Function GetAuthServerMeta

oauthex/auth_meta.go:133–163

GetAuthServerMeta issues a GET request to retrieve authorization server metadata from an OAuth authorization server with the given metadataURL. It follows [RFC 8414]: - The metadataURL must use HTTPS or be a local address. - The Issuer field is checked against metadataURL.Issuer. It also verifies

(ctx context.Context, metadataURL, issuer string, c *http.Client)

//
// [RFC 8414]: https://tools.ietf.org/html/rfc8414
func GetAuthServerMeta(ctx context.Context, metadataURL, issuer string, c *http.Client) (*AuthServerMeta, error) {
	// Only allow HTTP for local addresses (testing or development purposes).
	if err := checkHTTPSOrLoopback(metadataURL); err != nil {
		return nil, fmt.Errorf("metadataURL: %v", err)
	}
	asm, err := getJSON[AuthServerMeta](ctx, c, metadataURL, 1<<20)
	if err != nil {
		var httpErr *httpStatusError
		if errors.As(err, &httpErr) {
			if 400 <= httpErr.StatusCode && httpErr.StatusCode < 500 {
				return nil, nil
			}
		}
		return nil, fmt.Errorf("%v", err) // Do not expose error types.
	}
	if asm.Issuer != issuer {
		// Validate the Issuer field (see RFC 8414, section 3.3).
		return nil, fmt.Errorf("metadata issuer %q does not match issuer URL %q", asm.Issuer, issuer)
	}

	if len(asm.CodeChallengeMethodsSupported) == 0 {
		return nil, fmt.Errorf("authorization server at %s does not implement PKCE", issuer)
	}

	// Validate endpoint URLs to prevent XSS attacks (see #526).
	if err := validateAuthServerMetaURLs(asm); err != nil {
		return nil, err
	}

	return asm, nil
}

// validateAuthServerMetaURLs validates all URL fields in AuthServerMeta
// to ensure they don't use dangerous schemes that could enable XSS attacks.