Connect2id server 19.16

Connect2id Server 19.16 introduces configurable length limits for the OAuth 2.0 state and OpenID Connect nonce parameters used in authorisation requests.

While these parameters are normally small, the protocols themselves don’t impose hard limits. Excessively large values can create problems, particularly when state is appended to a redirect URI or when a large nonce is propagated into an ID token. Excessively large states can also facilitate browser-swap attacks.

• op.authz.maxStateLength.uriResponse – limits the state length in URI-based response modes, such as query, with a default value of 1024 characters.
• op.authz.maxStateLength.formPostResponse – limits the state length in form post-based response modes, with a default value 8192 characters.
• op.authz.maxNonceLength – limits the nonce length, with a default value of 128 characters.

The default values are those that the Connect2id server incorporated as hard limits in v19.x. The new configuration properties allow deployments to tighten or relax them according to their interoperability and operational requirements.

Download 19.16

For the signature validation: Public GPG key

Standard Connect2id server edition

Apache Tomcat package with Connect2id server 19.16: Connect2id-server.zip

GPG signature: Connect2id-server.zip.asc

SHA-256: 69f92fdcfc40c76330dcbc522ee7087b9176d99e279eb2f1eb42b36523c2f02e

Connect2id server 19.16 WAR package: c2id.war

GPG signature: c2id.war.asc

SHA-256: dbf0df2c97a197a39edd0ffddd29824bcc30a0c996dc0d5c1f1d92eda6594360

Multi-tenant edition

Apache Tomcat package with Connect2id server 19.16: Connect2id-server-mt.zip

GPG signature: Connect2id-server-mt.zip.asc

SHA-256: d4138d34172cc889e8b51cd67c92f033439e69dc46a592d7aaaa1ce329b49e73

Connect2id server 19.16 WAR package: c2id-mt.war

GPG signature: c2id-mt.war.asc

SHA-256: dc283a84f1ec611b5a6fd8538bce6bbb425bff2f9fba0dd2f0bd808a3bfeedb9

Questions?

For technical questions about this new release contact Connect2id support. To purchase a production license for the Connect2id server, renew or upgrade your support and updates subscription, email our sales.

Release notes

19.16 (2026-08-23)

Summary

• Introduces configurable limits on the maximum allowed length of the OAuth 2.0 state and OpenID Connect nonce authorisation request parameters.

Configuration

• /WEB-INF/oidcProvider.properties

  • op.authz.maxStateLength.uriResponse – New optional configuration property to specify the maximum allowed length of the OAuth 2.0 state authorisation request parameter, in characters, when returned in an authorisation response via a URI-based response mode, such as query, fragment, query.jwt, fragment.jwt or jwt. State values longer than this limit will be rejected with an invalid_request error. The limit helps prevent operational issues caused by excessively long redirection URIs. Must be a positive integer. The default value is 1024.

  • op.authz.maxStateLength.formPostResponse – New optional configuration property to specify the maximum allowed length of the OAuth 2.0 state authorisation request parameter, in characters, when returned in an authorisation response via the form_post or form_post.jwt response mode. State values longer than this limit will be rejected with an invalid_request error. Must be a positive integer. The default value
    is 8192.

  • op.authz.maxNonceLength – New optional configuration property to specify the maximum allowed length of the OpenID Connect nonce authorisation request parameter, in characters. Nonces longer than this value will be rejected with an invalid_request error. The limit helps prevent operational issues caused by unusually large nonce values in ID tokens, logs, or downstream processing. Must be a positive integer. The default value is 128.

Resolved issues

• Removes the hard-wired length limit of 2048 characters of authorisation response URIs (redirect_uri with appended state) from the state validator. Deployments can control the length of authorisation response URIs using a combination of redirect_uri length checking at client registration time and the new op.authz.maxStateLength.uriResponse configuration property. Note that the client registration endpoint enforces a length limit of 1024 characters for redirect_uri values (issue server / 1216).

Dependency changes

• Updates to net.minidev:json-smart:2.6.0

• Updates to org.bouncycastle:bcprov-jdk18on:1.85.2

• Updates to org.bouncycastle:bcpkix-jdk18on:1.85