mod_http_oauth2: Bind refresh tokens to client Prevent one OAuth client from using the refresh tokens issued to another client as required by RFC 6819 section 5.2.2.2 See also draft-ietf-oauth-security-topics-22 section 2.2.2 Thanks to OAuch for pointing out this issue

---
labels:
- 'Stage-Obsolete'
summary: Message Carbons
superseded_by: mod_carbons
...

Since Prosody 0.10, this module is [included in Prosody](https://prosody.im/doc/modules/mod_carbons), you will be redirected there shortly.