Mercurial > prosody-modules
comparison mod_http_oauth2/mod_http_oauth2.lua @ 5404:1087f697c3f3
mod_http_oauth2: Strip unknown extra fields from client registration
We shouldn't sign things we don't understand!
RFC 7591 section-2 states:
> The authorization server MUST ignore any client metadata sent by the
> client that it does not understand (for instance, by silently removing
> unknown metadata from the client's registration record during
> processing).
Prevents grandfathering in of unvalidated data that might become used
later, especially since the 'additionalProperties' schema keyword was
removed in 698fef74ce53
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Tue, 02 May 2023 16:23:40 +0200 |
| parents | c574aaaa4d57 |
| children | c7a5caad28ef |
comparison
equal
deleted
inserted
replaced
| 5403:c574aaaa4d57 | 5404:1087f697c3f3 |
|---|---|
| 770 return nil, oauth_error("invalid_client_metadata", "Invalid, insecure or inappropriate informative URI"); | 770 return nil, oauth_error("invalid_client_metadata", "Invalid, insecure or inappropriate informative URI"); |
| 771 end | 771 end |
| 772 end | 772 end |
| 773 end | 773 end |
| 774 | 774 |
| 775 -- Localized URIs should be secure too | |
| 776 for k, v in pairs(client_metadata) do | 775 for k, v in pairs(client_metadata) do |
| 777 if k:find"_uri#" then | 776 local base_k = k:match"^([^#]+)#" or k; |
| 777 if not registration_schema.properties[base_k] or k:find"^client_uri#" then | |
| 778 -- Ignore and strip unknown extra properties | |
| 779 client_metadata[k] = nil; | |
| 780 elseif k:find"_uri#" then | |
| 781 -- Localized URIs should be secure too | |
| 778 if not redirect_uri_allowed(v, client_uri, "web") then | 782 if not redirect_uri_allowed(v, client_uri, "web") then |
| 779 return nil, oauth_error("invalid_client_metadata", "Invalid, insecure or inappropriate informative URI"); | 783 return nil, oauth_error("invalid_client_metadata", "Invalid, insecure or inappropriate informative URI"); |
| 780 end | 784 end |
| 781 end | 785 end |
| 782 end | 786 end |