auth0 / auth0-java

Java client library for the Auth0 platform
https://auth0.com
MIT License
287 stars 131 forks source link

Update validation currently used by AuthApi#authorizeUrl and AuthApi#… #428

Closed dpromanko closed 2 years ago

dpromanko commented 2 years ago

…logoutUrl to accept all valid URIs using java.net.URI

Changes

Please see https://github.com/auth0/auth0-java/issues/424 for context.

References

https://github.com/auth0/auth0-java/issues/424

It is probably also worth noting the decision behind the use of the java.net.URI constructor instead of the static URI.create() method which can be found in their documentation here where it states The constructors, which throw URISyntaxException directly, should be used situations where a URI is being constructed from user input or from some other source that may be prone to errors.

Testing

Testing can be done by running the modified unit tests in AuthApiTest.java and the new unit tests in AssertsTest.java.

I wrote a handful of test cases to give examples of what would and would not pass validation. I'm not very familiar with rfc2396 which is referenced by java.net.URI as the syntax that defines a URI, but it seems quite broad. Obviously since URIs expand well past valid http or https URLs this would introduce a lot of values that would be considered valid. I don't necessarily have any concern here because these still must be configured as valid callback urls within Auth0 itself.

Checklist

poovamraj commented 2 years ago

Hey @dpromanko, I tried to use this same PR to implement the changes but since there is so much change from the initial implementation and the changed one and it requires a change in the description, I created a new PR instead - https://github.com/auth0/auth0-java/pull/429

I'll close this PR. Thanks a lot for your contribution 🙏