Function getOAuth2AllowedDomains

packages/server/src/utils/oauth2Security.ts:20–27

()

 * @returns Array of lowercase domain strings that OAuth2 URLs are permitted to contact
 */
export function getOAuth2AllowedDomains(): string[] {
    const securityCheckEnabled = process.env.OAUTH2_SECURITY_CHECK !== 'false'
    const customDomains = getCustomDomains()
    if (securityCheckEnabled) {
        return [...new Set([...DEFAULT_ALLOWED_OAUTH2_DOMAINS, ...customDomains])]
    }
    return customDomains
}

/**
 * Validates an OAuth2 URL against the allowed domain list.