release 4.1.0

- leverage HTTP status code from oauth2_token_verify
- depend on liboauth2 >= 2.2.0

Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>

Author: zandbelt

ChangeLog

@@ -1,3 +1,8 @@
+01/06/2026
+- leverage HTTP status code from oauth2_token_verify
+- depend on liboauth2 >= 2.2.0
+- release 4.1.0
+
 08/22/2024
 - change LICENSE to Apache 2.0
 - depend on liboauth2 >= 2.0.0

configure.ac

@@ -1,4 +1,4 @@
-AC_INIT([ngx_oauth2_module],[4.0.0],[hans.zandbelt@openidc.com])
+AC_INIT([ngx_oauth2_module],[4.1.0],[hans.zandbelt@openidc.com])
 
 AM_INIT_AUTOMAKE([foreign no-define subdir-objects])
 AC_CONFIG_MACRO_DIRS([m4])
@@ -25,11 +25,11 @@ AM_CONDITIONAL(HAVE_NGINX, [test x"$have_nginx" = "xyes"])
 AC_SUBST(NGINX_CFLAGS)
 AC_SUBST(NGINX_LIBS)
 
-PKG_CHECK_MODULES(OAUTH2, [liboauth2 >= 2.0.0])
+PKG_CHECK_MODULES(OAUTH2, [liboauth2 >= 2.2.0])
 AC_SUBST(OAUTH2_CFLAGS)
 AC_SUBST(OAUTH2_LIBS)
 
-PKG_CHECK_MODULES(OAUTH2_NGINX, [liboauth2_nginx >= 2.0.0])
+PKG_CHECK_MODULES(OAUTH2_NGINX, [liboauth2_nginx >= 2.2.0])
 AC_SUBST(OAUTH2_NGINX_CFLAGS)
 AC_SUBST(OAUTH2_NGINX_LIBS)
 

src/ngx_oauth2_module.c

@@ -228,12 +228,14 @@ static ngx_int_t ngx_oauth2_post_config(ngx_conf_t *cf)
 
 static ngx_int_t ngx_oauth2_handler(ngx_http_request_t *r)
 {
+	bool rc = false;
 	ngx_int_t rv = NGX_DECLINED;
 	oauth2_nginx_request_context_t *ctx = NULL;
 	ngx_oauth2_cfg_t *cfg = NULL;
 	ngx_str_t ngx_source_token;
 	char *source_token = NULL;
 	json_t *json_payload = NULL;
+	oauth2_http_status_code_t status_code = 0;
 
 	if (r != r->main)
 		// do not goto end because ctx->log is not available
@@ -286,9 +288,11 @@ static ngx_int_t ngx_oauth2_handler(ngx_http_request_t *r)
 	oauth2_debug(ctx->log, "enter: source_token=%s, initial_request=%d",
 		     source_token, (r != r->main));
 
-	if (oauth2_token_verify(ctx->log, ctx->request, cfg->verify,
-				source_token, &json_payload) == false) {
-		oauth2_warn(ctx->log, "Token could not be verified.");
+	rc = oauth2_token_verify(ctx->log, ctx->request, cfg->verify,
+				source_token, &json_payload, &status_code);
+
+	if (rc == false) {
+		oauth2_warn(ctx->log, "Token could not be verified [HTTP status code=%d].", (int)status_code);
 		rv = NGX_HTTP_UNAUTHORIZED;
 		goto end;
 	}