Mercurial > prosody-modules
view mod_atom/README.markdown @ 5616:59d5fc50f602
mod_http_oauth2: Implement refresh token rotation
Makes refresh tokens one-time-use, handing out a new refresh token with
each access token. Thus if a refresh token is stolen and used by an
attacker, the next time the legitimate client tries to use the previous
refresh token, it will not work and the attack will be noticed. If the
attacker does not use the refresh token, it becomes invalid after the
legitimate client uses it.
This behavior is recommended by draft-ietf-oauth-security-topics
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Sun, 23 Jul 2023 02:56:08 +0200 |
| parents | f478e325529e |
| children |
line wrap: on
line source
# Introduction This module exposes users [microblogging][xep277] on Prosodys built-in HTTP server. # Usage With default HTTP settings, the microblog of `user@example.com` would be seen at `https://example.com:5281/atom/user`. # Configuration The module itself has no options. However it uses the access control mechanisms in PubSub, so users must reconfigure their microblogging node to allow access, by setting `access_model` to `open`. E.g. Gajim has UI for this, look for "Personal Events" → "Configure services".