# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1683810644 -7200
# Node ID 74fdf4a7cca19a3dba05e341e62c6e726e63c19f
# Parent  0c7abc81c243d40109f894d52d643ba806e2ad7c
mod_http_oauth2: Fix unintentional persistence

diff -r 0c7abc81c243 -r 74fdf4a7cca1 mod_http_oauth2/mod_http_oauth2.lua
--- a/mod_http_oauth2/mod_http_oauth2.lua	Wed May 10 19:49:40 2023 +0200
+++ b/mod_http_oauth2/mod_http_oauth2.lua	Thu May 11 15:10:44 2023 +0200
@@ -205,6 +205,7 @@
 	else
 		-- Grant exists, reuse existing refresh token
 		refresh_token = refresh_token_info.token;
+		refresh_token_info.token = nil; -- Prevent persistence of *secret* token
 
 		refresh_token_info.grant = nil; -- Prevent reference loop
 	end