Validates registered redirect_uris for DCR are a secure schema with no fragments

Closed
VA
3mo ago
+150-1

Fixes #2629.

Summary

Dynamic Client Registration currently accepts redirect_uris with unsafe schemes (javascript:, data:, file:, ftp:) and fragments without complaint. RFC 9700 .1.1 and RFC 7591 require HTTPS for redirect_uris and prohibit fragments.

Changes

  • Added validate_redirect_uri() to routes.py, mirroring the existing validate_issuer_url() pattern: only https:// allowed, with http:// loopback exception for localhost/127.0.0.1/[::1]
  • Rejects URIs with explicit or empty fragments
  • Called in RegistrationHandler.handle() after model_validate_json, with 400 invalid_redirect_uri response on failure
  • 9 unit tests covering allowed HTTP loopback URIs and rejected unsafe schemes and fragments