File

mod_http_oauth2: Limit revocation to clients own tokens in strict mode RFC 7009 section 2.1 states: > The authorization server first validates the client credentials (in > case of a confidential client) and then verifies whether the token was > issued to the client making the revocation request. If this > validation fails, the request is refused and the client is informed of > the error by the authorization server as described below. The first part was already covered (in strict mode). This adds the later part using the hash of client_id recorded in 0860497152af It still seems weird to me that revoking a leaked token should not be allowed whoever might have discovered it, as that seems the responsible thing to do.

module:set_global();


local modulemanager = require "core.modulemanager";

module:provides("http", {
	route = {
		GET = function()
			for host in pairs(prosody.hosts) do
				local mods = modulemanager.get_modules(host);
				for _, mod in pairs(mods) do
					if mod.module.status_type == "error" then
						return { status_code = 500; headers = { content_type = "text/plain" }; body = "HAS ERRORS\n" };
					end
				end
			end

			return { status_code = 200; headers = { content_type = "text/plain" }; body = "OK\n" };
		end;
	};
});