(url: string)
| 46 | * required (`OAUTH2_SECURITY_CHECK` enabled) and the URL uses a non-HTTPS protocol |
| 47 | */ |
| 48 | export function validateOAuth2Url(url: string): void { |
| 49 | const securityCheckEnabled = process.env.OAUTH2_SECURITY_CHECK !== 'false' |
| 50 | const allowedDomains = getOAuth2AllowedDomains() |
| 51 | |
| 52 | if (!securityCheckEnabled && allowedDomains.length === 0) return |
| 53 | |
| 54 | const parsed = new URL(url) |
| 55 | |
| 56 | if (securityCheckEnabled && parsed.protocol !== 'https:') { |
| 57 | throw new Error(`OAuth2 URL must use HTTPS: ${url}`) |
| 58 | } |
| 59 | |
| 60 | const hostname = parsed.hostname.toLowerCase() |
| 61 | const isAllowed = allowedDomains.some((domain) => hostname === domain || hostname.endsWith(`.${domain}`)) |
| 62 | if (!isAllowed) { |
| 63 | throw new Error(`OAuth2 URL domain "${hostname}" is not in the allowed list.`) |
| 64 | } |
| 65 | } |
| 66 | |
| 67 | /** |
| 68 | * Extracts only recognised OAuth2 token fields from an arbitrary response object. |
no test coverage detected