Class ValidationOptions

Namespace

Fdyay.IdentityServer.Configuration

Assembly

Fdyay.IdentityServer.Core.dll

Checks applied to configured values, over and above whether they are configured.

public class ValidationOptions

Inheritance

object

ValidationOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Registration answers whether this server will send a browser somewhere. It does not answer whether the somewhere is a location at all, and the two are not the same question: a client-registration API, an administration screen or a SAML metadata document can put a URI into a store whose scheme runs script rather than navigating. This group is where that second question lives.

Properties

InvalidRedirectUriPrefixes

URI prefixes this server refuses to send a browser to, however the URI was registered. Matched case-insensitively against a normalised form of the URI.

public ICollection<string> InvalidRedirectUriPrefixes { get; set; }

Property Value

ICollection<string>

Remarks

A deny list rather than a list of permitted schemes, and the reason is native clients: a mobile application registers com.example.app:/callback and has every right to, so an allow list of http and https would refuse a legitimate registration in order to catch a hostile one. What the defaults have in common is that a browser asked to navigate to them either executes something (javascript:) or supplies its own document, and its own origin, rather than fetching one.

The list is settable, so a deployment that has a use for one of these can drop it, and one that knows its clients are all web applications can add to it.

Methods

IsAllowedRedirectTarget(string?)

Whether this server is willing to send a browser to uri.

public bool IsAllowedRedirectTarget(string? uri)

Parameters

uri string

Returns

bool

Remarks

The comparison is made against a normalised copy rather than the value itself, because a browser normalises before it decides what a URI means: it strips tab, carriage return and line feed from anywhere in the URI and trims leading control characters and spaces. So java	script:alert(1) is javascript: to a browser and is not to StartsWith, and a check that skipped this step would be a check that the values it was written to catch walk straight past.

An empty or absent URI is not this method's decision to make — it answers true, and the caller's own "is one registered" test stands.