Software / code / prosody-modules
Changeset
5646:9aace51c3637
mod_http_oauth2: Bail on invalid or expired device flow state token
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Fri, 04 Aug 2023 01:11:01 +0200 |
| parents | 5645:3a5cf8d80089 |
| children | 5647:ef0a283507c9 |
| files | mod_http_oauth2/mod_http_oauth2.lua |
| diffstat | 1 files changed, 2 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/mod_http_oauth2/mod_http_oauth2.lua Mon Jul 31 07:28:09 2023 +0200 +++ b/mod_http_oauth2/mod_http_oauth2.lua Fri Aug 04 01:11:01 2023 +0200 @@ -400,6 +400,8 @@ if is_device then -- reconstruct the device_code code = b64url(hashes.hmac_sha256(verification_key, device_state.user_code)); + else + return oauth_error("invalid_request"); end end local ok = codes:set("authorization_code:" .. params.client_id .. "#" .. code, {
