Package io.jans.as.server.service.net

Class SectorIdentifierUriService

java.lang.Object

io.jans.as.server.service.net.SectorIdentifierUriService

@Named
public class SectorIdentifierUriService
extends Object

Shared validation and fetching for client-supplied sector_identifier_uri values, used both at client registration time (RegisterParamsValidator) and at authorization time (RedirectionUriService). Enforces https-only scheme and the requestUriBlockList before any outbound request is made, to prevent SSRF via sector_identifier_uri.

Author:

Yuriy Z

Constructor Summary

Constructors

Constructor	Description
SectorIdentifierUriService()

Method Summary

Modifier and Type	Method	Description
String	fetchSectorIdentifierContent(String sectorIdentifierUri)
boolean	isAllowedSectorIdentifierUri(String sectorIdentifierUri)
static boolean	isPrivateAddress(InetAddress address)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SectorIdentifierUriService

public SectorIdentifierUriService()

Method Details

isAllowedSectorIdentifierUri

public boolean isAllowedSectorIdentifierUri(String sectorIdentifierUri)

isPrivateAddress

public static boolean isPrivateAddress(InetAddress address)

fetchSectorIdentifierContent

public String fetchSectorIdentifierContent(String sectorIdentifierUri)