Function validateCLICallbackURL

internal/auth/auth.go:167–195

(raw string)

}

func validateCLICallbackURL(raw string) (*url.URL, error) {
	if raw == "" {
		return nil, fmt.Errorf("cli callback URL required")
	}
	u, err := url.Parse(raw)
	if err != nil {
		return nil, fmt.Errorf("invalid cli callback URL: %w", err)
	}
	if u.Scheme != "http" {
		return nil, fmt.Errorf("cli callback URL must use http")
	}
	if u.Host == "" {
		return nil, fmt.Errorf("cli callback URL must include a host")
	}
	if u.User != nil {
		return nil, fmt.Errorf("cli callback URL must not include user info")
	}
	host := u.Hostname()
	if host == "" {
		return nil, fmt.Errorf("cli callback URL must include a host")
	}
	if host != "localhost" {
		ip := net.ParseIP(host)
		if ip == nil || !ip.IsLoopback() {
			return nil, fmt.Errorf("cli callback URL must use a loopback host")
		}
	}
	return u, nil
}

// OAuthState is encoded into the OAuth state parameter. It carries the CSRF
// nonce and, for CLI-initiated logins, the callback URL and CLI state token.