New templates were added to the Passkeys and WebAuthn authenticators to provide the new functionality for allowing users to set an alias for their newly registered devices. The new templates are:
authenticator/passkeys/register/set-alias/get.vm
authenticator/webauthn/register/set-alias/get.vm
New messages were added as well (at the same paths as the templates), to provide the necessary translations.
The HTTP Server was updated to enforce HTTP header size limits more strictly. This means that it is possible that workloads that previously worked will now start failing with Response Header Fields Too Large.
Response Header Fields Too Large
If you see this error, you may need to increase the limit by setting the se.curity:identity-server:max-header-size system property to a value above 65536, which is the default limit.
se.curity:identity-server:max-header-size
65536
Since version 10.0, the server does URL decoding of both the userid and the password components to establish the client ID and secret for validation. This aligns with OAuth 2.0, which states that clients should encode their ID/secret in this context.
That change can be breaking in cases where a client’s secret includes escape sequences (e.g. %3A and +), but the client doesn’t URL-encode the secret in the Authorization header. To avoid blocking server upgrades in such cases, the se.curity:identity-server:authorize:allow-unencoded-client-secret-on-basic-auth system property was added. If the property is set to true, the server also checks the client secret without URL-decoding it, as a fallback.
%3A
+
se.curity:identity-server:authorize:allow-unencoded-client-secret-on-basic-auth
true
That property is meant to allow a transition period on edge-case scenarios and it will be removed in a future major release. Clients should be updated as soon as possible, in any case.