Skip to content

Commit a9424d2

Browse files
authored
feat: enhance issuer URL validation in OAuth server metadata (#2164)
## Summary - Add trailing slash removal to prevent double slashes in endpoint URLs - Update validation comment to clarify purpose
1 parent 8a71006 commit a9424d2

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

internal/api/oauthserver/handlers.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -233,11 +233,14 @@ type OAuthServerMetadataResponse struct {
233233
func (s *Server) OAuthServerMetadata(w http.ResponseWriter, r *http.Request) error {
234234
issuer := s.config.JWT.Issuer
235235

236-
// TODO(cemal) :: Remove this check when we have the config validation in place
236+
// Basic issuer validation - empty issuer would create broken URLs
237237
if issuer == "" {
238238
return apierrors.NewInternalServerError("Issuer is not set")
239239
}
240240

241+
// Ensure issuer doesn't end with a slash to avoid double slashes in URLs
242+
issuer = strings.TrimSuffix(issuer, "/")
243+
241244
response := OAuthServerMetadataResponse{
242245
Issuer: issuer,
243246
AuthorizationEndpoint: fmt.Sprintf("%s/oauth/authorize", issuer),

0 commit comments

Comments
 (0)