stacklok / toolhive / 21395997626

60%

Build Type

push

github

Committed by web-flow

Commit Message

Dedupe redirect URL validation for authserver + allow app-specific redirect URLs (#3451)

* Add shared redirect URI validation to pkg/oauth

Consolidate redirect URI validation logic into a shared utility that
supports configurable security policies per RFC 6749/8252:

- RedirectURIPolicyStrict: HTTPS + HTTP loopback only (for DCR)
- RedirectURIPolicyAllowPrivateSchemes: Also allows custom schemes
  like cursor://, vscode:// for native app clients (RFC 8252 §7.1)

Update DCR and upstream modules to use the shared validator,
eliminating duplicate validation logic.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Allow private-use URI schemes in DCR for native app clients

Change DCR redirect URI validation from Strict to AllowPrivateSchemes
policy, enabling native applications (Cursor, VS Code, etc.) to
register with custom scheme redirect URIs like cursor://callback.

This aligns with RFC 8252 Section 7.1 which specifies private-use URI
schemes as a valid redirect mechanism for native apps. Security is
maintained through PKCE (required for public clients).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Run Details

26 of 28 new or added lines in 3 files covered. (92.86%)

6 existing lines in 1 file now uncovered.

38266 of 63591 relevant lines covered (60.18%)

76.86 hits per line