Mercurial > prosody-modules
view mod_log_auth/mod_log_auth.lua @ 5404:1087f697c3f3
mod_http_oauth2: Strip unknown extra fields from client registration
We shouldn't sign things we don't understand!
RFC 7591 section-2 states:
> The authorization server MUST ignore any client metadata sent by the
> client that it does not understand (for instance, by silently removing
> unknown metadata from the client's registration record during
> processing).
Prevents grandfathering in of unvalidated data that might become used
later, especially since the 'additionalProperties' schema keyword was
removed in 698fef74ce53
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Tue, 02 May 2023 16:23:40 +0200 |
parents | 6d1ec8099315 |
children |
line wrap: on
line source
local mode = module:get_option_string("log_auth_ips", "failure"); assert(({ all = true, failure = true, success = true })[mode], "Unknown log mode: "..tostring(mode).." - valid modes are 'all', 'failure', 'success'"); if mode == "failure" or mode == "all" then module:hook("authentication-failure", function (event) local session = event.session; local username = session.username or session.sasl_handler and session.sasl_handler.username or "?"; session.log("info", "Failed authentication attempt (%s) for user %s@%s from IP: %s", event.condition or "unknown-condition", username, module.host, session.ip or "?"); end); end if mode == "success" or mode == "all" then module:hook("authentication-success", function (event) local session = event.session; session.log("info", "Successful authentication as %s@%s from IP: %s", session.username, module.host, session.ip or "?"); end); end