Hydra customizable token prefixes

[K3das]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe your problem

Hydra currently has hardcoded token prefixes (ory_at_). This was initially a Fosite limitation due to @aeneasr's hesitation to make them customizable (ory/fosite#733 (comment)). However, ory/fosite#733 gained significant community support for this feature, and ory/fosite#816 makes it easy to modify prefixes through an HMACSHAStrategy wrapper.

Notably, making this a user-configurable option makes it easier for security teams to scan for leaks, enabling them to use systems like the GitHub secret scanning partner program, where security teams will get their own notifications for leaked secrets from their own Hydra instances, rather than ory.sh.

Some users, like @mattslocum, also cite the prefixes as unnecessary exposure of information, giving attackers extra information about their environment, worsening the impact of any future security issues in Hydra.

Describe your ideal solution

Ideally there will be a set of optional config options for customizing the token prefixes with something other than ory_

Workarounds or alternatives

None

Version

n/a

Additional Context

No response

[aeneasr]

Thanks for the feedback and for highlighting the community’s interest in configurable token prefixes. Right now, this feature is available in Ory Enterprise License, and we don’t have plans to add it to the Apache 2 version of Hydra. We get the value this brings for security teams and the concerns about exposure, and we’ll keep the community updated if anything changes!

[K3das]

Would such a feature be open to a community contribution?

[aeneasr]

Unfortunately not at this time but if that changes we will notify here :) Thank you for understanding