Bryan Frimin e7df6f6b2a Restrict OAuth client branding URLs to http(s) ...

CIMD and registration accepted any URI scheme for client_uri and
logo_uri, so allowlisted metadata could surface javascript: links on
sign-in. Validate absolute http/https at ingest and only expose those
schemes in branding.

Signed-off-by: Bryan Frimin <bryan@probo.com>

2026-07-21 15:44:19 +02:00

..

uri_test.go

Restrict OAuth client branding URLs to http(s)

2026-07-21 15:44:19 +02:00

uri.go

Restrict OAuth client branding URLs to http(s)

2026-07-21 15:44:19 +02:00