Comparison

mod_http_oauth2: Make defaults more secure This should be fine since we don't have a lot of clients to be backwards-compatible with.

comparison

equal deleted inserted replaced

-:8488ebde5739
+:426c42c11f89
 -- "token"; -- implicit flow disabled by default
 }
 ```
 The [Proof Key for Code Exchange][RFC 7636] mitigation method is
-optional by default but can be made required:
+required by default but can be made optional:
 ```lua
-oauth2_require_code_challenge = true -- default is false
+oauth2_require_code_challenge = false -- default is true
 ```
 Further, individual challenge methods can be enabled or disabled:
 ```lua
 -- These reflects the default
 allowed_oauth2_code_challenge_methods = {
-"plain"; -- the insecure one
+-- "plain"; -- insecure but backwards-compatible
 "S256";
 }
 ```
 ### Policy documents