Software /
code /
prosody-modules
Annotate
mod_strict_https/mod_strict_https.lua @ 5418:f2c7bb3af600
mod_http_oauth2: Add role selector to consent page
List includes all roles available to the user, if more than one.
Defaults to either the first role in the scope string or the users
primary role.
Earlier draft listed all roles, but having options that can't be
selected is bad UX and the entire list of all roles on the server could
be long, and perhaps even sensitive.
Allows e.g. picking a role with fewer permissions than what might
otherwise have been selected.
UX wise, doing this with more checkboxes or possibly radio buttons would
have been confusion and/or looked messier.
Fixes the previous situation where unselecting a role would default to
the primary role, which could be more permissions than requested.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Fri, 05 May 2023 01:23:13 +0200 |
parent | 5415:f8797e3284ff |
rev | line source |
---|---|
861
1b34c8e46ffb
mod_strict_https: New module implementing HTTP Strict Transport Security
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
1 -- HTTP Strict Transport Security |
5411
b3158647cb36
mod_strict_https: Update to use modern APIs instead of monkey patching
Kim Alvefur <zash@zash.se>
parents:
863
diff
changeset
|
2 -- https://www.rfc-editor.org/info/rfc6797 |
861
1b34c8e46ffb
mod_strict_https: New module implementing HTTP Strict Transport Security
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
3 |
1b34c8e46ffb
mod_strict_https: New module implementing HTTP Strict Transport Security
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
4 module:set_global(); |
1b34c8e46ffb
mod_strict_https: New module implementing HTTP Strict Transport Security
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
5 |
1b34c8e46ffb
mod_strict_https: New module implementing HTTP Strict Transport Security
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
6 local http_server = require "net.http.server"; |
1b34c8e46ffb
mod_strict_https: New module implementing HTTP Strict Transport Security
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
7 |
863
efa9c1676d1f
mod_strict_https: Correct underscore to hypen in max-age directive
Kim Alvefur <zash@zash.se>
parents:
861
diff
changeset
|
8 local hsts_header = module:get_option_string("hsts_header", "max-age=31556952"); -- This means "Don't even try to access without HTTPS for a year" |
5415
f8797e3284ff
mod_strict_https: Add way to disable redirect
Kim Alvefur <zash@zash.se>
parents:
5411
diff
changeset
|
9 local redirect = module:get_option_boolean("hsts_redirect", true); |
861
1b34c8e46ffb
mod_strict_https: New module implementing HTTP Strict Transport Security
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
10 |
5411
b3158647cb36
mod_strict_https: Update to use modern APIs instead of monkey patching
Kim Alvefur <zash@zash.se>
parents:
863
diff
changeset
|
11 module:wrap_object_event(http_server._events, false, function(handlers, event_name, event_data) |
b3158647cb36
mod_strict_https: Update to use modern APIs instead of monkey patching
Kim Alvefur <zash@zash.se>
parents:
863
diff
changeset
|
12 local request, response = event_data.request, event_data.response; |
b3158647cb36
mod_strict_https: Update to use modern APIs instead of monkey patching
Kim Alvefur <zash@zash.se>
parents:
863
diff
changeset
|
13 if request and response then |
b3158647cb36
mod_strict_https: Update to use modern APIs instead of monkey patching
Kim Alvefur <zash@zash.se>
parents:
863
diff
changeset
|
14 if request.secure then |
b3158647cb36
mod_strict_https: Update to use modern APIs instead of monkey patching
Kim Alvefur <zash@zash.se>
parents:
863
diff
changeset
|
15 response.headers.strict_transport_security = hsts_header; |
5415
f8797e3284ff
mod_strict_https: Add way to disable redirect
Kim Alvefur <zash@zash.se>
parents:
5411
diff
changeset
|
16 elseif redirect then |
5411
b3158647cb36
mod_strict_https: Update to use modern APIs instead of monkey patching
Kim Alvefur <zash@zash.se>
parents:
863
diff
changeset
|
17 -- This won't get the port number right |
b3158647cb36
mod_strict_https: Update to use modern APIs instead of monkey patching
Kim Alvefur <zash@zash.se>
parents:
863
diff
changeset
|
18 response.headers.location = "https://" .. request.host .. request.path .. (request.query and "?" .. request.query or ""); |
861
1b34c8e46ffb
mod_strict_https: New module implementing HTTP Strict Transport Security
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
19 return 301; |
1b34c8e46ffb
mod_strict_https: New module implementing HTTP Strict Transport Security
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
20 end |
1b34c8e46ffb
mod_strict_https: New module implementing HTTP Strict Transport Security
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
21 end |
5411
b3158647cb36
mod_strict_https: Update to use modern APIs instead of monkey patching
Kim Alvefur <zash@zash.se>
parents:
863
diff
changeset
|
22 return handlers(event_name, event_data); |
b3158647cb36
mod_strict_https: Update to use modern APIs instead of monkey patching
Kim Alvefur <zash@zash.se>
parents:
863
diff
changeset
|
23 end); |