Arne Luenser

Is this really hardcoded to 30 sec? IMO we can just extend this to 5 min. @zepatrik ?

Are we talking about the individual code validity period? Or the total time the user has to complete the flow?

This is by design, since `/sessions` is an admin API. Please reopen if you think I'm mistaken.

What is the problem, exactly? Returning 400 here for an identity ID which does not exist seems OK to me semantically. The OpenAPI spec also lists 400 as a possible...

I've investigated this issue and can reproduce it. The issue is that the continuity container (which holds the ` "traits": { "lang": "de", "tac": "1234", "dp": "4321" } ` data)...

Same issue: https://github.com/ory/oathkeeper/issues/1081 Needs a fix in ory/x.

Yes, this does look like a bug. Instead of only using the first key, we should attempt verification with previous keys as well. PRs are welcome.

Thanks for the PR! Would you mind adding a failing test case as a first step? That way we're sure to catch any regressions in the future. Also, it makes...

Hydra generates its own JWKS on-demand if it can't find an existing one. Because that's typically an RSA key, this operation is cpu intensive. I'm sure this could be handled...

If you see a `499` response code somewhere, that means the client canceled the request and no reponse was actually written. Any error messages related to this code may be...