Comparison

mod_http_oauth2: Add some words about supported flows and defaults

comparison

equal deleted inserted replaced

-:67448e677706
+:ef1ae6390742
 '
 ```
 ### Supported flows
+-   Authorization Code grant, optionally with Proof Key for Code Exchange
+-   Resource owner password grant
+-   Implicit flow *(disabled by default)*
+-   Refresh Token grants
 Various flows can be disabled and enabled with
 `allowed_oauth2_grant_types` and `allowed_oauth2_response_types`:
 ```lua
+-- These examples reflect the defaults
 allowed_oauth2_grant_types = {
 	"authorization_code"; -- authorization code grant
 	"password"; -- resource owner password grant
 }
 	"code"; -- authorization code flow
 -- "token"; -- implicit flow disabled by default
 }
 ```
-The [Proof Key for Code Exchange][RFC 7636] mitigation method can be
+The [Proof Key for Code Exchange][RFC 7636] mitigation method is
-made required:
+optional by default but can be made required:
 ```lua
-oauth2_require_code_challenge = true
+oauth2_require_code_challenge = true -- default is false
 ```
 Further, individual challenge methods can be enabled or disabled:
 ```lua
+-- These reflects the default
 allowed_oauth2_code_challenge_methods = {
 "plain"; -- the insecure one
 "S256";
 }
 ```
 for use by OAuth clients:
 ```lua
 oauth2_terms_url = "https://example.com/terms-of-service.html"
 oauth2_policy_url = "https://example.com/service-policy.pdf"
+-- These are unset by default
 ```
 ## Deployment notes
 ### Access management