normalizeOrigin extracts hostname:port from a URL or origin string. Standard ports (80/443) and absent ports are omitted so that "https://example.com" and "https://example.com:443" both normalise to "example.com".
(raw string)
| 10 | // Standard ports (80/443) and absent ports are omitted so that |
| 11 | // "https://example.com" and "https://example.com:443" both normalise to "example.com". |
| 12 | func normalizeOrigin(raw string) string { |
| 13 | raw = strings.TrimSpace(raw) |
| 14 | if !strings.HasPrefix(raw, "http://") && !strings.HasPrefix(raw, "https://") { |
| 15 | raw = "https://" + raw |
| 16 | } |
| 17 | u, err := url.Parse(raw) |
| 18 | if err != nil { |
| 19 | return raw |
| 20 | } |
| 21 | host := u.Hostname() |
| 22 | port := u.Port() |
| 23 | if port == "" || port == "443" || port == "80" { |
| 24 | return host |
| 25 | } |
| 26 | return host + ":" + port |
| 27 | } |
| 28 | |
| 29 | // IsValidRedirectURI validates a redirect URI for security-critical flows (password reset, |
| 30 | // magic link, OAuth, etc.). Unlike IsValidOrigin (used for CORS), this function never |
no outgoing calls