<p><a href="/tags/hollo/" rel="tag">#Hollo</a> 0.6.0 is coming soon!</p><p>We're putting the finishing touches on our biggest security and feature update yet. Here's what's coming:</p><p>Enhanced <a href="/tags/oauth/" rel="tag">#OAuth</a> <a href="/tags/security/" rel="tag">#security</a></p><p>RFC 8414 (OAuth metadata discovery)<br>RFC 7636 (<a href="/tags/pkce/" rel="tag">#PKCE</a> support)<br>Improved authorization flows following RFC 9700 best practices</p><p>New features</p><p>Extended character limit (4K → 10K)<br>Code syntax highlighting<br>Customizable profile themes<br>EXIF metadata stripping for privacy</p><p>Important notes for update</p><p>Node.js 24+ required<br>Updated environment variables for asset storage<br>Stronger SECRET_KEY requirements (44+ chars)</p><p>Special thanks to <span class="h-card"><a href="https://hachyderm.io/@thisismissem" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>thisismissem</span></a></span> for the extensive OAuth improvements that help keep the <a href="/tags/fediverse/" rel="tag">#fediverse</a> secure and compatible! 🙏</p><p>Full changelog and upgrade guide coming with the release.</p><p><a href="/tags/activitypub/" rel="tag">#ActivityPub</a></p>
pkce
<p>browsing the specs of OAuth 2.1 and found that PKCE is now mandatory for Authorization Code Flow (not only Desktops or frontend-only apps!):<br><a href="https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12" rel="nofollow" class="ellipsis" title="datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12"><span class="invisible">https://</span><span class="ellipsis">datatracker.ietf.org/doc/html/</span><span class="invisible">draft-ietf-oauth-v2-1-12</span></a></p><p>"The authorization code grant is extended with the functionality from PKCE [RFC7636] such that the default method of using the authorization code grant according to this specification requires the addition of the PKCE parameters"</p><p><a href="/tags/oauth/" rel="tag">#oauth</a> <a href="/tags/oauth2_1/" rel="tag">#oauth2_1</a> <a href="/tags/pkce/" rel="tag">#pkce</a> <a href="/tags/authorizationcodeflow/" rel="tag">#authorizationcodeflow</a></p>
Edited 1y ago