🔑 EnableOAuth rejects a non-positive refresh interval
app.EnableOAuth(jwksURL, 0) used to return nil. The JWKS refresh goroutine then died on time.NewTicker(0) with non-positive interval for NewTicker and took the whole process down a moment after startup. A refresh interval of 0 or less is now rejected the same way a bad JWKS URL is: EnableOAuth returns a wrapped error, logs that OAuth is disabled and installs no middleware. A positive interval behaves as before.
| Call | Before | After |
|---|---|---|
EnableOAuth(url, 0) | returns nil, process crashes shortly after | returns an error, no middleware installed |
EnableOAuth(url, -1) | returns nil, process crashes shortly after | returns an error, no middleware installed |
EnableOAuth(url, 600) | works | works |
if err := app.EnableOAuth("https://idp.example.com/.well-known/jwks.json", 600); err != nil {
app.Logger().Fatal(err) // stop startup instead of running without authentication
}
📄 Swagger serves only its own UI assets
When static/openapi.json exists, GoFr registered a catch-all GET /.well-known/{name}. It served any embedded file under that name, including implementation files such as files.go, and it stopped an application from defining its own /.well-known/* routes. GoFr now lists the embedded Swagger UI assets at startup and registers one route per web asset (.css, .html, .ico, .js, .png). SwaggerUIHandler keeps its signature, so direct callers are not affected.
| Path | Before | After |
|---|---|---|
/.well-known/openapi.json | served | served |
/.well-known/swagger | served | served |
Swagger UI assets (swagger-ui.css, index.html, …) | served by the catch-all | served by their own routes |
Embedded implementation files (files.go) | publicly served | not routed, 404 |
Your own /.well-known/security.txt | shadowed by Swagger | works |
Unknown /.well-known/<name> | returned the Swagger UI | normal 404 |
Full Changelog: https://github.com/gofr-dev/gofr/compare/v1.63.0...v1.63.1