search

simonw / datasette-indieauth

Datasette authentication using IndieAuth and RelMeAuth
8 stars 0 forks source link

verify_client_identifier() #7

Closed simonw closed 3 years ago

simonw commented 3 years ago

https://indieauth.spec.indieweb.org/#client-identifier

Clients are identified by a [URL]. Client identifier URLs MUST have either an https or http scheme, MUST contain a path component, MUST NOT contain single-dot or double-dot path segments, MAY contain a query string component, MUST NOT contain a fragment component, MUST NOT contain a username or password component, and MAY contain a port. Additionally, hostnames MUST be domain names or a loopback interface and MUST NOT be IPv4 or IPv6 addresses except for IPv4 127.0.0.1 or IPv6 [::1].

Refs #2

simonw commented 3 years ago

I'm going to skip IPv6 for the moment because I can't figure out what a valid IPv6 URL would look like.