auth: allow passing custom http.Client to AuthorizationCodeHandler (#840)

oauthex/oauth2.go

@@ -17,6 +17,8 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
+
+	"github.com/modelcontextprotocol/go-sdk/internal/util"
 )
 
 type httpStatusError struct {
@@ -78,3 +80,17 @@ func checkURLScheme(u string) error {
 	}
 	return nil
 }
+
+func checkHTTPSOrLoopback(addr string) error {
+	if addr == "" {
+		return nil
+	}
+	u, err := url.Parse(addr)
+	if err != nil {
+		return err
+	}
+	if !util.IsLoopback(u.Host) && u.Scheme != "https" {
+		return fmt.Errorf("URL %q does not use HTTPS or is not a loopback address", addr)
+	}
+	return nil
+}