Method isAdcpDomain

server/src/http.ts:834–837

(req: express.Request)

  // Helper to check if request is from adcontextprotocol.org (requires redirect to AAO for auth)
  // Session cookies are scoped to agenticadvertising.org, so auth pages on AdCP must redirect
  private isAdcpDomain(req: express.Request): boolean {
    const hostname = req.hostname || '';
    return HTTPServer.ADCP_HOSTNAMES.has(hostname);
  }

  // Validate that a URL points to an allowed AdCP domain (prevents open redirect)
  private static isAllowedAdcpUrl(url: string): boolean {