search

ivoa-std / SSO

Single Sign On
Creative Commons Attribution Share Alike 4.0 International
1 stars 6 forks source link

oauth: What format is `allowed_domains` in? #24

Open aragilar opened 4 days ago

aragilar commented 4 days ago

It could be bare domains, include ports or subpaths, or something else?

See #22 for context.

mbtaylor commented 3 days ago

One possibility would be an origin (or list of origins), as defined by RFC6454. Origin is a triple of scheme, hostname and port, and has the benefit that it's been thought through from a security perspective. But it's no good as it stands if we want to restrict on subpath as well.