Module: Hitch::UriValidation

Extended by:

ActiveSupport::Concern

Included in:

AuthorizationRequest, DeviceActivation, DeviceAuthorizationsController, RegistrationsController, TokensController

Defined in:

app/controllers/concerns/hitch/uri_validation.rb

Overview

Shared OAuth URI validation rules used by both the authorization endpoint (per-request redirect_uri) and the DCR endpoint (redirect_uris array at registration time).

Without DCR-time validation, an attacker could register a client with javascript:alert(1) or http://attacker.test/cb and then try to use it at authorize — RFC 7591 §2 makes URI policy the authorization server's responsibility.