isValidCustomScheme validates custom schemes for public clients (RFC 8252)
(scheme string)
| 298 | |
| 299 | // isValidCustomScheme validates custom schemes for public clients (RFC 8252) |
| 300 | func isValidCustomScheme(scheme string) bool { |
| 301 | // For security and RFC compliance, require reverse domain notation |
| 302 | // Should contain at least one period and not be a well-known scheme |
| 303 | if !strings.Contains(scheme, ".") { |
| 304 | return false |
| 305 | } |
| 306 | |
| 307 | // Block schemes that look like well-known protocols |
| 308 | wellKnownSchemes := []string{"http", "https", "ftp", "mailto", "tel", "sms"} |
| 309 | for _, wellKnown := range wellKnownSchemes { |
| 310 | if strings.EqualFold(scheme, wellKnown) { |
| 311 | return false |
| 312 | } |
| 313 | } |
| 314 | |
| 315 | return true |
| 316 | } |
no test coverage detected