Table of Contents

Class StrictRedirectUriValidator

Namespace
Fdyay.IdentityServer.Validation
Assembly
Fdyay.IdentityServer.Core.dll

A redirect URI is valid if it is one the client registered, character for character.

public class StrictRedirectUriValidator : IRedirectUriValidator
Inheritance
StrictRedirectUriValidator
Implements
Derived
Inherited Members

Remarks

Duende 8.0.1's default. Duende compares OrdinalIgnoreCase; this compares Ordinal, on purpose: RFC 9700 §2.1 requires exact string matching of redirect URIs, and a path differing only in case may be a different resource at the client. Open, with virtual methods, as Duende's is.

Constructors

StrictRedirectUriValidator(IOptions<IdentityServerOptions>?) 

public StrictRedirectUriValidator(IOptions<IdentityServerOptions>? options = null)

Parameters

options IOptions<IdentityServerOptions>

This server's options, for PushedAuthorization.AllowUnregisteredPushedRedirectUris; without them, every redirect URI must be registered, as Duende's does without its options.

Methods

IsPostLogoutRedirectUriValidAsync(string, Client, CancellationToken)

Whether requestedUri is a post-logout redirect URI client may use.

public virtual Task<bool> IsPostLogoutRedirectUriValidAsync(string requestedUri, Client client, CancellationToken ct)

Parameters

requestedUri string
client Client
ct CancellationToken

Returns

Task<bool>

Remarks

True only when client registered requestedUri as a post-logout redirect URI, compared ordinally.

Exceptions

ArgumentNullException

client is null.

IsRedirectUriValidAsync(RedirectUriValidationContext, CancellationToken) 

public virtual Task<bool> IsRedirectUriValidAsync(RedirectUriValidationContext context, CancellationToken ct)

Parameters

context RedirectUriValidationContext
ct CancellationToken

Returns

Task<bool>

Remarks

Duende's, measured: with PushedAuthorization.AllowUnregisteredPushedRedirectUris on, a client with RequireClientSecret may name any redirect URI in a pushed request and in its redemption — it authenticated to push it. Otherwise the URI must be registered.

IsRedirectUriValidAsync(string, Client)

Whether requestedUri is a redirect URI client may use.

public virtual Task<bool> IsRedirectUriValidAsync(string requestedUri, Client client)

Parameters

requestedUri string
client Client

Returns

Task<bool>

Remarks

True only when client registered requestedUri, compared ordinally.

Exceptions

ArgumentNullException

client is null.

StringCollectionContainsString(IEnumerable<string>, string)

Whether uris holds requestedUri exactly.

protected static bool StringCollectionContainsString(IEnumerable<string> uris, string requestedUri)

Parameters

uris IEnumerable<string>
requestedUri string

Returns

bool