view mod_http_debug/mod_http_debug.lua @ 5682:527c747711f3

mod_http_oauth2: Limit revocation to clients own tokens in strict mode RFC 7009 section 2.1 states: > The authorization server first validates the client credentials (in > case of a confidential client) and then verifies whether the token was > issued to the client making the revocation request. If this > validation fails, the request is refused and the client is informed of > the error by the authorization server as described below. The first part was already covered (in strict mode). This adds the later part using the hash of client_id recorded in 0860497152af It still seems weird to me that revoking a leaked token should not be allowed whoever might have discovered it, as that seems the responsible thing to do.
author Kim Alvefur <zash@zash.se>
date Sun, 29 Oct 2023 11:30:49 +0100
parents b6af4d1ff8c1
children
line wrap: on
line source

local json = require "util.json"

module:depends("http")
local function handle_request(event)
	local request = event.request;
	(request.log or module._log)("debug", "%s -- %s %q HTTP/%s -- %q -- %s", request.ip, request.method, request.url, request.httpversion, request.headers, request.body);
	return {
		status_code = 200;
		headers = { content_type = "application/json" };
		host = module.host;
		body = json.encode {
			body = request.body;
			headers = request.headers;
			httpversion = request.httpversion;
			id = request.id;
			ip = request.ip;
			method = request.method;
			path = request.path;
			secure = request.secure;
			url = request.url;
		};
	}
end

local methods = module:get_option_set("http_debug_methods", { "GET"; "HEAD"; "DELETE"; "OPTIONS"; "PATCH"; "POST"; "PUT" });
local route = {};
for method in methods do
	route[method] = handle_request;
	route[method .. " /*"] = handle_request;
end

module:provides("http", {
	route = route;
})