Function validateAuth0Domain

packages/server/src/enterprise/sso/Auth0SSO.ts:13–37

(domain: string)

const PROVIDER_NAME_AUTH0_SSO = 'Auth0 SSO'

function validateAuth0Domain(domain: string): string | null {
    if (!domain || typeof domain !== 'string') {
        return null
    }

    const trimmed = domain.trim()

    // Reject characters that could introduce scheme, port, path, or query
    if (/[/\\?#:]/.test(trimmed)) {
        return null
    }

    // Basic hostname validation
    const hostnameRegex = /^(?=.{1,253}$)([a-zA-Z0-9-]{1,63}\.)+[a-zA-Z]{2,63}$/
    if (!hostnameRegex.test(trimmed)) {
        return null
    }

    // Restrict to Auth0 domains
    if (!trimmed.toLowerCase().endsWith('.auth0.com')) {
        return null
    }

    return trimmed
}

class Auth0SSO extends SSOBase {
    static LOGIN_URI = '/api/v1/auth0/login'