Mercurial > prosody-modules
comparison mod_http_oauth2/mod_http_oauth2.lua @ 5548:fd3c12c40cd9
mod_http_oauth2: Disable CORS for authorization endpoint
Per recommendation in draft-ietf-oauth-security-topics-23
Hopefully it is enough to return an error status, since mod_http will
add CORS headers from a handler with higher priority, even for OPTIONS.
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Fri, 16 Jun 2023 00:05:57 +0200 |
| parents | d4a2997deae9 |
| children | 01a0b67a9afd |
comparison
equal
deleted
inserted
replaced
| 5547:d4a2997deae9 | 5548:fd3c12c40cd9 |
|---|---|
| 1119 ["POST /register"] = handle_register_request; | 1119 ["POST /register"] = handle_register_request; |
| 1120 | 1120 |
| 1121 -- Step 2. User-facing login and consent view | 1121 -- Step 2. User-facing login and consent view |
| 1122 ["GET /authorize"] = handle_authorization_request; | 1122 ["GET /authorize"] = handle_authorization_request; |
| 1123 ["POST /authorize"] = handle_authorization_request; | 1123 ["POST /authorize"] = handle_authorization_request; |
| 1124 ["OPTIONS /authorize"] = { status_code = 403; body = "" }; | |
| 1124 | 1125 |
| 1125 -- Step 3. User is redirected to the 'redirect_uri' along with an | 1126 -- Step 3. User is redirected to the 'redirect_uri' along with an |
| 1126 -- authorization code. In the insecure 'implicit' flow, the access token | 1127 -- authorization code. In the insecure 'implicit' flow, the access token |
| 1127 -- is delivered here. | 1128 -- is delivered here. |
| 1128 | 1129 |