Mercurial > prosody-modules
view misc/systemd/socket-activation.lua @ 5682:527c747711f3
mod_http_oauth2: Limit revocation to clients own tokens in strict mode
RFC 7009 section 2.1 states:
> The authorization server first validates the client credentials (in
> case of a confidential client) and then verifies whether the token was
> issued to the client making the revocation request. If this
> validation fails, the request is refused and the client is informed of
> the error by the authorization server as described below.
The first part was already covered (in strict mode). This adds the later
part using the hash of client_id recorded in 0860497152af
It still seems weird to me that revoking a leaked token should not be
allowed whoever might have discovered it, as that seems the responsible
thing to do.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sun, 29 Oct 2023 11:30:49 +0100 |
parents | 3296a09b4e57 |
children |
line wrap: on
line source
-- Monkeypatch to support socket activation -- -- Requires LuaSocket after "agnostic" changes merged -- -- To enable: -- RunScript "socket-activation.lua" local socket = require"socket"; local tcp_serv_mt = debug.getregistry()["tcp{server}"]; local socket_bind = socket.bind; local SD_LISTEN_FDS_START = 3; local fds = tonumber(os.getenv"LISTEN_FDS") or 0; if fds < SD_LISTEN_FDS_START then return; end local servs = {}; for i = 1, fds do local serv = socket.tcp(); if serv:getfd() >= 0 then return; -- This won't work, we will leak the old FD end debug.setmetatable(serv, tcp_serv_mt); serv:setfd(SD_LISTEN_FDS_START + i - 1); local ip, port = serv:getsockname(); servs [ ip .. ":" .. port ] = serv; end function socket.bind( ip, port, backlog ) local sock = servs [ ip .. ":" .. port ]; if sock then servs [ ip .. ":" .. port ] = nil; return sock; end if next(servs) == nil then -- my work here is done socket.bind = socket_bind; end return socket_bind( ip, port, backlog ); end