File

mod_register_web/templates/recaptcha.html @ 5705:527c747711f3

mod_http_oauth2: Limit revocation to clients own tokens in strict mode RFC 7009 section 2.1 states: > The authorization server first validates the client credentials (in > case of a confidential client) and then verifies whether the token was > issued to the client making the revocation request. If this > validation fails, the request is refused and the client is informed of > the error by the authorization server as described below. The first part was already covered (in strict mode). This adds the later part using the hash of client_id recorded in 0860497152af It still seems weird to me that revoking a leaked token should not be allowed whoever might have discovered it, as that seems the responsible thing to do.
author Kim Alvefur <zash@zash.se>
date Sun, 29 Oct 2023 11:30:49 +0100
parent 1778:32604bf33a4c
line wrap: on
line source

<tr>
  <td colspan="2">
    <script src="https://www.google.com/recaptcha/api.js" async defer></script>
    <div class="g-recaptcha" data-sitekey="{recaptcha_public_key}"></div>
    <noscript>
      <div style="width: 302px; height: 352px;">
        <div style="width: 302px; height: 352px; position: relative;">
          <div style="width: 302px; height: 352px; position: absolute;">
            <iframe src="https://www.google.com/recaptcha/api/fallback?k={recaptcha_public_key}"
                    frameborder="0" scrolling="no"
                    style="width: 302px; height:352px; border-style: none;">
            </iframe>
          </div>
          <div style="width: 250px; height: 80px; position: absolute; border-style: none;
                      bottom: 21px; left: 25px; margin: 0px; padding: 0px; right: 25px;">
            <textarea id="g-recaptcha-response" name="g-recaptcha-response"
                      class="g-recaptcha-response"
                      style="width: 250px; height: 80px; border: 1px solid #c1c1c1;
                             margin: 0px; padding: 0px; resize: none;" value="">
            </textarea>
          </div>
        </div>
      </div>
    </noscript>
  </td>
</tr>