From 08aea95c7e40be8d51a1956fef3460d2375ce9f4 Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Thu, 12 Feb 2026 22:42:21 +0100
Subject: [PATCH] Validate that Okta audience config is an absolute URL

Add a check in the Okta auth provider initialization that ensures
the provided audience is an absolute URL with an http(s) scheme,
and throws a descriptive error if not.

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .changeset/okta-audience-url-validation.md    |  5 +++
 .../src/authenticator.ts                      |  5 +++
 .../src/module.test.ts                        | 31 +++++++++++++++++++
 3 files changed, 41 insertions(+)
 create mode 100644 .changeset/okta-audience-url-validation.md

diff --git a/.changeset/okta-audience-url-validation.md b/.changeset/okta-audience-url-validation.md
new file mode 100644
index 0000000000..4173a2dc65
--- /dev/null
+++ b/.changeset/okta-audience-url-validation.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-okta-provider': patch
+---
+
+Added a validation check that rejects `audience` configuration values that are not absolute URLs (i.e. missing `https://` or `http://` prefix).
diff --git a/plugins/auth-backend-module-okta-provider/src/authenticator.ts b/plugins/auth-backend-module-okta-provider/src/authenticator.ts
index 1454d580cb..8d7106c674 100644
--- a/plugins/auth-backend-module-okta-provider/src/authenticator.ts
+++ b/plugins/auth-backend-module-okta-provider/src/authenticator.ts
@@ -33,6 +33,11 @@ export const oktaAuthenticator = createOAuthAuthenticator({
     const clientId = config.getString('clientId');
     const clientSecret = config.getString('clientSecret');
     const audience = config.getOptionalString('audience') || 'https://okta.com';
+    if (!audience.match(/^https?:\/\//)) {
+      throw new Error(
+        `The provided audience "${audience}" is not a valid URL. It must start with "https://" or "http://".`,
+      );
+    }
     const authServerId = config.getOptionalString('authServerId');
     const idp = config.getOptionalString('idp');
 
diff --git a/plugins/auth-backend-module-okta-provider/src/module.test.ts b/plugins/auth-backend-module-okta-provider/src/module.test.ts
index a1d2b9e1de..5a7a957090 100644
--- a/plugins/auth-backend-module-okta-provider/src/module.test.ts
+++ b/plugins/auth-backend-module-okta-provider/src/module.test.ts
@@ -76,4 +76,35 @@ describe('authModuleOktaProvider', () => {
       nonce: decodeURIComponent(nonceCookie.value),
     });
   });
+
+  it('should reject a relative audience URL', async () => {
+    await expect(
+      startTestBackend({
+        features: [
+          import('@backstage/plugin-auth-backend'),
+          authModuleOktaProvider,
+          mockServices.rootConfig.factory({
+            data: {
+              app: {
+                baseUrl: 'http://localhost:3000',
+              },
+              auth: {
+                providers: {
+                  okta: {
+                    development: {
+                      clientId: 'my-client-id',
+                      clientSecret: 'my-client-secret',
+                      audience: 'example.okta.com',
+                    },
+                  },
+                },
+              },
+            },
+          }),
+        ],
+      }),
+    ).rejects.toThrow(
+      'The provided audience "example.okta.com" is not a valid URL. It must start with "https://" or "http://".',
+    );
+  });
 });