| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-09-10 | 1.1 kB | |
| v5.9.7 source code.tar.gz | 2026-09-10 | 212.3 kB | |
| v5.9.7 source code.zip | 2026-09-10 | 369.4 kB | |
| Totals: 3 Items | 582.8 kB | 0 | |
- Refuse requests that transmit an access token by more than one method (RFC 6750 §2), instead of silently authorizing with the first configured
access_token_methodsentry that matched and discarding the other tokens. Such a request now fails closed as carrying no usable token (401invalid_token); no calling contract changes. The form-encoded body (§2.2) and the URI query (§2.3) count as two methods even though Rails and Rack merge them into a singleparamshash. The same token repeated across two methods is refused too — §2 forbids the second method, not a disagreement between the two — and a custom callable extractor inaccess_token_methodskeeps the historical first-wins behavior and is never invoked more than once. (The strictinvalid_request(400) answer §3.1 prescribes ships with Doorkeeper 6.0.) - [#1925] Internal: pin the development dependency on
jsonbelow 3.0. json 3 removed the positional options Hash fromJSON.parseand thequirks_modeoption fromJSON.generate, both of which Active Support still uses, so the suite could not run on any supported Rails version.
