Function validateCallbackUrl

apps/sim/lib/core/security/input-validation.ts:1208–1219

(url: string)

 * @returns true if the URL is safe to redirect to
 */
export function validateCallbackUrl(url: string): boolean {
  try {
    if (typeof url !== 'string' || url.length === 0) return false

    const base = typeof window === 'undefined' ? CALLBACK_URL_SERVER_BASE : window.location.origin
    const parsed = new URL(url, base)
    return parsed.origin === base
  } catch (error) {
    logger.error('Error validating callback URL:', { error, url })
    return false
  }
}

const OKTA_DOMAIN_PATTERN =
  /^[a-zA-Z0-9][a-zA-Z0-9-]*\.(okta|okta-gov|okta-emea|oktapreview|trexcloud)\.com$/