validateURIField validates a URI field
(uriStr, fieldName string)
| 255 | |
| 256 | // validateURIField validates a URI field |
| 257 | func validateURIField(uriStr, fieldName string) error { |
| 258 | if uriStr == "" { |
| 259 | return nil // Empty URIs are allowed for optional fields |
| 260 | } |
| 261 | |
| 262 | uri, err := url.Parse(uriStr) |
| 263 | if err != nil { |
| 264 | return xerrors.Errorf("invalid %s: %w", fieldName, err) |
| 265 | } |
| 266 | |
| 267 | // Require absolute URLs with scheme |
| 268 | if !uri.IsAbs() { |
| 269 | return xerrors.Errorf("%s must be an absolute URL", fieldName) |
| 270 | } |
| 271 | |
| 272 | // Only allow http/https schemes |
| 273 | if uri.Scheme != "http" && uri.Scheme != "https" { |
| 274 | return xerrors.Errorf("%s must use http or https scheme", fieldName) |
| 275 | } |
| 276 | |
| 277 | // For production, prefer HTTPS |
| 278 | // Note: we allow HTTP for localhost but prefer HTTPS for production |
| 279 | // This could be made configurable in the future |
| 280 | |
| 281 | return nil |
| 282 | } |
| 283 | |
| 284 | // isLocalhost checks if hostname is localhost (allows broader development usage) |
| 285 | func isLocalhost(hostname string) bool { |