Mercurial > prosody-modules
view mod_tls_policy/README.markdown @ 5616:59d5fc50f602
mod_http_oauth2: Implement refresh token rotation
Makes refresh tokens one-time-use, handing out a new refresh token with
each access token. Thus if a refresh token is stolen and used by an
attacker, the next time the legitimate client tries to use the previous
refresh token, it will not work and the attack will be noticed. If the
attacker does not use the refresh token, it becomes invalid after the
legitimate client uses it.
This behavior is recommended by draft-ietf-oauth-security-topics
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sun, 23 Jul 2023 02:56:08 +0200 |
parents | ad24f8993385 |
children |
line wrap: on
line source
--- summary: Cipher policy enforcement with application level error reporting ... # Introduction This module arose from discussions at the XMPP Summit about enforcing better ciphers in TLS. It may seem attractive to disallow some insecure ciphers or require forward secrecy, but doing this at the TLS level would the user with an unhelpful "Encryption failed" message. This module does this enforcing at the application level, allowing better error messages. # Configuration First, download and add the module to `module_enabled`. Then you can decide on what policy you want to have. Requiring ciphers with forward secrecy is the most simple to set up. ``` lua tls_policy = "FS" -- allow only ciphers that enable forward secrecy ``` A more complicated example: ``` lua tls_policy = { c2s = { encryption = "AES"; -- Require AES (or AESGCM) encryption protocol = "TLSv1.2"; -- and TLSv1.2 bits = 128; -- and at least 128 bits (FIXME: remember what this meant) } s2s = { cipher = "AESGCM"; -- Require AESGCM ciphers protocol = "TLSv1.[12]"; -- and TLSv1.1 or 1.2 authentication = "RSA"; -- with RSA authentication }; } ``` # Compatibility Requires LuaSec 0.5