| 345 | */ |
| 346 | |
| 347 | const checkHttpUrl = ( |
| 348 | value: string, |
| 349 | name: string, |
| 350 | requireHttps: boolean |
| 351 | ): string[] => { |
| 352 | try { |
| 353 | const parsed = new URL(value); |
| 354 | |
| 355 | if (requireHttps) { |
| 356 | return parsed.protocol === "https:" |
| 357 | ? [] |
| 358 | : [ |
| 359 | `${name} must use https:// in production (got "${parsed.protocol}//"). Secure cookies, OAuth callbacks, billing return URLs, and signed email links all require TLS.`, |
| 360 | ]; |
| 361 | } |
| 362 | |
| 363 | const isHttp = parsed.protocol === "http:" || parsed.protocol === "https:"; |
| 364 | |
| 365 | return isHttp ? [] : [`${name} must be an http(s) URL`]; |
| 366 | } catch { |
| 367 | return [`${name} must be a valid URL`]; |
| 368 | } |
| 369 | }; |
| 370 | |
| 371 | const checkUrls = (env: Env): string[] => { |
| 372 | const requireHttps = env.NODE_ENV === "production"; |