Mercurial > prosody-modules

comparison mod_http_oauth2/mod_http_oauth2.lua @ 5461:06640647d193

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_http_oauth2: Fix use of arbitrary ports in loopback redirect URIs Per draft-ietf-oauth-v2-1-08#section-8.4.2 > The authorization server MUST allow any port to be specified at the > time of the request for loopback IP redirect URIs, to accommodate > clients that obtain an available ephemeral port from the operating > system at the time of the request. Uncertain if it should normalize the host part, but it also seems harmless to treat IPv6 and IPv4 the same here. One thing is that "localhost" is NOT RECOMMENDED because it can sometimes be pointed to non-loopback interfaces via DNS or hosts file.
author Kim Alvefur <zash@zash.se>
date Wed, 17 May 2023 13:51:30 +0200
parents c0d62c1b4424
children f6d8830a83fe
comparison
equal deleted inserted replaced
5460:c0d62c1b4424 5461:06640647d193
234 id_token = id_token; 234 id_token = id_token;
235 refresh_token = refresh_token or nil; 235 refresh_token = refresh_token or nil;
236 }; 236 };
237 end 237 end
238 238
239 local function normalize_loopback(uri)
240 local u = url.parse(uri);
241 if u.scheme == "http" and loopbacks:contains(u.host) then
242 u.authority = nil;
243 u.host = "::1";
244 u.port = nil;
245 return url.build(u);
246 end
247 -- else, not a valid loopback uri
248 end
249
239 local function get_redirect_uri(client, query_redirect_uri) -- record client, string : string 250 local function get_redirect_uri(client, query_redirect_uri) -- record client, string : string
240 if not query_redirect_uri then 251 if not query_redirect_uri then
241 if #client.redirect_uris ~= 1 then 252 if #client.redirect_uris ~= 1 then
242 -- Client registered multiple URIs, it needs specify which one to use 253 -- Client registered multiple URIs, it needs specify which one to use
243 return; 254 return;
249 for _, redirect_uri in ipairs(client.redirect_uris) do 260 for _, redirect_uri in ipairs(client.redirect_uris) do
250 if query_redirect_uri == redirect_uri then 261 if query_redirect_uri == redirect_uri then
251 return redirect_uri 262 return redirect_uri
252 end 263 end
253 end 264 end
254 -- FIXME The authorization server MUST allow any port to be specified at the 265 -- The authorization server MUST allow any port to be specified at the time
255 -- time of the request for loopback IP redirect URIs, to accommodate clients 266 -- of the request for loopback IP redirect URIs, to accommodate clients that
256 -- that obtain an available ephemeral port from the operating system at the 267 -- obtain an available ephemeral port from the operating system at the time
257 -- time of the request. 268 -- of the request.
258 -- https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-08.html#section-8.4.2 269 -- https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-08.html#section-8.4.2
270 local loopback_redirect_uri = normalize_loopback(query_redirect_uri);
271 if loopback_redirect_uri then
272 for _, redirect_uri in ipairs(client.redirect_uris) do
273 if loopback_redirect_uri == normalize_loopback(redirect_uri) then
274 return query_redirect_uri;
275 end
276 end
277 end
259 end 278 end
260 279
261 local grant_type_handlers = {}; 280 local grant_type_handlers = {};
262 local response_type_handlers = {}; 281 local response_type_handlers = {};
263 local verifier_transforms = {}; 282 local verifier_transforms = {};