--- a/mod_http_oauth2/mod_http_oauth2.lua Sun Nov 22 01:31:27 2020 +0100
+++ b/mod_http_oauth2/mod_http_oauth2.lua Sun Nov 22 01:32:09 2020 +0100
@@ -1,3 +1,4 @@
+local hashes = require "util.hashes";
local http = require "util.http";
local jid = require "util.jid";
local json = require "util.json";
@@ -90,6 +91,12 @@
}
end
+local pepper = module:get_option_string("oauth2_client_pepper", "");
+
+local function verify_secret(stored, salt, i, secret)
+ return base64.decode(stored) == hashes.pbkdf2_hmac_sha256(secret, salt .. pepper, i);
+end
+
function grant_type_handlers.authorization_code(params)
if not params.client_id then return oauth_error("invalid_request", "missing 'client_id'"); end
if not params.client_secret then return oauth_error("invalid_request", "missing 'client_secret'"); end
@@ -105,7 +112,7 @@
end
local client, err = clients:get(client_owner, client_id);
if err then error(err); end
- if not client or client.client_secret ~= params.client_secret then
+ if not client or not verify_secret(client.secret_hash, client.salt, client.iteration_count, params.client_secret) then
module:log("debug", "client_secret mismatch");
return oauth_error("invalid_client", "incorrect credentials");
end