gateway docs) | 2025-03-14 | Fix | Fixed issue: Unable to validate audience claim. . (opens in API7 Gateway docs) |
| 3.6.1 (opens in API7 Gateway docs) | 2025-03-14 | Fix | Fixed issue: The plugin does not support configuring verify issuer. (opens in API7 Gateway docs) |
| 3.5.5 (opens in API7 Gateway docs) | 2025-03-14 | Fix | Fixed issue: The plugin does not support configuring verify issuer. (opens in API7 Gateway docs) |
| 3.5.5 (opens in API7 Gateway docs) | 2025-03-14 | Fix | Fixed issue: Unable to validate audience claim. (opens in API7 Gateway docs) |
| 3.5.0 (opens in API7 Gateway docs) | 2025-01-27 | Feature | Added redirect_after_logout_uri for plugin that do not have an end_session_endpoint. (opens in API7 Gateway docs) |
| 3.5.0 (opens in API7 Gateway docs) | 2025-01-27 | Fix | Fixed issue: The redirect_uri was set to ngx.var.request_uri if not configured and caused the underlying lua-resty-openidc module to raise error. (opens in API7 Gateway docs) |
| 3.4.0 (opens in API7 Gateway docs) | 2025-01-07 | Feature | Added authorization parameters. (opens in API7 Gateway docs) |
| 3.4.0 (opens in API7 Gateway docs) | 2025-01-07 | Feature | Added more attributes. (opens in API7 Gateway docs) |
| 3.4.0 (opens in API7 Gateway docs) | 2025-01-07 | Feature | Added required scopes configuration property. (opens in API7 Gateway docs) |
| 3.4.0 (opens in API7 Gateway docs) | 2025-01-07 | Feature | Added session.cookie configuration. (opens in API7 Gateway docs) |
| 3.4.0 (opens in API7 Gateway docs) | 2025-01-07 | Fix | Fixed issue: Not closing session and blocking until TTL expired when using lockable session storage backend. (opens in API7 Gateway docs) |
| 3.4.0 (opens in API7 Gateway docs) | 2025-01-07 | Feature | Supported setting headers in introspection request. (opens in API7 Gateway docs) |
| 3.3.0 (opens in API7 Gateway docs) | 2024-12-17 | Feature | Added proxy_opts attribute. (opens in API7 Gateway docs) |
| 3.3.0 (opens in API7 Gateway docs) | 2024-12-17 | Feature | Synchronized the latest APISIX code. (opens in API7 Gateway docs) |
