Mercurial > prosody-modules
view mod_rest/example/app.py @ 5682:527c747711f3
mod_http_oauth2: Limit revocation to clients own tokens in strict mode
RFC 7009 section 2.1 states:
> The authorization server first validates the client credentials (in
> case of a confidential client) and then verifies whether the token was
> issued to the client making the revocation request. If this
> validation fails, the request is refused and the client is informed of
> the error by the authorization server as described below.
The first part was already covered (in strict mode). This adds the later
part using the hash of client_id recorded in 0860497152af
It still seems weird to me that revoking a leaked token should not be
allowed whoever might have discovered it, as that seems the responsible
thing to do.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sun, 29 Oct 2023 11:30:49 +0100 |
parents | f3fbfde9683d |
children |
line wrap: on
line source
from flask import Flask, Response, request, jsonify app = Flask("echobot") @app.route("/api", methods=["OPTIONS"]) def options(): """ Startup check. Return an appropriate Accept header to confirm the data type to use. """ return Response(status=200, headers={"accept": "application/json"}) @app.route("/api", methods=["POST"]) def hello(): """ Example RESTful JSON format stanza handler. """ print(request.data) if request.is_json: data = request.get_json() if "kind" not in data: return Response(status=400) if data["kind"] == "message" and "body" in data: # Reply to a message return jsonify({"body": "Yes this is flask app"}) elif data["kind"] == "iq" and data["type"] == "get": if "disco" in data: # Return supported features return jsonify( { "disco": { "identities": [ { "category": "component", "type": "generic", "name": "Flask app", } ], "features": [ "http://jabber.org/protocol/disco#info", "http://jabber.org/protocol/disco#items", "jabber:iq:version", "urn:xmpp:ping", ], } } ) elif "items" in data: # Disco items return jsonify( {"items": [{"jid": "example.org", "name": "Example Dot Org"}]} ) elif "version" in data: # Version info return jsonify({"version": {"name": "app.py", "version": "0"}}) elif "ping" in data: # Respond to ping return Response(status=204) return Response(status=501) if __name__ == "__main__": app.run()