SecureHttpFetchOptionsValidator Class

Refuses a AllowedDestinations entry that would permit more than it reads as permitting.

public class SecureHttpFetchOptionsValidator : Microsoft.Extensions.Options.IValidateOptions<Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions>

Inheritance System.Object → SecureHttpFetchOptionsValidator

Implements Microsoft.Extensions.Options.IValidateOptions<SecureHttpFetchOptions>

Remarks

Matching considers a destination's scheme, host, port and path, and nothing else. An entry carrying a query, a fragment or user information therefore permits every request to that path whatever those parts say, so accepting one would grant a permission wider than the text of the entry - the single failure this option exists to prevent. A relative entry names no host at all and can never match.