http://hg.omfa.de/prosody-modules/ en-us mod_http_oauth2/mod_http_oauth2.lua revision history http://hg.omfa.de/prosody-modules/log/3b69df385f66/mod_http_oauth2/mod_http_oauth2.lua
Otherwise entering passwords in non-normal form might lead to
authentication failures.]]> Kim Alvefur <zash@zash.se> Wed, 08 Apr 2026 23:12:13 +0200 http://hg.omfa.de/prosody-modules/log/ff55e93be449/mod_http_oauth2/mod_http_oauth2.lua
Otherwise authentication may fail if provided a non-normalized username

Introduced in c1b94dd6e53b]]> Kim Alvefur <zash@zash.se> Wed, 08 Apr 2026 23:08:39 +0200 http://hg.omfa.de/prosody-modules/log/7fe484e7b574/mod_http_oauth2/mod_http_oauth2.lua
Would fall back to mod_http_errors]]> Kim Alvefur <zash@zash.se> Wed, 18 Feb 2026 16:35:30 +0100 http://hg.omfa.de/prosody-modules/log/3f0970babd67/mod_http_oauth2/mod_http_oauth2.lua
Leftover from something]]> Kim Alvefur <zash@zash.se> Tue, 15 Jul 2025 21:56:56 +0200 http://hg.omfa.de/prosody-modules/log/c96bd4156664/mod_http_oauth2/mod_http_oauth2.lua Kim Alvefur <zash@zash.se> Tue, 15 Jul 2025 21:55:25 +0200 http://hg.omfa.de/prosody-modules/log/6e80b2cb5fe6/mod_http_oauth2/mod_http_oauth2.lua
This should help the user understand and provide _informed_ consent,
although the texts can certainly be improved. Explaining these scopes is
non-trivial.]]> Kim Alvefur <zash@zash.se> Tue, 15 Jul 2025 16:28:40 +0200 http://hg.omfa.de/prosody-modules/log/9b03238d4e0e/mod_http_oauth2/mod_http_oauth2.lua
OpenID Connect Core 1.0 states that OIDC is only being done if the
"openid" scope is included.

https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.2.1

Less details given out by default is good for privacy and byte count.]]> Kim Alvefur <zash@zash.se> Tue, 15 Jul 2025 01:46:38 +0200 http://hg.omfa.de/prosody-modules/log/578fa5d97daa/mod_http_oauth2/mod_http_oauth2.lua
Since device clients don't need to include redirect_uris, this function
needs to handle that case and not try to index the missing array.]]> Kim Alvefur <zash@zash.se> Thu, 03 Jul 2025 16:18:38 +0200 http://hg.omfa.de/prosody-modules/log/17d9533f7596/mod_http_oauth2/mod_http_oauth2.lua
The implicit flow works without a client_secret since the token is
delivered directly, but all other currently supported grant types
require client to authenticate using credentials, so it makes no sense
to not issue credentials then.]]> Kim Alvefur <zash@zash.se> Thu, 03 Jul 2025 15:45:00 +0200 http://hg.omfa.de/prosody-modules/log/6ea80b73d8f2/mod_http_oauth2/mod_http_oauth2.lua
In the Device flow, no redirect URI is used because the client instead
receives responses by polling. It is therefore unnecessary to enforce a
requirement that these include redirect URI(s).]]> Kim Alvefur <zash@zash.se> Thu, 03 Jul 2025 15:42:42 +0200 http://hg.omfa.de/prosody-modules/log/5dc4ec836ce2/mod_http_oauth2/mod_http_oauth2.lua Kim Alvefur <zash@zash.se> Thu, 03 Jul 2025 15:34:57 +0200 http://hg.omfa.de/prosody-modules/log/4f9b42c53d0f/mod_http_oauth2/mod_http_oauth2.lua
This prevents even issuing a refresh token to a client that has not
registered the corresponding grant type.

The grant type dispatcher also checks before invoking the refresh token
grant type handler.]]> Kim Alvefur <zash@zash.se> Thu, 03 Jul 2025 15:34:42 +0200 http://hg.omfa.de/prosody-modules/log/dfc035ecabb4/mod_http_oauth2/mod_http_oauth2.lua
Since create_client() adds these fields if they are missing, we can
assume that they are present.]]> Kim Alvefur <zash@zash.se> Thu, 03 Jul 2025 12:32:43 +0200 http://hg.omfa.de/prosody-modules/log/e174e12549e1/mod_http_oauth2/mod_http_oauth2.lua
Allows this argument to be optional and prevents an error attempting to
obtain the length of nil.]]> Kim Alvefur <zash@zash.se> Thu, 03 Jul 2025 12:27:32 +0200 http://hg.omfa.de/prosody-modules/log/ebcf612da2b1/mod_http_oauth2/mod_http_oauth2.lua
Pedantic attempted optimization, reducing function calls.

I didn't even measure, only vaguely recall that this is faster in PUC Lua.]]> Kim Alvefur <zash@zash.se> Thu, 03 Jul 2025 12:14:53 +0200 http://hg.omfa.de/prosody-modules/log/63ef69b2f046/mod_http_oauth2/mod_http_oauth2.lua
Per the README, 0.12 is not supported, so we should not need to worry
about this. Plus it is assumed to be present elsewhere and that would
throw errors.]]> Kim Alvefur <zash@zash.se> Wed, 02 Jul 2025 16:15:32 +0200 http://hg.omfa.de/prosody-modules/log/fe797da37174/mod_http_oauth2/mod_http_oauth2.lua
This one does not create two new tables and then throw them away.]]> Kim Alvefur <zash@zash.se> Wed, 02 Jul 2025 15:55:05 +0200 http://hg.omfa.de/prosody-modules/log/8108aec64fb9/mod_http_oauth2/mod_http_oauth2.lua
Refresh tokens are no longer included unless this scope is requested and
granted.

BC: This prevents existing implementations that rely on always getting
the refresh token from continuing.]]> Kim Alvefur <zash@zash.se> Wed, 02 Jul 2025 15:53:02 +0200 http://hg.omfa.de/prosody-modules/log/e1c54de06905/mod_http_oauth2/mod_http_oauth2.lua
If for some reason the `code` was nil, it would have thrown an error
attempting to index it.]]> Kim Alvefur <zash@zash.se> Fri, 13 Jun 2025 21:57:38 +0200 http://hg.omfa.de/prosody-modules/log/aae94f82c56e/mod_http_oauth2/mod_http_oauth2.lua
Previously only a single case was returned to device clients, now all
error conditions that pass trough the error_response() are covered.]]> Kim Alvefur <zash@zash.se> Fri, 13 Jun 2025 21:30:56 +0200 http://hg.omfa.de/prosody-modules/log/28fd42866be9/mod_http_oauth2/mod_http_oauth2.lua
Took a while to recall where this was defined.]]> Kim Alvefur <zash@zash.se> Sat, 07 Jun 2025 22:13:41 +0200 http://hg.omfa.de/prosody-modules/log/7cf1fcac9b94/mod_http_oauth2/mod_http_oauth2.lua
Following the order in which field are described in each specification.
Also fills in `nil` fields that are defined but not used in this module.
Tweaks some values to reflect current behavior.]]> Kim Alvefur <zash@zash.se> Sat, 07 Jun 2025 22:02:18 +0200 http://hg.omfa.de/prosody-modules/log/7e4238d2989c/mod_http_oauth2/mod_http_oauth2.lua
Allows for e.g. audit logging and rate limiting modules to catch login
attempts, successful or otherwise, that come through here.]]> Kim Alvefur <zash@zash.se> Wed, 04 Jun 2025 17:32:19 +0200 http://hg.omfa.de/prosody-modules/log/b7eb7d256939/mod_http_oauth2/mod_http_oauth2.lua
error() or assert() does not get handled correctly]]> Kim Alvefur <zash@zash.se> Tue, 03 Jun 2025 17:20:52 +0200 http://hg.omfa.de/prosody-modules/log/5b269511ade7/mod_http_oauth2/mod_http_oauth2.lua
Better than asserting that at least one allowed grant or response type
is included.]]> Kim Alvefur <zash@zash.se> Tue, 03 Jun 2025 17:04:19 +0200 http://hg.omfa.de/prosody-modules/log/ef81c67e1ae7/mod_http_oauth2/mod_http_oauth2.lua Kim Alvefur <zash@zash.se> Tue, 03 Jun 2025 16:59:07 +0200 http://hg.omfa.de/prosody-modules/log/b460b2a65f0b/mod_http_oauth2/mod_http_oauth2.lua
Missed these in 2505542c6c50]]> Kim Alvefur <zash@zash.se> Tue, 03 Jun 2025 01:11:37 +0200 http://hg.omfa.de/prosody-modules/log/7b3316ac24b3/mod_http_oauth2/mod_http_oauth2.lua
Iterating over an array instead of creating a Set ought to create fewer
short-lived tables. The arrays are usually very short so shouldn't be a
performance issue.

Moves validation earlier as to do less work before discovering that it
can't proceed anyway.]]> Kim Alvefur <zash@zash.se> Mon, 02 Jun 2025 22:21:44 +0200 http://hg.omfa.de/prosody-modules/log/9d88c3d9eea5/mod_http_oauth2/mod_http_oauth2.lua
Thus a client can limit itself to certain grant types.
Not sure if this prevents any attacks, but what was the point of
including this in the registration if it was not going to be enforced?

This became easier to do with client_id being available earlier.]]> Kim Alvefur <zash@zash.se> Mon, 02 Jun 2025 20:55:20 +0200 http://hg.omfa.de/prosody-modules/log/b63202d66238/mod_http_oauth2/mod_http_oauth2.lua Kim Alvefur <zash@zash.se> Sat, 31 May 2025 16:07:29 +0200 http://hg.omfa.de/prosody-modules/log/9014c95c4549/mod_http_oauth2/mod_http_oauth2.lua Kim Alvefur <zash@zash.se> Sat, 31 May 2025 16:07:18 +0200 http://hg.omfa.de/prosody-modules/log/2505542c6c50/mod_http_oauth2/mod_http_oauth2.lua
Since it is always performed by each grant_type_handler, it can now be
done earlier before dispatching to them.

A note on 4f0ed0e3ad5a: Requiring a client in the password grant broke
use without registering a client, e.g. the Snikket Web Portal.]]> Kim Alvefur <zash@zash.se> Sat, 31 May 2025 13:36:39 +0200 http://hg.omfa.de/prosody-modules/log/ab14e7ecb82f/mod_http_oauth2/mod_http_oauth2.lua magicfelix <felix@felix-zauberer.de> Sat, 19 Apr 2025 20:32:37 +0200 http://hg.omfa.de/prosody-modules/log/a931a95e363e/mod_http_oauth2/mod_http_oauth2.lua magicfelix <felix@felix-zauberer.de> Sat, 19 Apr 2025 18:30:57 +0200 http://hg.omfa.de/prosody-modules/log/c1b94dd6e53b/mod_http_oauth2/mod_http_oauth2.lua
For consistency since the other grant types do not accept JIDs

This has been like this from the beginning of this module.

Changing this breaks backwards-compatibility with anything that relied
on the JID as username, but things shouldn't really be using the
password grant anyway as it is insecure.]]> Kim Alvefur <zash@zash.se> Sat, 19 Apr 2025 16:25:24 +0200 http://hg.omfa.de/prosody-modules/log/4f0ed0e3ad5a/mod_http_oauth2/mod_http_oauth2.lua magicfelix <felix@felix-zauberer.de> Sat, 19 Apr 2025 16:42:21 +0200 http://hg.omfa.de/prosody-modules/log/a1a33f0f6f6e/mod_http_oauth2/mod_http_oauth2.lua
More in the order they might be used, related paths together.]]> Kim Alvefur <zash@zash.se> Sun, 16 Mar 2025 21:56:25 +0100 http://hg.omfa.de/prosody-modules/log/277ccafb4826/mod_http_oauth2/mod_http_oauth2.lua
It was checking whether the wrong handler exists. It could have made
sense if there was some dependency between them but there isn't.]]> Kim Alvefur <zash@zash.se> Thu, 31 Oct 2024 21:49:32 +0100 http://hg.omfa.de/prosody-modules/log/7308ec4aaad1/mod_http_oauth2/mod_http_oauth2.lua
Was passing the table instead of the host]]> Kim Alvefur <zash@zash.se> Sat, 07 Sep 2024 15:20:23 +0200 http://hg.omfa.de/prosody-modules/log/538f468f9a65/mod_http_oauth2/mod_http_oauth2.lua Kim Alvefur <zash@zash.se> Sat, 31 Aug 2024 14:46:33 +0200 http://hg.omfa.de/prosody-modules/log/5f8a306c8306/mod_http_oauth2/mod_http_oauth2.lua Kim Alvefur <zash@zash.se> Sat, 31 Aug 2024 13:30:55 +0200 http://hg.omfa.de/prosody-modules/log/e8bf46a7bb27/mod_http_oauth2/mod_http_oauth2.lua
LuaSocket is weird and thinks ports should be strings]]> Kim Alvefur <zash@zash.se> Thu, 29 Aug 2024 18:03:23 +0200 http://hg.omfa.de/prosody-modules/log/97375a78d2b5/mod_http_oauth2/mod_http_oauth2.lua
The LuaSocket parser supports these but they're deprecated without
replacement by RFC 3986

> Use of the format "user:password" in the userinfo field is deprecated

Allowing it in OAuth2 URLs is probably bad from a security perspective.]]> Kim Alvefur <zash@zash.se> Thu, 29 Aug 2024 16:02:46 +0200 http://hg.omfa.de/prosody-modules/log/46394b327d17/mod_http_oauth2/mod_http_oauth2.lua
Prevent error on calling :lower() afterwards]]> Kim Alvefur <zash@zash.se> Mon, 15 Jul 2024 20:02:25 +0200 http://hg.omfa.de/prosody-modules/log/ca3479c67e48/mod_http_oauth2/mod_http_oauth2.lua
According to RFC 9110 section 11
> It uses a case-insensitive token to identify the authentication scheme]]> Kim Alvefur <zash@zash.se> Sun, 14 Jul 2024 17:47:06 +0200 http://hg.omfa.de/prosody-modules/log/761142ee0ff2/mod_http_oauth2/mod_http_oauth2.lua
- Resource owner password grant was disabled by default
- Tokens now include a hash of client_id making it possible to be
reasonable sure that they were issued to a particular client]]> Kim Alvefur <zash@zash.se> Tue, 05 Mar 2024 00:32:00 +0100 http://hg.omfa.de/prosody-modules/log/b109773ce6fe/mod_http_oauth2/mod_http_oauth2.lua
Makes the token shorter. Since iat and auth_time are generated at about
the same time they would only differ by a few microseconds anyway.]]> Kim Alvefur <zash@zash.se> Wed, 24 Jan 2024 17:55:26 +0100 http://hg.omfa.de/prosody-modules/log/c75328aeaba3/mod_http_oauth2/mod_http_oauth2.lua
This is supposed to be normal in OAuth2, not really deserving a warning
log message.]]> Kim Alvefur <zash@zash.se> Sat, 23 Dec 2023 00:06:35 +0100 http://hg.omfa.de/prosody-modules/log/fdf3056021dc/mod_http_oauth2/mod_http_oauth2.lua
Since the oauth error is more like the error condition, a symbolic error
code, not the most human-friendly. Many error cases do have
human-readable error descriptions that should be fine on their own, or
changed to be.

As a fallback, capitalize the error name.]]> Kim Alvefur <zash@zash.se> Sat, 23 Dec 2023 00:01:30 +0100 http://hg.omfa.de/prosody-modules/log/03477980f1a9/mod_http_oauth2/mod_http_oauth2.lua Kim Alvefur <zash@zash.se> Thu, 21 Dec 2023 18:26:42 +0100 http://hg.omfa.de/prosody-modules/log/93d6e9026c1b/mod_http_oauth2/mod_http_oauth2.lua
PKCE does not appear to be used with the Device flow. I have found no
mention of any interaction between those standards. Since no data is
delivered via redirects in these cases, PKCE may not serve any purpose.

This is mostly a problem because we reuse the authorization code to
implement the Device and OOB flows.]]> Kim Alvefur <zash@zash.se> Fri, 15 Dec 2023 12:10:07 +0100 http://hg.omfa.de/prosody-modules/log/72799c330986/mod_http_oauth2/mod_http_oauth2.lua
So many assumptions in so many other modules about auth-success/fail]]> Kim Alvefur <zash@zash.se> Mon, 04 Dec 2023 21:36:35 +0100 http://hg.omfa.de/prosody-modules/log/990c6adc4407/mod_http_oauth2/mod_http_oauth2.lua Kim Alvefur <zash@zash.se> Mon, 04 Dec 2023 21:07:54 +0100 http://hg.omfa.de/prosody-modules/log/a967bb4972c5/mod_http_oauth2/mod_http_oauth2.lua
This used to be caught by luaPattern=https:// in the schema but that's
been removed for some reason]]> Kim Alvefur <zash@zash.se> Sun, 03 Dec 2023 23:51:54 +0100 http://hg.omfa.de/prosody-modules/log/b8a2b3ebe792/mod_http_oauth2/mod_http_oauth2.lua
It's not fun at all to try to register a client and only get back
"failed schema validation", this should help with that.]]> Kim Alvefur <zash@zash.se> Sun, 03 Dec 2023 23:44:18 +0100 http://hg.omfa.de/prosody-modules/log/87920d436cb4/mod_http_oauth2/mod_http_oauth2.lua
Makes life easier for the client when it does not know the full JID,
which might not have the same hostpart as the authorization server URL.]]> Kim Alvefur <zash@zash.se> Sun, 03 Dec 2023 15:07:50 +0100 http://hg.omfa.de/prosody-modules/log/c27eaa7117d6/mod_http_oauth2/mod_http_oauth2.lua
For e.g. mod_audit_auth to use.

A bit hacky because upon review many modules don't seem to handle the
lack of an XMPP session in the event payload.]]> Kim Alvefur <zash@zash.se> Fri, 01 Dec 2023 22:40:41 +0100 http://hg.omfa.de/prosody-modules/log/d563a6b0dfb7/mod_http_oauth2/mod_http_oauth2.lua Kim Alvefur <zash@zash.se> Fri, 01 Dec 2023 21:35:25 +0100 http://hg.omfa.de/prosody-modules/log/426c42c11f89/mod_http_oauth2/mod_http_oauth2.lua
This should be fine since we don't have a lot of clients to be
backwards-compatible with.]]> Kim Alvefur <zash@zash.se> Tue, 14 Nov 2023 23:19:19 +0100 http://hg.omfa.de/prosody-modules/log/8488ebde5739/mod_http_oauth2/mod_http_oauth2.lua
This follows the intent behind the OpenID Connect 'prompt' parameter
when it does not include the 'consent' keyword, that is the client
wishes to skip the consent screen. If the user has already granted the
exact same scopes to the exact same client in the past, then one can
assume that they may grant it again.]]> Kim Alvefur <zash@zash.se> Tue, 14 Nov 2023 23:03:37 +0100