prosody-modules: mod_http_oauth2/mod_http

comparison mod_http_oauth2/mod_http_oauth2.lua @ 6280:6ea80b73d8f2

mod_http_oauth2: Only require redirect URIs when using grant types that need it In the Device flow, no redirect URI is used because the client instead receives responses by polling. It is therefore unnecessary to enforce a requirement that these include redirect URI(s).

author	Kim Alvefur <zash@zash.se>
date	Thu, 03 Jul 2025 15:42:42 +0200
parents	5dc4ec836ce2
children	17d9533f7596

comparison

equal deleted inserted replaced

-:5dc4ec836ce2
+:6ea80b73d8f2
 	end
 	-- else, not a valid loopback uri
 end
 local function get_redirect_uri(client, query_redirect_uri) -- record client, string : string
-	if not query_redirect_uri then
+	if query_redirect_uri == device_uri and client.grant_types then
+		if array_contains(client.grant_types, device_uri) then
+			return query_redirect_uri;
+		end
+		-- Tried to use device authorization flow without registering it.
+		return;
+	elseif not query_redirect_uri and client.redirect_uris then
 		if #client.redirect_uris ~= 1 then
 			-- Client registered multiple URIs, it needs specify which one to use
 			return;
 		end
 		-- When only a single URI is registered, that's the default
 		return client.redirect_uris[1];
-	end
-	if query_redirect_uri == device_uri and client.grant_types then
-		for _, grant_type in ipairs(client.grant_types) do
-			if grant_type == device_uri then
-				return query_redirect_uri;
-			end
-		end
-		-- Tried to use device authorization flow without registering it.
-		return;
 	end
 	-- Verify the client-provided URI matches one previously registered
 	for _, redirect_uri in ipairs(client.redirect_uris) do
 		if query_redirect_uri == redirect_uri then
 			return redirect_uri
 	type = "object";
 	required = {
 		-- These are shown to users in the template
 		"client_name";
 		"client_uri";
-		-- We need at least one redirect URI for things to work
-		"redirect_uris";
 	};
 	properties = {
 		redirect_uris = {
 			title = "List of Redirect URIs";
 			type = "array";
 				examples = {
 					"https://app.example.com/redirect";
 					"http://localhost:8080/redirect";
 					"com.example.app:/redirect";
 					oob_uri;
-					device_uri;
 				};
+				["not"] = {
+					const = device_uri;
+				}
 			};
 		};
 		token_endpoint_auth_method = {
 			title = "Token Endpoint Authentication Method";
 			description = "Authentication method the client intends to use. Recommended is `client_secret_basic`. \z
 	local client_uri = strict_url_parse(client_metadata.client_uri);
 	if not client_uri or client_uri.scheme ~= "https" or not client_uri.host or loopbacks:contains(client_uri.host) then
 		return nil, oauth_error("invalid_client_metadata", "Missing, invalid or insecure client_uri");
 	end
-	if not client_metadata.application_type and redirect_uri_allowed(client_metadata.redirect_uris[1], client_uri, "native") then
+	if not client_metadata.application_type then
-		client_metadata.application_type = "native";
+		if client_metadata.redirect_uris and redirect_uri_allowed(client_metadata.redirect_uris[1], client_uri, "native") then
-		-- else defaults to "web"
+			client_metadata.application_type = "native";
+		elseif array_contains(client_metadata.grant_types, device_uri) then
+			client_metadata.application_type = "native";
+		end
 	end
 	-- Fill in default values
 	for propname, propspec in pairs(registration_schema.properties) do
 		if client_metadata[propname] == nil and type(propspec) == "table" and propspec.default ~= nil then
 		if not registration_schema.properties[propname] then
 			client_metadata[propname] = nil;
 		end
 	end
-	for _, redirect_uri in ipairs(client_metadata.redirect_uris) do
+	if client_metadata.redirect_uris then
-		if not redirect_uri_allowed(redirect_uri, client_uri, client_metadata.application_type) then
+		for _, redirect_uri in ipairs(client_metadata.redirect_uris) do
-			return nil, oauth_error("invalid_redirect_uri", "Invalid, insecure or inappropriate redirect URI.");
+			if not redirect_uri_allowed(redirect_uri, client_uri, client_metadata.application_type) then
+				return nil, oauth_error("invalid_redirect_uri", "Invalid, insecure or inappropriate redirect URI.");
+			end
 		end
 	end
 	for field, prop_schema in pairs(registration_schema.properties) do
 		if field ~= "client_uri" and prop_schema.format == "uri" and client_metadata[field] then
 	if not (grant_types - allowed_grant_type_handlers):empty() then
 		return nil, oauth_error("invalid_client_metadata", "Disallowed 'grant_types' specified");
 	elseif not (response_types - allowed_response_type_handlers):empty() then
 		return nil, oauth_error("invalid_client_metadata", "Disallowed 'response_types' specified");
+	end
+	if not client_metadata.redirect_uris then
+		if grant_types:contains("authorization_code") then
+			return nil, oauth_error("invalid_client_metadata", "The 'authorization_code' grant requires 'redirect_uris' to be present.");
+		elseif grant_types:contains("implicit") then
+			return nil, oauth_error("invalid_client_metadata", "The 'implicit' grant requires 'redirect_uris' to be present.");
+		end
 	end
 	if grant_types:contains("authorization_code") and not response_types:contains("code") then
 		return nil, oauth_error("invalid_client_metadata", "Inconsistency between 'grant_types' and 'response_types'");
 	elseif grant_types:contains("implicit") and not response_types:contains("token") then

Mercurial > prosody-modules

comparison mod_http_oauth2/mod_http_oauth2.lua @ 6280:6ea80b73d8f2