@cloudflare/workers-oauth-provider 0.3.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/oauth-provider.js +5 -3
- package/package.json +1 -1
package/dist/oauth-provider.js
CHANGED
|
@@ -1390,14 +1390,16 @@ function validateRedirectUriScheme(redirectUri) {
|
|
|
1390
1390
|
for (const dangerousScheme of dangerousSchemes) if (scheme === dangerousScheme) throw new Error("Invalid redirect URI");
|
|
1391
1391
|
}
|
|
1392
1392
|
/**
|
|
1393
|
-
* Checks if a URI is a loopback redirect URI (127.0.0.0/8 or
|
|
1394
|
-
* Per RFC 8252 Section 7.3,
|
|
1393
|
+
* Checks if a URI is a loopback redirect URI (127.0.0.0/8, ::1, or localhost).
|
|
1394
|
+
* Per RFC 8252 Section 7.3, loopback IPs get special port handling. This library
|
|
1395
|
+
* applies the same port flexibility to localhost for native apps (e.g., Claude Code).
|
|
1395
1396
|
*/
|
|
1396
1397
|
function isLoopbackUri(uri) {
|
|
1397
1398
|
try {
|
|
1398
1399
|
const host = new URL(uri).hostname;
|
|
1399
1400
|
if (host.match(/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)) return true;
|
|
1400
1401
|
if (host === "::1" || host === "[::1]") return true;
|
|
1402
|
+
if (host.toLowerCase() === "localhost") return true;
|
|
1401
1403
|
return false;
|
|
1402
1404
|
} catch {
|
|
1403
1405
|
return false;
|
|
@@ -1405,7 +1407,7 @@ function isLoopbackUri(uri) {
|
|
|
1405
1407
|
}
|
|
1406
1408
|
/**
|
|
1407
1409
|
* Validates a redirect URI against registered URIs with RFC 8252 loopback support.
|
|
1408
|
-
* For loopback URIs (127.x.x.x, ::1), any port is allowed as long as scheme, host, path, and query match.
|
|
1410
|
+
* For loopback URIs (127.x.x.x, ::1, localhost), any port is allowed as long as scheme, host, path, and query match.
|
|
1409
1411
|
* For non-loopback URIs, exact match is required.
|
|
1410
1412
|
*/
|
|
1411
1413
|
function isValidRedirectUri(requestUri, registeredUris) {
|