Documentation
¶
Overview ¶
Package cimd implements fetching and validation of OAuth 2.0 Client ID Metadata Documents (CIMD) per draft-ietf-oauth-client-id-metadata-document.
This package is a sub-package of pkg/oauthproto and is allowed to import pkg/networking (for SSRF utilities) without violating the leaf-package invariant of the parent package.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ValidateClientMetadataDocument ¶
func ValidateClientMetadataDocument(doc *ClientMetadataDocument, fetchedFrom string) error
ValidateClientMetadataDocument validates a parsed ClientMetadataDocument against the URL it was fetched from. Per the CIMD draft spec, the client_id field must exactly equal the URL — no normalization is applied, because allowing normalization would permit subtle spoofing attacks where a document at URL A claims the identity of URL B.
Types ¶
type ClientMetadataDocument ¶
type ClientMetadataDocument struct {
// Required
ClientID string `json:"client_id"`
RedirectURIs []string `json:"redirect_uris"`
// Recommended
ClientName string `json:"client_name,omitempty"`
LogoURI string `json:"logo_uri,omitempty"`
ClientURI string `json:"client_uri,omitempty"`
// Optional
TosURI string `json:"tos_uri,omitempty"`
PolicyURI string `json:"policy_uri,omitempty"`
GrantTypes []string `json:"grant_types,omitempty"`
ResponseTypes []string `json:"response_types,omitempty"`
Scope string `json:"scope,omitempty"`
TokenEndpointAuthMethod string `json:"token_endpoint_auth_method,omitempty"`
// TokenEndpointAuthMethodsSupported is not part of the CIMD draft itself;
// it is defined by OpenID Connect RP Metadata Choices 1.0 as the plural
// counterpart of TokenEndpointAuthMethod, listing every method the client
// supports while TokenEndpointAuthMethod names its preferred one. Live
// clients (e.g. ChatGPT) publish it alongside a stricter singular
// preference the client_id-issuing party does not control per-AS; the
// decorator in pkg/authserver/storage uses it to negotiate a mutually
// supported method instead of rejecting the document outright (#6278).
TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported,omitempty"`
ApplicationType string `json:"application_type,omitempty"`
PostLogoutRedirectURIs []string `json:"post_logout_redirect_uris,omitempty"`
}
ClientMetadataDocument represents an OAuth 2.0 Client ID Metadata Document per draft-ietf-oauth-client-id-metadata-document.
func FetchClientMetadataDocument ¶
func FetchClientMetadataDocument(ctx context.Context, rawURL string) (*ClientMetadataDocument, error)
FetchClientMetadataDocument fetches and validates a Client ID Metadata Document from the given URL. The URL must use the HTTPS scheme (http://localhost is accepted in development). The document is fetched with a 5-second timeout, a 1-hop redirect limit, a 10 KB body cap, and SSRF protection via a per-dial IP check. After fetching, ValidateClientMetadataDocument is called and any validation error is returned.
Source Files