Changeset

5382:12498c0d705f

mod_http_oauth2: Reorder routes into order they happen in OAuth 2.0 Since I usually start here to remember the order of things, might as well turn it into a mini step by step guide :)
author Kim Alvefur <zash@zash.se>
date Sat, 29 Apr 2023 11:26:04 +0200
parents 5381:32a9817c7516
children 5383:df11a2cbc7b7
files mod_http_oauth2/mod_http_oauth2.lua
diffstat 1 files changed, 15 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/mod_http_oauth2/mod_http_oauth2.lua	Fri Apr 28 13:27:06 2023 +0100
+++ b/mod_http_oauth2/mod_http_oauth2.lua	Sat Apr 29 11:26:04 2023 +0200
@@ -833,14 +833,26 @@
 module:depends("http");
 module:provides("http", {
 	route = {
-		-- User-facing login and consent view
+		-- OAuth 2.0 in 5 simple steps!
+		-- This is the normal 'authorization_code' flow.
+
+		-- Step 1. Create OAuth client
+		["POST /register"] = handle_register_request;
+
+		-- Step 2. User-facing login and consent view
 		["GET /authorize"] = handle_authorization_request;
 		["POST /authorize"] = handle_authorization_request;
 
-		-- Create OAuth client
-		["POST /register"] = handle_register_request;
+		-- Step 3. User is redirected to the 'redirect_uri' along with an
+		-- authorization code.  In the insecure 'implicit' flow, the access token
+		-- is delivered here.
 
+		-- Step 4. Retrieve access token using the code.
 		["POST /token"] = handle_token_grant;
+
+		-- Step 4 is later repeated using the refresh token to get new access tokens.
+
+		-- Step 5. Revoke token (access or refresh)
 		["POST /revoke"] = handle_revocation_request;
 
 		-- OpenID