Module client_metadata_document 

OAuth Client ID Metadata Documents (draft-ietf-oauth-client-id-metadata-document): a client whose client_id is an https URL is registered by fetching the JSON document at that URL.

The URL comes from whoever starts an authorization request, so fetching it must not reach internal services: the host must resolve only to public addresses, the connection is pinned to the checked addresses, redirects are not followed and the response size and time are capped.

Structs

ClientMetadataDocument 🔒

Constants

CACHE_LIFETIME 🔒

The registration is re-fetched when the cached copy is older than this.

FETCH_TIMEOUT 🔒

MAX_DOCUMENT_BYTES 🔒

NEW_DOCUMENTS_PER_USER_PER_HOUR 🔒

Per server process; an agent registers one document, so this only bounds abuse.

REFETCHES_PER_DOCUMENT_PER_HOUR 🔒

Per server process; a document’s host is fetched again at most this often, however many authorize requests name it.

STALE_CACHE_LIFETIME 🔒

A cached copy this old is still used when the document cannot be fetched.

Statics

DOCUMENT_REFETCHES 🔒

NEW_DOCUMENT_FETCHES 🔒

Functions

fetch_and_store 🔒

fetch_and_validate 🔒

find_cached_client

The stored registration for a metadata document client_id, as last fetched, without fetching; None if the document was never fetched.

is_metadata_document_client_id

Whether the client id names a metadata document rather than a registered client.

is_public_address 🔒

is_public_ipv4 🔒

is_public_ipv6 🔒

resolve_client

The client registration for a metadata document client_id, fetched and cached as needed. user_id is the signed-in user the fetch is made for: fetching a document that was never fetched before counts against their hourly quota.

validate_client_id_url 🔒

Checks the client_id URL as the draft requires: https, a host, a path, no fragment, no credentials and no dot segments. Returns the URL and its host.

validate_document 🔒

Redirect URIs are left to the database’s is_valid_oauth_uri, the one rule for every client.