Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hello. We're implementing a consent screen as an SPA with hydra, and I'm wondering how to go about protecting the hydra admin getOAuth2ConsentRequest/acceptOAuth2ConsentRequest api calls? At the moment I'm building a backend service that our SPA will call, which itself calls these APIs, that way the hydra admin apis do not need to be exposed. However I'm wondering if there's a pattern established, or best practices for protecting the hydra admin apis that are more-or-less required for public operation.