Mercurial > prosody-modules
view mod_auth_oauthbearer/README.markdown @ 5682:527c747711f3
mod_http_oauth2: Limit revocation to clients own tokens in strict mode
RFC 7009 section 2.1 states:
> The authorization server first validates the client credentials (in
> case of a confidential client) and then verifies whether the token was
> issued to the client making the revocation request. If this
> validation fails, the request is refused and the client is informed of
> the error by the authorization server as described below.
The first part was already covered (in strict mode). This adds the later
part using the hash of client_id recorded in 0860497152af
It still seems weird to me that revoking a leaked token should not be
allowed whoever might have discovered it, as that seems the responsible
thing to do.
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Sun, 29 Oct 2023 11:30:49 +0100 |
| parents | 1a1affd22f74 |
| children |
line wrap: on
line source
--- labels: - 'Type-Auth' summary: OAuth authentication ... Introduction ============ This is an authentication module for the SASL OAUTHBEARER mechanism, as provided by `mod_sasl_oauthbearer`. You can use this to log in via OAuth, for example if you want your user's to log in with Github, Twitter, Reddit etc. The XMPP client needs get an OAuth token from the provider (e.g. Github) and send that to Prosody. This module will then verify that token by calling the `oauth_url` you've configured. Configuration ============= Per VirtualHost, you'll need to supply your OAuth client Id, secret and the URL which Prosody must call in order to verify the OAuth token it receives from the XMPP client. For example, for Github: oauth_client_id = "13f8e9cc8928b3409822" oauth_client_secret = "983161fd3ah608ea7ef35382668aad1927463978" oauth_url = "https://api.github.com/applications/{{oauth_client_id}}/tokens/{{password}}"; authentication = "oauthbearer"