annotate mod_muc_restrict_nick/README.markdown @ 5193:2bb29ece216b

mod_http_oauth2: Implement stateless dynamic client registration Replaces previous explicit registration that required either the additional module mod_adhoc_oauth2_client or manually editing the database. That method was enough to have something to test with, but would not probably not scale easily. Dynamic client registration allows creating clients on the fly, which may be even easier in theory. In order to not allow basically unauthenticated writes to the database, we implement a stateless model here. per_host_key := HMAC(config -> oauth2_registration_key, hostname) client_id := JWT { client metadata } signed with per_host_key client_secret := HMAC(per_host_key, client_id) This should ensure everything we need to know is part of the client_id, allowing redirects etc to be validated, and the client_secret can be validated with only the client_id and the per_host_key. A nonce injected into the client_id JWT should ensure nobody can submit the same client metadata and retrieve the same client_secret
author Kim Alvefur <zash@zash.se>
date Fri, 03 Mar 2023 21:14:19 +0100
parents e7b126161e7b
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
4588
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 ---
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2 labels:
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 - 'Stage-Alpha'
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4 summary: 'Require MUC occupant nicknames to match a specific pattern'
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 ---
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7 Introduction
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8 ============
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10 This checks the nickname of a joining user against a configurable
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 [Lua pattern](https://www.lua.org/manual/5.2/manual.html#6.4.1), and prevents
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12 them from joining if it does not match.
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 Configuration
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 =============
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17 There is a single configuration option, `muc_restrict_nick_pattern` and the
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18 default is `"^%w+$"` - i.e. allow only alphanumeric characters in nicknames.
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20 Compatibility
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21 =============
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
22
e7b126161e7b mod_muc_restrict_nick: New module to restrict MUC occupant nicknames
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23 Requires Prosody 0.11 or higher.