Mercurial > prosody-modules
view mod_http_authentication/README.markdown @ 5404:1087f697c3f3
mod_http_oauth2: Strip unknown extra fields from client registration
We shouldn't sign things we don't understand!
RFC 7591 section-2 states:
> The authorization server MUST ignore any client metadata sent by the
> client that it does not understand (for instance, by silently removing
> unknown metadata from the client's registration record during
> processing).
Prevents grandfathering in of unvalidated data that might become used
later, especially since the 'additionalProperties' schema keyword was
removed in 698fef74ce53
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Tue, 02 May 2023 16:23:40 +0200 |
| parents | b19d64dd4c66 |
| children |
line wrap: on
line source
--- labels: - 'Stage-Beta' summary: Enforces HTTP Basic authentication across all HTTP endpoints served by Prosody ... # mod_http_authentication This module enforces HTTP Basic authentication across all HTTP endpoints served by Prosody. ## Configuration Name Default Description ---------------------------------- --------------------------------- -------------------------------------------------------------------------------------------------------------------------------------- http\_credentials "minddistrict:secretpassword" The credentials that HTTP clients must provide to access the HTTP interface. Should be a string with the syntax "username:password". unauthenticated\_http\_endpoints { "/http-bind", "/http-bind/" } A list of paths that should be excluded from authentication. ## Usage This is a global module, so should be added to the global `modules_enabled` option in your config file. It applies to all HTTP virtual hosts. ## Compatibility The module use a new API in Prosody 0.10 and will not work with older versions. ## Details By Kim Alvefur \<zash@zash.se\>