Skip to content

v11.4.7

Choose a tag to compare

View all tags
@ryanio ryanio released this 15 Jul 22:36
· 29 commits to main since this release
v11.4.7
aeaeb82

What's Changed

  • OAuth browser and device flows now request Zitadel's role-specific scopes, keeping issued tokens limited to the OpenSea permissions the client requested.
  • Explicit empty scope lists are rejected locally instead of being sent to the authorization server, where they could expand to every role on the account.

Full Changelog: v11.4.5...v11.4.7

Assets 2
Loading