Mercurial > prosody-modules
view mod_auth_external_insecure/examples/python/prosody-auth-example.py @ 5404:1087f697c3f3
mod_http_oauth2: Strip unknown extra fields from client registration
We shouldn't sign things we don't understand!
RFC 7591 section-2 states:
> The authorization server MUST ignore any client metadata sent by the
> client that it does not understand (for instance, by silently removing
> unknown metadata from the client's registration record during
> processing).
Prevents grandfathering in of unvalidated data that might become used
later, especially since the 'additionalProperties' schema keyword was
removed in 698fef74ce53
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Tue, 02 May 2023 16:23:40 +0200 |
parents | f84ede3e9e3b |
children |
line wrap: on
line source
#!/usr/bin/env python2 import sys def auth(username, password): if username == "someone": return "1" return "0" def respond(ret): sys.stdout.write(ret+"\n") sys.stdout.flush() methods = { "auth": { "function": auth, "parameters": 2 } } while 1: line = sys.stdin.readline().rstrip("\n") method, sep, data = line.partition(":") if method in methods: method_info = methods[method] split_data = data.split(":", method_info["parameters"]) if len(split_data) == method_info["parameters"]: respond(method_info["function"](*split_data)) else: respond("error: incorrect number of parameters to method '%s'"%method) else: respond("error: method '%s' not implemented"%method)