Software /
code /
prosody-modules
File
mod_auth_custom_http/mod_auth_custom_http.lua @ 5512:1fbc8718bed6
mod_http_oauth2: Bind refresh tokens to client
Prevent one OAuth client from using the refresh tokens issued to another
client as required by RFC 6819 section 5.2.2.2
See also draft-ietf-oauth-security-topics-22 section 2.2.2
Thanks to OAuch for pointing out this issue
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Fri, 02 Jun 2023 10:40:48 +0200 |
parent | 3989:32d7f05e062f |
line wrap: on
line source
-- Prosody IM -- Copyright (C) 2008-2010 Waqas Hussain -- -- This project is MIT/X11 licensed. Please see the -- COPYING file in the source package for more information. -- local new_sasl = require "util.sasl".new; local json = require "util.json"; prosody.unlock_globals(); local http = require "socket.http"; prosody.lock_globals(); local options = module:get_option("auth_custom_http"); local post_url = options and options.post_url; assert(post_url, "No HTTP POST URL provided"); local provider = {}; function provider.test_password(username, password) return nil, "Not supported" end function provider.get_password(username) return nil, "Not supported" end function provider.set_password(username, password) return nil, "Not supported" end function provider.user_exists(username) return true; end function provider.create_user(username, password) return nil, "Not supported" end function provider.delete_user(username) return nil, "Not supported" end function provider.get_sasl_handler() local getpass_authentication_profile = { plain_test = function(sasl, username, password, realm) local postdata = json.encode({ username = username, password = password }); local result = http.request(post_url, postdata); return result == "true", true; end, }; return new_sasl(module.host, getpass_authentication_profile); end module:provides("auth", provider);