# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1775682519 -7200
# Node ID ff55e93be4497652e47ead8341b592d4c8a2502b
# Parent  668b1f0a4dc6ab2079be1f21ce42d1673df2a70c
mod_http_oauth2: Normalize username in password grant

Otherwise authentication may fail if provided a non-normalized username

Introduced in c1b94dd6e53b

diff -r 668b1f0a4dc6 -r ff55e93be449 mod_http_oauth2/mod_http_oauth2.lua
--- a/mod_http_oauth2/mod_http_oauth2.lua	Wed Apr 08 15:56:38 2026 +0200
+++ b/mod_http_oauth2/mod_http_oauth2.lua	Wed Apr 08 23:08:39 2026 +0200
@@ -455,6 +455,10 @@
 		if not request_username then
 			return oauth_error("invalid_request", "missing 'username'");
 		end
+		request_username = encodings.stringprep.nodeprep(request_username);
+		if not request_username then
+			return oauth_error("invalid_request", "invalid 'username'");
+		end
 	end
 
 	local request_password = params.password;