# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1686866757 -7200
# Node ID fd3c12c40cd912b4bfce3c6c6e471b3e72078dfb
# Parent  d4a2997deae9f9e7b588465e095e620b47c7a043
mod_http_oauth2: Disable CORS for authorization endpoint

Per recommendation in draft-ietf-oauth-security-topics-23

Hopefully it is enough to return an error status, since mod_http will
add CORS headers from a handler with higher priority, even for OPTIONS.

diff -r d4a2997deae9 -r fd3c12c40cd9 mod_http_oauth2/mod_http_oauth2.lua
--- a/mod_http_oauth2/mod_http_oauth2.lua	Sun Jun 11 14:06:28 2023 +0200
+++ b/mod_http_oauth2/mod_http_oauth2.lua	Fri Jun 16 00:05:57 2023 +0200
@@ -1121,6 +1121,7 @@
 		-- Step 2. User-facing login and consent view
 		["GET /authorize"] = handle_authorization_request;
 		["POST /authorize"] = handle_authorization_request;
+		["OPTIONS /authorize"] = { status_code = 403; body = "" };
 
 		-- Step 3. User is redirected to the 'redirect_uri' along with an
 		-- authorization code.  In the insecure 'implicit' flow, the access token