Mercurial > prosody-modules
view mod_discoitems/mod_discoitems.lua @ 5682:527c747711f3
mod_http_oauth2: Limit revocation to clients own tokens in strict mode
RFC 7009 section 2.1 states:
> The authorization server first validates the client credentials (in
> case of a confidential client) and then verifies whether the token was
> issued to the client making the revocation request. If this
> validation fails, the request is refused and the client is informed of
> the error by the authorization server as described below.
The first part was already covered (in strict mode). This adds the later
part using the hash of client_id recorded in 0860497152af
It still seems weird to me that revoking a leaked token should not be
allowed whoever might have discovered it, as that seems the responsible
thing to do.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sun, 29 Oct 2023 11:30:49 +0100 |
parents | ae91c98b7e4c |
children |
line wrap: on
line source
-- mod_discoitems.lua -- -- In the config, you can add: -- -- disco_items = { -- {"proxy.eu.jabber.org", "Jabber.org SOCKS5 service"}; -- {"conference.jabber.org", "The Jabber.org MUC"}; -- }; -- local st = require "util.stanza"; local result_query = st.stanza("query", {xmlns="http://jabber.org/protocol/disco#items"}); for _, item in ipairs(module:get_option("disco_items") or {}) do result_query:tag("item", {jid=item[1], name=item[2]}):up(); end module:hook('iq/host/http://jabber.org/protocol/disco#items:query', function(event) local stanza = event.stanza; local query = stanza.tags[1]; if stanza.attr.type == 'get' and not query.attr.node then event.origin.send(st.reply(stanza):add_child(result_query)); return true; end end, 100);