You've already forked snikket-web-portal
feabed6565
mod_http_oauth2 in prosody-modules was updated to require client authentication for the password grant, which previously did not need client authentication. This means that the first request we make to Prosody will now register as a client in order to obtain client_id and client_secret. There is no real security gain from this approach (unlike other grant types, the password grant does not do redirects which could be intercepted). In the future, however, some security could be gained by having Prosody restrict the ability to use the password grant to privileged OAuth clients. This would prevent third-party OAuth clients from using the password grant which is not suitable for that purpose.