comparison mod_http_oauth2/mod_http_oauth2.lua @ 5404:1087f697c3f3

mod_http_oauth2: Strip unknown extra fields from client registration We shouldn't sign things we don't understand! RFC 7591 section-2 states: > The authorization server MUST ignore any client metadata sent by the > client that it does not understand (for instance, by silently removing > unknown metadata from the client's registration record during > processing). Prevents grandfathering in of unvalidated data that might become used later, especially since the 'additionalProperties' schema keyword was removed in 698fef74ce53
author Kim Alvefur <zash@zash.se>
date Tue, 02 May 2023 16:23:40 +0200
parents c574aaaa4d57
children c7a5caad28ef
comparison
equal deleted inserted replaced
5403:c574aaaa4d57 5404:1087f697c3f3
770 return nil, oauth_error("invalid_client_metadata", "Invalid, insecure or inappropriate informative URI"); 770 return nil, oauth_error("invalid_client_metadata", "Invalid, insecure or inappropriate informative URI");
771 end 771 end
772 end 772 end
773 end 773 end
774 774
775 -- Localized URIs should be secure too
776 for k, v in pairs(client_metadata) do 775 for k, v in pairs(client_metadata) do
777 if k:find"_uri#" then 776 local base_k = k:match"^([^#]+)#" or k;
777 if not registration_schema.properties[base_k] or k:find"^client_uri#" then
778 -- Ignore and strip unknown extra properties
779 client_metadata[k] = nil;
780 elseif k:find"_uri#" then
781 -- Localized URIs should be secure too
778 if not redirect_uri_allowed(v, client_uri, "web") then 782 if not redirect_uri_allowed(v, client_uri, "web") then
779 return nil, oauth_error("invalid_client_metadata", "Invalid, insecure or inappropriate informative URI"); 783 return nil, oauth_error("invalid_client_metadata", "Invalid, insecure or inappropriate informative URI");
780 end 784 end
781 end 785 end
782 end 786 end