From 4611d59fdc4829a1c8a23df5536e76cee2cca1b2 Mon Sep 17 00:00:00 2001
From: Alex Krantz <alex@krantz.dev>
Date: Sat, 9 Oct 2021 17:29:13 -0700
Subject: [PATCH] fix: require https for Okta audience URL

Signed-off-by: Alex Krantz <alex@krantz.dev>
---
 plugins/auth-backend/src/providers/okta/provider.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts
index 44e26bb7fe..7ea5b29e80 100644
--- a/plugins/auth-backend/src/providers/okta/provider.ts
+++ b/plugins/auth-backend/src/providers/okta/provider.ts
@@ -275,6 +275,10 @@ export const createOktaProvider = (
       const audience = envConfig.getString('audience');
       const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
 
+      if (!audience.startsWith('https')) {
+        throw new Error("URL for 'audience' must start with 'https'.");
+      }
+
       const catalogIdentityClient = new CatalogIdentityClient({
         catalogApi,
         tokenIssuer,