Function normalizeAudienceURI

coderd/httpmw/apikey.go:735–776

normalizeAudienceURI implements RFC 3986 URI normalization for OAuth2 audience comparison. This ensures consistent audience matching between authorization and token validation.

(audienceURI string)

// normalizeAudienceURI implements RFC 3986 URI normalization for OAuth2 audience comparison.
// This ensures consistent audience matching between authorization and token validation.
func normalizeAudienceURI(audienceURI string) string {
	if audienceURI == "" {
		return ""
	}

	u, err := url.Parse(audienceURI)
	if err != nil {
		// If parsing fails, return as-is to avoid breaking existing functionality
		return audienceURI
	}

	// Apply RFC 3986 syntax-based normalization:

	// 1. Scheme normalization - case-insensitive
	u.Scheme = strings.ToLower(u.Scheme)

	// 2. Host normalization - case-insensitive and IDN (punnycode) normalization
	u.Host = normalizeHost(u.Host)

	// 3. Remove default ports for HTTP/HTTPS
	if (u.Scheme == "http" && strings.HasSuffix(u.Host, ":80")) ||
		(u.Scheme == "https" && strings.HasSuffix(u.Host, ":443")) {
		// Extract host without default port
		if idx := strings.LastIndex(u.Host, ":"); idx > 0 {
			u.Host = u.Host[:idx]
		}
	}

	// 4. Path normalization including dot-segment removal (RFC 3986 Section 6.2.2.3)
	u.Path = normalizePathSegments(u.Path)

	// 5. Remove fragment - should already be empty due to earlier validation,
	// but clear it as a safety measure in case validation was bypassed
	if u.Fragment != "" {
		// This should not happen if validation is working correctly
		u.Fragment = ""
	}

	// 6. Keep query parameters as-is (rarely used in audience URIs but preserved for compatibility)

	return u.String()
}

// normalizeHost performs host normalization including case-insensitive conversion
// and IDN (Internationalized Domain Name) punnycode normalization.