• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

supabase / auth / 20576804091
69%

Build:
DEFAULT BRANCH: master
Ran 29 Dec 2025 03:55PM UTC
Jobs 1
Files 171
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

29 Dec 2025 03:47PM UTC coverage: 68.783% (+0.001%) from 68.782%
20576804091

push

github

web-flow
fix(oauth-server): allow custom URI schemes in client redirect URIs (#2298)

## Problem

Fixes #2285

The OAuth 2.0 Client Registration endpoin was incorrectly rejecting
custom URI schemes like `cursor://`, or `myapp://`, blocking native
application integrations.

## Root Cause
The validation logic in `validateRedirectURI()` was overly restrictive,
only allowing HTTPS or HTTP (localhost). This contradicted with **RFC
8252** (OAuth 2.0 for Native Apps) - recommends custom URI schemes

## Solution

Relaxed redirect URI validation

### New Validation Rules
  - **HTTPS** - always allowed
- **Custom URI schemes** - allowed for native apps (`cursor://`,
`myapp://`, `vscode://`, etc.)
- **HTTP** - only for localhost/loopback (`localhost`, `127.0.0.1`,
`::1`)
  - **Fragments** - still rejected per spec

6 of 6 new or added lines in 1 file covered. (100.0%)

14743 of 21434 relevant lines covered (68.78%)

79.23 hits per line

Jobs
ID Job ID Ran Files Coverage
1 20576804091.1 29 Dec 2025 03:55PM UTC 171
68.78
GitHub Action Run
Source Files on build 20576804091
  • Tree
  • List 171
  • Changed 1
  • Source Changed 0
  • Coverage Changed 1
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • ea72f57f on github
  • Prev Build on master (#20463603498)
  • Delete
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2025 Coveralls, Inc