validateIssuerURL validates that the issuer URL is a valid HTTPS URL.
(issuerURL string)
| 77 | |
| 78 | // validateIssuerURL validates that the issuer URL is a valid HTTPS URL. |
| 79 | func validateIssuerURL(issuerURL string) error { |
| 80 | parsed, err := url.Parse(issuerURL) |
| 81 | if err != nil { |
| 82 | return errors.Wrap(err, "invalid issuer URL") |
| 83 | } |
| 84 | if parsed.Scheme != "https" { |
| 85 | return errors.Errorf("issuer URL must use HTTPS: %s", issuerURL) |
| 86 | } |
| 87 | if parsed.Host == "" { |
| 88 | return errors.Errorf("issuer URL must have a host: %s", issuerURL) |
| 89 | } |
| 90 | // Prevent localhost and private IPs in production (basic SSRF prevention) |
| 91 | host := strings.ToLower(parsed.Hostname()) |
| 92 | if host == "localhost" || strings.HasPrefix(host, "127.") || strings.HasPrefix(host, "10.") || |
| 93 | strings.HasPrefix(host, "192.168.") || strings.HasPrefix(host, "172.") { |
| 94 | return errors.Errorf("issuer URL cannot be a private address: %s", issuerURL) |
| 95 | } |
| 96 | return nil |
| 97 | } |
| 98 | |
| 99 | func fetchOIDCConfig(ctx context.Context, configURL string) (*oidcConfig, error) { |
| 100 | req, err := http.NewRequestWithContext(ctx, http.MethodGet, configURL, nil) |