Software /
code /
prosody-modules
File
mod_pubsub_eventsource/mod_pubsub_eventsource.lua @ 5705:527c747711f3
mod_http_oauth2: Limit revocation to clients own tokens in strict mode
RFC 7009 section 2.1 states:
> The authorization server first validates the client credentials (in
> case of a confidential client) and then verifies whether the token was
> issued to the client making the revocation request. If this
> validation fails, the request is refused and the client is informed of
> the error by the authorization server as described below.
The first part was already covered (in strict mode). This adds the later
part using the hash of client_id recorded in 0860497152af
It still seems weird to me that revoking a leaked token should not be
allowed whoever might have discovered it, as that seems the responsible
thing to do.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sun, 29 Oct 2023 11:30:49 +0100 |
parent | 4508:0329cf8cdecb |
line wrap: on
line source
module:depends("http"); module:depends("pubsub"); local streams = {}; local service = hosts[module.host].modules.pubsub.service; function client_closed(response) local node = response._eventsource_node; module:log("debug", "Destroying client for %q", node); streams[node][response] = nil; if next(streams[node]) == nil then streams[node] = nil; end end function serve_stream(event, node) module:log("debug", "Client subscribed to: %s", node); local response = event.response; response.on_destroy = client_closed; response._eventsource_node = node; response.conn:write(table.concat({ "HTTP/1.1 200 OK"; "Content-Type: text/event-stream"; "Access-Control-Allow-Origin: *"; "Access-Control-Allow-Methods: GET"; "Access-Control-Max-Age: 7200"; ""; ""; }, "\r\n")); local clientlist = streams[node]; if not clientlist then clientlist = {}; streams[node] = clientlist; end clientlist[response] = response.conn; return true; end function handle_update(event) module:log("debug", "Item published: %q", event.node); local node = event.node; local clientlist = streams[node]; local item = event.item; if (item.name == "json" and item.attr.xmlns == "urn:xmpp:json:0") or (item.name == "data" and item.attr.xmlns == "https://prosody.im/protocol/data") then item = item[1]; end local data = "data: "..tostring(item):gsub("\n", "\ndata: ").."\n\n"; if not clientlist then module:log("debug", "No clients for %q", node); return; end for response, conn in pairs(clientlist) do conn:write(data); end end module:provides("http", { name = "eventsource"; route = { ["GET /*"] = serve_stream; }; }); module:hook_object_event(service.events, "item-published", handle_update);