{"id":13438220,"url":"https://github.com/ory/fosite","last_synced_at":"2026-01-12T02:34:19.871Z","repository":{"id":37405430,"uuid":"48582772","full_name":"ory/fosite","owner":"ory","description":"Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.","archived":false,"fork":false,"pushed_at":"2025-04-16T23:01:11.000Z","size":7679,"stargazers_count":2391,"open_issues_count":47,"forks_count":373,"subscribers_count":50,"default_branch":"master","last_synced_at":"2025-05-12T02:45:01.285Z","etag":null,"topics":["auth","authentication","authorization","golang","hacktoberfest","library","oauth","oauth2","openid-connect","sdk","security"],"latest_commit_sha":null,"homepage":"https://www.ory.sh/?utm_source=github\u0026utm_medium=banner\u0026utm_campaign=fosite","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ory.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null},"funding":{"patreon":"_ory","open_collective":"ory"}},"created_at":"2015-12-25T14:23:27.000Z","updated_at":"2025-05-10T05:55:25.000Z","dependencies_parsed_at":"2024-02-13T08:42:48.149Z","dependency_job_id":"b11ce7ac-a0b6-43cf-8fd6-bc0ee09b5a5c","html_url":"https://github.com/ory/fosite","commit_stats":{"total_commits":793,"total_committers":102,"mean_commits":"7.7745098039215685","dds":0.6658259773013872,"last_synced_commit":"db59a34fd07a978cd053d4485c3bafdc54348cbb"},"previous_names":["ory-am/fosite"],"tags_count":158,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ory%2Ffosite","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ory%2Ffosite/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ory%2Ffosite/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ory%2Ffosite/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ory","download_url":"https://codeload.github.com/ory/fosite/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253672731,"owners_count":21945482,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["auth","authentication","authorization","golang","hacktoberfest","library","oauth","oauth2","openid-connect","sdk","security"],"created_at":"2024-07-31T03:01:03.787Z","updated_at":"2026-01-12T02:34:19.865Z","avatar_url":"https://github.com/ory.png","language":"Go","readme":"\u003ch1 align=\"center\"\u003e\u003cimg src=\"./docs/image/banner_fosite.png\" alt=\"ORY Fosite - Security-first OAuth2 framework\"\u003e\u003c/h1\u003e\n\n[![Build Status](https://travis-ci.org/ory/fosite.svg?branch=master)](https://travis-ci.org/ory/fosite?branch=master)\n[![Coverage Status](https://coveralls.io/repos/ory/fosite/badge.svg?branch=master\u0026service=github\u0026foo)](https://coveralls.io/github/ory/fosite?branch=master)\n[![Go Report Card](https://goreportcard.com/badge/ory/fosite)](https://goreportcard.com/report/ory/fosite)\n\n[![Join the chat at https://www.ory.sh/chat](https://img.shields.io/badge/join-chat-00cc99.svg)](https://www.ory.sh/chat)\n\n**The security first OAuth2 \u0026 OpenID Connect framework for\n[Go](https://golang.org).** Built simple, powerful and extensible. This library\nimplements peer-reviewed [IETF RFC6749](https://tools.ietf.org/html/rfc6749),\ncounterfeits weaknesses covered in peer-reviewed\n[IETF RFC6819](https://tools.ietf.org/html/rfc6819) and countermeasures various\ndatabase attack scenarios, keeping your application safe when that hacker\npenetrates or leaks your database. OpenID Connect is implemented according to\n[OpenID Connect Core 1.0 incorporating errata set 1](https://openid.net/specs/openid-connect-core-1_0.html)\nand includes all flows: code, implicit, hybrid.\n\nThis library considered and implemented:\n\n- [The OAuth 2.0 Authorization Framework](https://tools.ietf.org/html/rfc6749)\n- [OAuth 2.0 Multiple Response Type Encoding Practices](https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html)\n- [OAuth 2.0 Threat Model and Security Considerations](https://tools.ietf.org/html/rfc6819)\n- [Proof Key for Code Exchange by OAuth Public Clients](https://tools.ietf.org/html/rfc7636)\n- [OAuth 2.0 for Native Apps](https://tools.ietf.org/html/rfc8252)\n- [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html)\n- [OAuth 2.0 Pushed Authorization Request](https://datatracker.ietf.org/doc/html/rfc9126)\n\nOAuth2 and OpenID Connect are difficult protocols. If you want quick wins, we\nstrongly encourage you to look at [Hydra](https://github.com/ory-am/hydra).\nHydra is a secure, high performance, cloud native OAuth2 and OpenID Connect\nservice that integrates with every authentication method imaginable and is built\non top of Fosite.\n\n\u003c!-- START doctoc generated TOC please keep comment here to allow auto update --\u003e\n\u003c!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE --\u003e\n\n**Table of Contents**\n\n- [Motivation](#motivation)\n- [API Stability](#api-stability)\n- [Example](#example)\n- [A word on quality](#a-word-on-quality)\n- [A word on security](#a-word-on-security)\n- [A word on extensibility](#a-word-on-extensibility)\n- [Installation](#installation)\n- [Documentation](#documentation)\n  - [Scopes](#scopes)\n    - [`fosite.WildcardScopeStrategy`](#fositewildcardscopestrategy)\n    - [`fosite.HierarchicScopeStrategy`](#fositehierarchicscopestrategy)\n  - [Quickstart](#quickstart)\n  - [Code Examples](#code-examples)\n  - [Example Storage Implementation](#example-storage-implementation)\n  - [Extensible handlers](#extensible-handlers)\n  - [JWT Introspection](#jwt-introspection)\n- [Contribute](#contribute)\n  - [Refresh mock objects](#refresh-mock-objects)\n- [Hall of Fame](#hall-of-fame)\n\n\u003c!-- END doctoc generated TOC please keep comment here to allow auto update --\u003e\n\n## Motivation\n\nFosite was written because our OAuth2 and OpenID Connect service\n[**Hydra**](https://github.com/ory-am/hydra) required a secure and extensible\nOAuth2 library. We had to realize that nothing matching our requirements was out\nthere, so we decided to build it ourselves.\n\n## API Stability\n\nThe core public API is almost stable as most changes will only touch the inner\nworkings.\n\nWe strongly encourage vendoring fosite using\n[dep](https://github.com/golang/dep) or comparable tools.\n\n## Example\n\nThe example does not have nice visuals but it should give you an idea of what\nyou can do with Fosite and a few lines of code.\n\n![Authorize Code Grant](docs/authorize-code-grant.gif)\n\nYou can run this minimalistic example by doing\n\n```\ngo get github.com/ory/fosite-example\ncd $GOPATH/src/github.com/ory/fosite-example\ndep ensure\ngo install github.com/ory/fosite-example\nfosite-example\n```\n\nThere should be a server listening on [localhost:3846](https://localhost:3846/).\nYou can check out the example's source code\n[here](https://github.com/ory/fosite-example/).\n\n## A word on quality\n\nWe tried to set up as many tests as possible and test for as many cases covered\nin the RFCs as possible. But we are only human. Please, feel free to add tests\nfor the various cases defined in the OAuth2 RFCs 6749 and 6819 or any other\ncases that improve the tests.\n\n**Everyone** writing an RFC conform test that breaks with the current\nimplementation, will receive a place in the [Hall of Fame](#hall-of-fame)!\n\n## A word on security\n\nPlease be aware that Fosite only secures parts of your server side security. You\nstill need to secure your apps and clients, keep your tokens safe, prevent CSRF\nattacks, ensure database security, use valid and strong TLS certificates and\nmuch more. If you need any help or advice feel free to contact our security\nstaff through [our website](https://ory.am/)!\n\nWe have given the various specifications, especially\n[OAuth 2.0 Threat Model and Security Considerations](https://tools.ietf.org/html/rfc6819#section-5.1.5.3),\na very close look and included everything we thought was in the scope of this\nframework. Here is a complete list of things we implemented in Fosite:\n\n- [No Cleartext Storage of Credentials](https://tools.ietf.org/html/rfc6819#section-5.1.4.1.3)\n- [Encryption of Credentials](https://tools.ietf.org/html/rfc6819#section-5.1.4.1.4)\n- [Use Short Expiration Time](https://tools.ietf.org/html/rfc6819#section-5.1.5.3)\n- [Limit Number of Usages or One-Time Usage](https://tools.ietf.org/html/rfc6819#section-5.1.5.4)\n- [Bind Token to Client id](https://tools.ietf.org/html/rfc6819#section-5.1.5.8)\n- [Automatic Revocation of Derived Tokens If Abuse Is Detected](https://tools.ietf.org/html/rfc6819#section-5.2.1.1)\n- [Binding of Refresh Token to \"client_id\"](https://tools.ietf.org/html/rfc6819#section-5.2.2.2)\n- [Refresh Token Rotation](https://tools.ietf.org/html/rfc6819#section-5.2.2.3)\n- [Revocation of Refresh Tokens](https://tools.ietf.org/html/rfc6819#section-5.2.2.4)\n- [Validate Pre-Registered \"redirect_uri\"](https://tools.ietf.org/html/rfc6819#section-5.2.3.5)\n- [Binding of Authorization \"code\" to \"client_id\"](https://tools.ietf.org/html/rfc6819#section-5.2.4.4)\n- [Binding of Authorization \"code\" to \"redirect_uri\"](https://tools.ietf.org/html/rfc6819#section-5.2.4.6)\n- [Opaque access tokens](https://tools.ietf.org/html/rfc6749#section-1.4)\n- [Opaque refresh tokens](https://tools.ietf.org/html/rfc6749#section-1.5)\n- [Ensure Confidentiality of Requests](https://tools.ietf.org/html/rfc6819#section-5.1.1)\n- [Use of Asymmetric Cryptography](https://tools.ietf.org/html/rfc6819#section-5.1.4.1.5)\n  Fosite ensures that redirect URIs use https **except localhost** but you need\n  to implement TLS for the token and auth endpoints yourself.\n\nAdditionally, we added these safeguards:\n\n- **Enforcing random states:** Without a random-looking state or OpenID Connect\n  nonce the request will fail.\n- **Advanced Token Validation:** Tokens are layouted as `\u003ckey\u003e.\u003csignature\u003e`\n  where `\u003csignature\u003e` is created using HMAC-SHA256 using a global secret. This\n  is what a token can look like:\n  `/tgBeUhWlAT8tM8Bhmnx+Amf8rOYOUhrDi3pGzmjP7c=.BiV/Yhma+5moTP46anxMT6cWW8gz5R5vpC9RbpwSDdM=`\n\nSections below [Section 5](https://tools.ietf.org/html/rfc6819#section-5) that\nare not covered in the list above should be reviewed by you. If you think that a\nspecific section should be something that is covered in Fosite, feel free to\ncreate an [issue](https://github.com/ory/fosite/issues). Please be aware that\nOpenID Connect requires specific knowledge of the identity provider, which is\nwhy Fosite only implements core requirements and most things must be implemented\nby you (for example prompt, max_age, ui_locales, id_token_hint, user\nauthentication, session management, ...).\n\n**It is strongly encouraged to use the handlers shipped with Fosite as they\nfollow the specs and are well tested.**\n\n## A word on extensibility\n\nFosite is extensible ... because OAuth2 is an extensible and flexible\n**framework**. Fosite let's you register custom token and authorize endpoint\nhandlers with the security that the requests have been validated against the\nOAuth2 specs beforehand. You can easily extend Fosite's capabilities. For\nexample, if you want to provide OpenID Connect on top of your OAuth2 stack,\nthat's no problem. Or custom assertions, what ever you like and as long as it is\nsecure. ;)\n\n## Installation\n\n[Go 1.11+](https://golang.org) must be installed on your system and it is\nrequired that you have set up your GOPATH environment variable.\n\n```\ngo get -u github.com/ory/fosite/...\n```\n\nWe recommend to use [dep](https://github.com/golang/dep) to mitigate\ncompatibility breaks that come with new api versions.\n\n## Documentation\n\nThere is an API documentation available at\n[godoc.org/ory/fosite](https://godoc.org/github.com/ory/fosite).\n\n### Scopes\n\nFosite has three strategies for matching scopes. You can replace the default\nscope strategy if you need a custom one by implementing `fosite.ScopeStrategy`.\n\nUsing the composer, setting a strategy is easy:\n\n```go\nimport \"github.com/ory/fosite\"\n\nvar config = \u0026fosite.Config{\nScopeStrategy: fosite.HierarchicScopeStrategy,\n}\n```\n\n**Note:** To issue refresh tokens with any of the grants, you need to include\nthe `offline` scope in the OAuth2 request. This can be modified by the\n`RefreshTokenScopes` compose configuration. When set to an empty array, _all_\ngrants will issue refresh tokens.\n\n#### `fosite.WildcardScopeStrategy`\n\nThis is the default strategy, and the safest one. It is best explained by\nlooking at some examples:\n\n- `users.*` matches `users.read`\n- `users.*` matches `users.read.foo`\n- `users.read` matches `users.read`\n- `users` does not match `users.read`\n- `users.read.*` does not match `users.read`\n- `users.*.*` does not match `users.read`\n- `users.*.*` matches `users.read.own`\n- `users.*.*` matches `users.read.own.other`\n- `users.read.*` matches `users.read.own`\n- `users.read.*` matches `users.read.own.other`\n- `users.write.*` does not match `users.read.own`\n- `users.*.bar` matches `users.baz.bar`\n- `users.*.bar` does not `users.baz.baz.bar`\n\nTo request `users.*`, a client must have exactly `users.*` as granted scope.\n\n#### `fosite.ExactScopeStrategy`\n\nThis strategy is searching only for exact matches. It returns true iff the scope\nis granted.\n\n#### `fosite.HierarchicScopeStrategy`\n\nThis strategy is deprecated, use it with care. Again, it is best explained by\nlooking at some examples:\n\n- `users` matches `users`\n- `users` matches `users.read`\n- `users` matches `users.read.own`\n- `users.read` matches `users.read`\n- `users.read` matches `users.read.own`\n- `users.read` does not match `users.write`\n- `users.read` does not match `users.write.own`\n\n### Globalization\n\nFosite does not natively carry translations for error messages and hints, but\noffers an interface that allows the consumer to define catalog bundles and an\nimplementation to translate. This is available through the\n[MessageCatalog](i18n/i18n.go) interface. The functions defined are\nself-explanatory. The `DefaultMessageCatalog` illustrates this. Compose config\nhas been extended to take in an instance of the `MessageCatalog`.\n\n#### Building translated files\n\nThere are three possible \"message key\" types:\n\n1. Value of `RFC6749Error.ErrorField`: This is a string like `invalid_request`\n   and correlates to most errors produced by Fosite.\n2. Hint identifier passed into `RFC6749Error.WithHintIDOrDefaultf`: This func is\n   not used extensively in Fosite but, in time, most `WithHint` and `WithHintf`\n   will be replaced with this function.\n3. Free text string format passed into `RFC6749Error.WithHint` and\n   `RFC6749Error.WithHintf`: This function is used in Fosite and Hydra\n   extensively and any message catalog implementation can use the format string\n   parameter as the message key.\n\nAn example of a message catalog can be seen in the\n[i18n_test.go](i18n/i18n_test.go).\n\n#### Generating the `en` messages file\n\nThis is a WIP at the moment, but effectively any scripting language can be used\nto generate this. It would need to traverse all files in the source code and\nextract the possible message identifiers based on the different message key\ntypes.\n\n### Quickstart\n\nInstantiating fosite by hand can be painful. Therefore we created a few\nconvenience helpers available through the [compose package](/compose). It is\nstrongly encouraged to use these well tested composers.\n\nIn this very basic example, we will instantiate fosite with all OpenID Connect\nand OAuth2 handlers enabled. Please refer to the\n[example app](https://github.com/ory/fosite-example/) for more details.\n\nThis little code snippet sets up a full-blown OAuth2 and OpenID Connect example.\n\n```go\npackage main\n\nimport \"github.com/ory/fosite\"\nimport \"github.com/ory/fosite/compose\"\nimport \"github.com/ory/fosite/storage\"\n\n// This is the example storage that contains:\n// * an OAuth2 Client with id \"my-client\" and secrets \"foobar\" and \"foobaz\" capable of all oauth2 and open id connect grant and response types.\n// * a User for the resource owner password credentials grant type with username \"peter\" and password \"secret\".\n//\n// You will most likely replace this with your own logic once you set up a real world application.\nvar storage = storage.NewExampleStore()\n\n// This secret is being used to sign access and refresh tokens as well as\n// authorization codes. It must be exactly 32 bytes long.\nvar secret = []byte(\"my super secret signing password\")\n\nprivateKey, err := rsa.GenerateKey(rand.Reader, 2048)\nif err != nil {\npanic(\"unable to create private key\")\n}\n\n// check the api docs of fosite.Config for further configuration options\nvar config = \u0026fosite.Config{\n\tAccessTokenLifespan: time.Minute * 30,\n\tGlobalSecret: secret,\n\t// ...\n}\n\nvar oauth2Provider = compose.ComposeAllEnabled(config, storage, privateKey)\n\n// The authorize endpoint is usually at \"https://mydomain.com/oauth2/auth\".\nfunc authorizeHandlerFunc(rw http.ResponseWriter, req *http.Request) {\n\t// This context will be passed to all methods. It doesn't fulfill a real purpose in the standard library but could be used\n\t// to abort database lookups or similar things.\n\tctx := req.Context()\n\n\t// Let's create an AuthorizeRequest object!\n\t// It will analyze the request and extract important information like scopes, response type and others.\n\tar, err := oauth2Provider.NewAuthorizeRequest(ctx, req)\n\tif err != nil {\n\t\toauth2Provider.WriteAuthorizeError(ctx, rw, ar, err)\n\t\treturn\n\t}\n\n\t// Normally, this would be the place where you would check if the user is logged in and gives his consent.\n\t// We're simplifying things and just checking if the request includes a valid username and password\n\tif req.Form.Get(\"username\") != \"peter\" {\n\t\trw.Header().Set(\"Content-Type\", \"text/html;charset=UTF-8\")\n\t\trw.Write([]byte(`\u003ch1\u003eLogin page\u003c/h1\u003e`))\n\t\trw.Write([]byte(`\n\t\t\t\u003cp\u003eHowdy! This is the log in page. For this example, it is enough to supply the username.\u003c/p\u003e\n\t\t\t\u003cform method=\"post\"\u003e\n\t\t\t\t\u003cinput type=\"text\" name=\"username\" /\u003e \u003csmall\u003etry peter\u003c/small\u003e\u003cbr\u003e\n\t\t\t\t\u003cinput type=\"submit\"\u003e\n\t\t\t\u003c/form\u003e\n\t\t`))\n\t\treturn\n\t}\n\n\t// Now that the user is authorized, we set up a session. When validating / looking up tokens, we additionally get\n\t// the session. You can store anything you want in it.\n\n\t// The session will be persisted by the store and made available when e.g. validating tokens or handling token endpoint requests.\n\t// The default OAuth2 and OpenID Connect handlers require the session to implement a few methods. Apart from that, the\n\t// session struct can be anything you want it to be.\n\tmySessionData := \u0026fosite.DefaultSession{\n\t\tUsername: req.Form.Get(\"username\"),\n\t}\n\n\t// It's also wise to check the requested scopes, e.g.:\n\t// if authorizeRequest.GetScopes().Has(\"admin\") {\n\t//     http.Error(rw, \"you're not allowed to do that\", http.StatusForbidden)\n\t//     return\n\t// }\n\n\t// Now we need to get a response. This is the place where the AuthorizeEndpointHandlers kick in and start processing the request.\n\t// NewAuthorizeResponse is capable of running multiple response type handlers which in turn enables this library\n\t// to support open id connect.\n\tresponse, err := oauth2Provider.NewAuthorizeResponse(ctx, ar, mySessionData)\n\tif err != nil {\n\t\toauth2Provider.WriteAuthorizeError(ctx, rw, ar, err)\n\t\treturn\n\t}\n\n\t// Awesome, now we redirect back to the client redirect uri and pass along an authorize code\n\toauth2Provider.WriteAuthorizeResponse(ctx, rw, ar, response)\n}\n\n// The token endpoint is usually at \"https://mydomain.com/oauth2/token\"\nfunc tokenHandlerFunc(rw http.ResponseWriter, req *http.Request) {\n\tctx := req.Context()\n\n\t// Create an empty session object that will be passed to storage implementation to populate (unmarshal) the session into.\n\t// By passing an empty session object as a \"prototype\" to the store, the store can use the underlying type to unmarshal the value into it.\n\t// For an example of storage implementation that takes advantage of that, see SQL Store (fosite_store_sql.go) from ory/Hydra project.\n\tmySessionData := new(fosite.DefaultSession)\n\n\t// This will create an access request object and iterate through the registered TokenEndpointHandlers to validate the request.\n\taccessRequest, err := oauth2Provider.NewAccessRequest(ctx, req, mySessionData)\n\tif err != nil {\n\t\toauth2Provider.WriteAccessError(ctx, rw, accessRequest, err)\n\t\treturn\n\t}\n\n\tif mySessionData.Username == \"super-admin-guy\" {\n\t\t// do something...\n\t}\n\n\t// Next we create a response for the access request. Again, we iterate through the TokenEndpointHandlers\n\t// and aggregate the result in response.\n\tresponse, err := oauth2Provider.NewAccessResponse(ctx, accessRequest)\n\tif err != nil {\n\t\toauth2Provider.WriteAccessError(ctx, rw, accessRequest, err)\n\t\treturn\n\t}\n\n\t// All done, send the response.\n\toauth2Provider.WriteAccessResponse(ctx, rw, accessRequest, response)\n\n\t// The client has a valid access token now\n}\n\nfunc someResourceProviderHandlerFunc(rw http.ResponseWriter, req *http.Request) {\n\tctx := req.Context()\n\trequiredScope := \"blogposts.create\"\n\n\t_, ar, err := oauth2Provider.IntrospectToken(ctx, fosite.AccessTokenFromRequest(req), fosite.AccessToken, new(fosite.DefaultSession), requiredScope)\n\tif err != nil {\n\t\t// ...\n\t}\n\n\t// If no error occurred the token + scope is valid and you have access to:\n\t// ar.GetClient().GetID(), ar.GetGrantedScopes(), ar.GetScopes(), ar.GetSession().UserID, ar.GetRequestedAt(), ...\n}\n```\n\n### Code Examples\n\nFosite provides integration tests as well as a http server example:\n\n- Fosite ships with an example app that runs in your browser:\n  [Example app](https://github.com/ory/fosite-example/).\n- If you want to check out how to enable specific handlers, check out the\n  [integration tests](integration/).\n\nIf you have working examples yourself, please share them with us!\n\n### Example Storage Implementation\n\nFosite does not ship a storage implementation. This is intended, because\nrequirements vary with every environment. You can find a reference\nimplementation at [storage/memory.go](storage/memory.go). This storage fulfills\nrequirements from all OAuth2 and OpenID Connect handlers.\n\n### Extensible handlers\n\nOAuth2 is a framework. Fosite mimics this behaviour by enabling you to replace\nexisting or create new OAuth2 handlers. Of course, fosite ships handlers for all\nOAuth2 and OpenID Connect flows.\n\n- **[Fosite OAuth2 Core Handlers](handler/oauth2)** implement the\n  [Client Credentials Grant](https://tools.ietf.org/html/rfc6749#section-4.4),\n  [Resource Owner Password Credentials Grant](https://tools.ietf.org/html/rfc6749#section-4.3),\n  [Implicit Grant](https://tools.ietf.org/html/rfc6749#section-4.2),\n  [Authorization Code Grant](https://tools.ietf.org/html/rfc6749#section-4.1),\n  [Refresh Token Grant](https://tools.ietf.org/html/rfc6749#section-6)\n- **[Fosite OpenID Connect Handlers](handler/openid)** implement the\n  [Authentication using the Authorization Code Flow](http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth),\n  [Authentication using the Implicit Flow](http://openid.net/specs/openid-connect-core-1_0.html#ImplicitFlowAuth),\n  [Authentication using the Hybrid Flow](http://openid.net/specs/openid-connect-core-1_0.html#HybridFlowAuth)\n\nThis section is missing documentation and we welcome any contributions in that\ndirection.\n\n### JWT Introspection\n\nPlease note that when using the OAuth2StatelessJWTIntrospectionFactory access\ntoken revocation is not possible.\n\n## Contribute\n\nYou need git and golang installed on your system.\n\n```\ngo get -d github.com/ory/fosite\ncd $GOPATH/src/github.com/ory/fosite\ngit status\ngit remote add myfork \u003curl-to-your-fork\u003e\ngo test ./...\n```\n\nSimple, right? Now you are ready to go! Make sure to run `go test ./...` often,\ndetecting problems with your code rather sooner than later. Please read\n[CONTRIBUTE.md] before creating pull requests and issues.\n\n### Refresh mock objects\n\nRun `./generate-mocks.sh` in fosite's root directory or run the contents of\n[generate-mocks.sh] in a shell.\n\n## Hall of Fame\n\nThis place is reserved for the fearless bug hunters, reviewers and contributors\n(alphabetical order).\n\n- [agtorre](https://github.com/agtorre):\n  [contributions](https://github.com/ory/fosite/issues?q=author%3Aagtorre),\n  [participations](https://github.com/ory/fosite/issues?q=commenter%3Aagtorre).\n- [danielchatfield](https://github.com/danielchatfield):\n  [contributions](https://github.com/ory/fosite/issues?q=author%3Adanielchatfield),\n  [participations](https://github.com/ory/fosite/issues?q=commenter%3Adanielchatfield).\n- [leetal](https://github.com/leetal):\n  [contributions](https://github.com/ory/fosite/issues?q=author%3Aleetal),\n  [participations](https://github.com/ory/fosite/issues?q=commenter%3Aleetal).\n- [jrossiter](https://github.com/jrossiter):\n  [contributions](https://github.com/ory/fosite/issues?q=author%3Ajrossiter),\n  [participations](https://github.com/ory/fosite/issues?q=commenter%3Ajrossiter).\n- [jrossiter](https://github.com/jrossiter):\n  [contributions](https://github.com/ory/fosite/issues?q=author%3Ajrossiter),\n  [participations](https://github.com/ory/fosite/issues?q=commenter%3Ajrossiter).\n- [danilobuerger](https://github.com/danilobuerger):\n  [contributions](https://github.com/ory/fosite/issues?q=author%3Adanilobuerger),\n  [participations](https://github.com/ory/fosite/issues?q=commenter%3Adanilobuerger).\n\nFind out more about the [author](https://aeneas.io/) of Fosite and Hydra, and\nthe [Ory Company](https://ory.am/).\n","funding_links":["https://patreon.com/_ory","https://opencollective.com/ory"],"categories":["HarmonyOS","Go","Authentication","`Authentication Development`","Ecosystem"],"sub_categories":["Windows Manager","\u003ca name=\"authN-golang\"\u003e\u003c/a\u003eGolang"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fory%2Ffosite","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fory%2Ffosite","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fory%2Ffosite/lists"}