You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
AuthArea: what it touches
Bug FixesKind: in v2.1.232,
Bug FixesSection of the release
What
Reading identity claims from an OIDC token now rejects zero-length strings, so a blank claim falls through to the userinfo lookup instead of being accepted as a value. Affects OIDC-configured deployments only.
Details
Scalar claims require J.length > 0; array claims filter on typeof O === "string" && O.length > 0.
Presence checks were split into their own helpers ahead of the userinfo fallback.
Evidence
oidc id_token claim names request_id=
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
