view mod_auth_http_async/README.md @ 6281:17d9533f7596

mod_http_oauth2: Reject invalid attempt to register client without credentials The implicit flow works without a client_secret since the token is delivered directly, but all other currently supported grant types require client to authenticate using credentials, so it makes no sense to not issue credentials then.
author Kim Alvefur <zash@zash.se>
date Thu, 03 Jul 2025 15:45:00 +0200
parents fe081789f7b5
children 7b693a5539ad
line wrap: on
line source

---
labels:
- Stage-Alpha
...

Introduction
============

This is an experimental authentication module that does an asynchronous
HTTP call to verify username and password.

Details
=======

When a user attempts to authenticate to Prosody, this module takes the
username and password and does a HTTP GET request with [Basic
authentication][rfc7617] to the configured `http_auth_url`.

Configuration
=============

``` lua
VirtualHost "example.com"
authentication = "http_async"
http_auth_url = "http://example.com/auth"
```

Compatibility
=============

Requires Prosody trunk