Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hi Team , We are upgrading the Ory Hydra from version 1.11.10 to 2.0.3 what we could see that the end point /.well-known/jwks.json has started returning both public and private keys public:hydra.openid.id-token , private:hydra.openid.id-token , public:hydra.jwt.access-token , private:hydra.jwt.access-token however the  value of the  "n" (modulus) parameter contains the modulus value for the RSA public key looks to be same

is it only the IDs that are returned, or do you actually get private key values?

Thanks for your reply . No we don't get back the sensitive values q,d,p but it returns both the ids which is having ("use","kty","kid","alg","n","e": "AQAB")

Please confirm if it is expected behavior  as before upgrade the same endpoint only use to send public key details

These properties are part of the public key according to the JWK specs (<https://www.rfc-editor.org/rfc/rfc7517|https://www.rfc-editor.org/rfc/rfc7517>), so this is expected behavior.