# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1678118007 -3600
# Node ID d5492bc861f67d5354e415b7fca16d785c92ad71
# Parent  dc0f502c12f107f1b6a2140ed04f977cff69a6fe
mod_http_oauth2: Remove authorization codes after use

RFC 6749 section 4.1.2 says:
> The client MUST NOT use the authorization code more than once.

Thus we clear it from the cache after use.

diff -r dc0f502c12f1 -r d5492bc861f6 mod_http_oauth2/mod_http_oauth2.lua
--- a/mod_http_oauth2/mod_http_oauth2.lua	Mon Mar 06 16:49:43 2023 +0100
+++ b/mod_http_oauth2/mod_http_oauth2.lua	Mon Mar 06 16:53:27 2023 +0100
@@ -265,6 +265,9 @@
 	end
 	local code, err = codes:get(params.client_id .. "#" .. params.code);
 	if err then error(err); end
+	-- MUST NOT use the authorization code more than once, so remove it to
+	-- prevent a second attempted use
+	codes:set(params.client_id .. "#" .. params.code, nil);
 	if not code or type(code) ~= "table" or code_expired(code) then
 		module:log("debug", "authorization_code invalid or expired: %q", code);
 		return oauth_error("invalid_client", "incorrect credentials");