prosody-modules
d67980d9e12d
mod_http_oauth2/mod_http_oauth2.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody-modules

Comparison

mod_http_oauth2/mod_http_oauth2.lua @ 5669:d67980d9e12d

mod_http_oauth2: Apply refresh token ttl to refresh token instead of grant The intent in 59d5fc50f602 was for refresh tokens to extend the lifetime of the grant, but the refresh token ttl was applied to the grant and mod_tokenauth does not change it, leading to the grant expiring regardless of refresh token usage. This makes grant lifetimes unlimited, which seems to be standard practice in the wild.
author Kim Alvefur <zash@zash.se>
date Mon, 11 Sep 2023 10:48:31 +0200
parent 5666:73c3d5bfce3e
child 5688:bbde136a4c29
comparison
equal deleted inserted replaced
5668:f16edebb1305 5669:d67980d9e12d
270 end 270 end
271 271
272 local grant = refresh_token_info and refresh_token_info.grant; 272 local grant = refresh_token_info and refresh_token_info.grant;
273 if not grant then 273 if not grant then
274 -- No existing grant, create one 274 -- No existing grant, create one
275 grant = tokens.create_grant(token_jid, token_jid, default_refresh_ttl, token_data); 275 grant = tokens.create_grant(token_jid, token_jid, nil, token_data);
276 end 276 end
277 277
278 if refresh_token_info then 278 if refresh_token_info then
279 -- out with the old refresh tokens 279 -- out with the old refresh tokens
280 local ok, err = tokens.revoke_token(refresh_token_info.token); 280 local ok, err = tokens.revoke_token(refresh_token_info.token);
282 module:log("error", "Could not revoke refresh token: %s", err); 282 module:log("error", "Could not revoke refresh token: %s", err);
283 return 500; 283 return 500;
284 end 284 end
285 end 285 end
286 -- in with the new refresh token 286 -- in with the new refresh token
287 local refresh_token = refresh_token_info ~= false and tokens.create_token(token_jid, grant.id, nil, nil, "oauth2-refresh"); 287 local refresh_token = refresh_token_info ~= false and tokens.create_token(token_jid, grant.id, nil, default_refresh_ttl, "oauth2-refresh");
288 288
289 if role == "xmpp" then 289 if role == "xmpp" then
290 -- Special scope meaning the users default role. 290 -- Special scope meaning the users default role.
291 local user_default_role = usermanager.get_user_role(jid.node(token_jid), module.host); 291 local user_default_role = usermanager.get_user_role(jid.node(token_jid), module.host);
292 role = user_default_role and user_default_role.name; 292 role = user_default_role and user_default_role.name;