mod_http_oauth2: Make allowed locales configurable Explicit > Implicit Instead of allowing anything after #, allow only the explicitly configured locales to be used. Default to empty list because using these is not supported yet. This potentially limits the size of the client_id, which is already quite large. Nothing prevents clients from registering a whole client_id per locale, which would not require translation support on this side.

local base64_encode = require"util.encodings".base64.encode;
local random_bytes = require"util.random".bytes;

local b64url = { ["+"] = "-", ["/"] = "_", ["="] = "" };
local function random_resource()
	return base64_encode(random_bytes(8)):gsub("[+/=]", b64url);
end

module:hook("pre-resource-bind", function (event)
	event.resource = random_resource();
end);