OpenFGA Files

🚨 Operational warning for MySQL users 🚨

This release contains a migration for MySQL which acquires a shared lock on the tuple and changelog tables. This is a potentially-lengthy migration, during which you will not be able to perform Write operations.

What you should do: Do not execute auto-migrations on startup for production instances with large datasets. Please refer to this migration guide before applying this migration.

Fixed

• Use crypto/subtle.ConstantTimeCompare for preshared key authentication to close a timing side-channel where the prior map lookup could reveal information about valid key bytes. #3168 Thanks to @geo-chen for reporting this.
• Enforce that authn.oidc.issuer and authn.oidc.audience are both set when authn.method is oidc. Previously, omitting --authn-oidc-audience caused the JWT aud claim to be silently skipped during token validation, allowing any validly-signed token from the trusted issuer to be accepted regardless of its intended audience. OpenFGA will now refuse to start if either value is missing. Thank you @0xVijay for bringing this to our attention.

Security

• Fixed identifier comparison on the MySQL backend to be case-sensitive, matching Postgres and SQLite. Ships schema migrations 008, which require a maintenance window — see the operator runbook before upgrading.

Full Changelog: https://github.com/openfga/openfga/compare/v1.17.1...v1.18.0