| 240 | } |
| 241 | |
| 242 | func validateBaseURL(base string) error { |
| 243 | u, err := url.Parse(base) |
| 244 | if err != nil { |
| 245 | return apierr.ErrUsage(fmt.Sprintf("invalid base URL %q: %v", base, err)) |
| 246 | } |
| 247 | if u.Scheme == "" || u.Host == "" { |
| 248 | return apierr.ErrUsage(fmt.Sprintf("base URL must be an absolute URL with scheme and host (got %q)", base)) |
| 249 | } |
| 250 | // Enforce HTTPS for non-localhost |
| 251 | host := u.Hostname() |
| 252 | if u.Scheme != "https" && host != "localhost" && host != "127.0.0.1" && host != "::1" && !strings.HasSuffix(host, ".localhost") { |
| 253 | return apierr.ErrUsage(fmt.Sprintf("base URL must use HTTPS (got %q)", base)) |
| 254 | } |
| 255 | return nil |
| 256 | } |