Mercurial > prosody-modules
view mod_password_reset/README.markdown @ 5264:d3ebaef1ea7a
mod_http_oauth2: Correctly verify OAuth client credentials on revocation
Makes no sense to validate against username and password here, or using
a token to revoke another token, or itself?
In fact, upon further discussion, why do you need credentials to revoke
a token? If you are not supposed to have the token, revoking it seems
the most responsible thing to do with it, so it should be allowed, while
if you are supposed to have it, you should be allowed to revoke it.
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Tue, 21 Mar 2023 21:57:18 +0100 |
| parents | 660160fe97fa |
| children |
line wrap: on
line source
--- labels: - 'Stage-Alpha' summary: 'Enables users to reset their password via a link' rockspec: build: copy_directories: - password_reset ... Introduction ============ This module allows users to reset their password via a simple link to a web page. Reset links may be generated by an admin through their XMPP client using the ad-hoc command that this module provides. Alternatively other modules may reuse this module to generate links and e.g. send them via email to the user directly. A link is only valid for a single reset, and expires after a duration (24 hours by default). This module depends on Prosody's internal webserver. Compatibility ============= ----- ------- 0.10 Works ----- ------- trunk Works ----- -------