fix: require https for Okta audience URL

Signed-off-by: Alex Krantz <alex@krantz.dev>
2021-10-09 17:29:13 -07:00
parent ce6387a40b
commit 4611d59fdc
1 changed files with 4 additions and 0 deletions
@@ -275,6 +275,10 @@ export const createOktaProvider = (
      const audience = envConfig.getString('audience');
      const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;

+      if (!audience.startsWith('https')) {
+        throw new Error("URL for 'audience' must start with 'https'.");
+      }
+
      const catalogIdentityClient = new CatalogIdentityClient({
        catalogApi,
        tokenIssuer,