File

mod_http_oauth2: Reject URLs with 'userinfo' part (thanks mimi89999) The LuaSocket parser supports these but they're deprecated without replacement by RFC 3986 > Use of the format "user:password" in the userinfo field is deprecated Allowing it in OAuth2 URLs is probably bad from a security perspective.

+
−---
+
−summary: OIDC group membership in UserInfo
+
−labels:
+
−- Stage-Alpha
+
−rockspec:
+
−  dependencies:
+
−  - mod_http_oauth2 >= 200
+
−  - mod_groups_internal
+
−---
+
−
+
−This module exposes [mod_groups_internal] groups to
+
−[OAuth 2.0][mod_http_oauth2] clients via a `groups` scope/claim.