LoginSign Up
← Back to all sparks
A

Authelia

INFRA · APIS
Velocity5.0

Open-source authentication and two-factor authorization server.

www.authelia.com ↗

Authelia ships weekly OIDC patches as v4.39 works through a long conformance backlog

authenticationoidcssoself-hostedsecurityauthorization
◆Current state
Authelia is in a steady patch release cycle for v4.39, shipping OIDC conformance fixes, proxy integration patches, and storage correctness fixes every few days. Recent releases address edge cases in consent flows (pre-configured consent saved twice, consent redirect status codes), JARM alg-none conformance, Envoy authz path handling, and SMTP IPv6 literal address support.
◆Where it's heading
The high frequency of point releases reflects a long tail of OIDC conformance issues surfaced as more client libraries and proxy configurations hit edge cases in production. The v4.39.21 batch was notably large—over 30 fixes covering LDAP stale aliases, storage AAD/HKDF hardening, token regeneration semantics, and pre-compressed asset serving. This is a codebase being actively hardened rather than feature-extended.
◆Prediction
A v4.40.0 feature release is the logical next milestone; the dense patch cadence in 4.39 typically precedes a feature window. Expect new OIDC profile features or expanded token management based on the storage and JWT work in recent patches.

◆Recent moves

  1. 1d ago

    v4.39.27

    Three targeted OIDC fixes: correct HTTP status code for consent redirects, include query string in Envoy authz path checks, and prevent pre-configured consent from being persisted twice. Narrow correctness patches with no behavioral change for standard deployments.

    View source ↗
  2. 3d ago

    v4.39.26

    Allows conformant `alg: none` in JARM (JWT Secured Authorization Response Mode) responses. Required for compatibility with clients that use JARM without response signing—a narrow OIDC edge case.

    View source ↗
  3. 6d ago

    v4.39.25

    Fixes SMTP notification delivery failures when the server address is an IPv6 literal (e.g., [::1]). A specific infrastructure edge case for self-hosters with IPv6-only mail servers.

    View source ↗
  4. 7d ago

    v4.39.24

    Fixes test suite log formatting—preserves log colors under `go test -json` and restores single log groups in suite output. Developer tooling only; no user-visible change.

    View source ↗
  5. 8d ago

    v4.39.23

    Fixes ten issues across OIDC (client auth strategy, resource indicators grant, FK violation in client credentials, resource strategy matching) and the web frontend (WebAuthn description error visibility, reset password form re-enable after failure, dialog cancellation blocking). This is the most substantive recent release—addressing multiple OIDC correctness issues that affected real deployments using resource indicators and client credentials.

    View source ↗
  6. 13d ago

    v4.39.22

    Fixes a storage bug where access token JWT upgrades could fail—a correctness patch for the token storage layer introduced as part of the recent AAD/HKDF hardening work in v4.39.21.

    View source ↗