Function GetProtectedResourceMetadata

oauthex/resource_meta.go:124–148

GetProtectedResourceMetadata issues a GET request to retrieve protected resource metadata from a resource server. The metadataURL is typically a URL with a host:port and possibly a path. The resourceURL is the resource URI the metadataURL is for. The following checks are performed: - The metadataURL

(ctx context.Context, metadataURL, resourceURL string, c *http.Client)

//   - The resource field of the resulting metadata must match the resourceURL.
//   - The authorization_servers field of the resulting metadata is checked for dangerous URL schemes.
func GetProtectedResourceMetadata(ctx context.Context, metadataURL, resourceURL string, c *http.Client) (_ *ProtectedResourceMetadata, err error) {
	defer util.Wrapf(&err, "GetProtectedResourceMetadata(%q)", metadataURL)
	// Only allow HTTP for local addresses (testing or development purposes).
	if err := checkHTTPSOrLoopback(metadataURL); err != nil {
		return nil, fmt.Errorf("metadataURL: %v", err)
	}
	prm, err := getJSON[ProtectedResourceMetadata](ctx, c, metadataURL, 1<<20)
	if err != nil {
		return nil, err
	}
	// Validate the Resource field (see RFC 9728, section 3.3).
	if prm.Resource != resourceURL {
		return nil, fmt.Errorf("got metadata resource %q, want %q", prm.Resource, resourceURL)
	}
	// Validate the authorization server URLs to prevent XSS attacks (see #526).
	for i, u := range prm.AuthorizationServers {
		if err := checkURLScheme(u); err != nil {
			return nil, fmt.Errorf("authorization_servers[%d]: %v", i, err)
		}
		if err := checkHTTPSOrLoopback(u); err != nil {
			return nil, fmt.Errorf("authorization_servers[%d]: %v", i, err)
		}
	}
	return prm, nil
}

// ParseWWWAuthenticate parses a WWW-Authenticate header string.
// The header format is defined in RFC 9110, Section 11.6.1, and can contain