mod_http_oauth2: Limit revocation to clients own tokens in strict mode RFC 7009 section 2.1 states: > The authorization server first validates the client credentials (in > case of a confidential client) and then verifies whether the token was > issued to the client making the revocation request. If this > validation fails, the request is refused and the client is informed of > the error by the authorization server as described below. The first part was already covered (in strict mode). This adds the later part using the hash of client_id recorded in 0860497152af It still seems weird to me that revoking a leaked token should not be allowed whoever might have discovered it, as that seems the responsible thing to do.

A module providing a streaming statistics interface like
[mod_statistics] but based on the new [statistics API][doc:statistics]
introduced in Prosody 0.10.

# Usage

To use, enable the built-in statistics like so:

```lua
statistics = "internal"
```

Then, in `modules_enabled`, replace `"statistics"` with
`"statistics_statsman"` and the various `"statistics_<something>"`
with equivalent `"measure_<something>"`.


# Compatibility

  ------- --------------------
  trunk   Does not work [^1]
  0.11    Should work
  0.10    Should work
  ------- --------------------

[^1]: not after
    [5f15ab7c6ae5](https://hg.prosody.im/trunk/rev/5f15ab7c6ae5)