Commit graph go-sdk/oauthex/dcr.go
Author SHA1 Message Date
Rob Findley
307e32c2b3 oauthex: validate URL schemes in auth server metadata and DCR
Use URL scheme validation for remaining URL fields in auth
datastructures (AuthServerMeta and ClientRegistrationMetadata), to
prevent XSS attacks.

By comparison, the typescript SDK doesn't validate
introspection_endpoint, and I don't know why. Otherwise the
implementations align.

Fixes #526
2025-12-11 10:09:43 -05:00
Sam Thanawalla
9348d33b75
oauthex: move internal/oauthex to oauthex (#559)
This PR relocates oauthex and moves DCR logic into dcr.go.

Fixes #558
2025-10-07 08:39:49 -04:00
Renamed from internal/oauthex/auth_meta.go (Previous history)