From e2039ef99a0391bf01b9fd5be9fdccc1a04a9fa5 Mon Sep 17 00:00:00 2001 From: Alex Krantz Date: Tue, 12 Oct 2021 10:28:42 -0700 Subject: [PATCH] fix: add comment for clarification and require full scheme Signed-off-by: Alex Krantz --- plugins/auth-backend/src/providers/okta/provider.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index 7ea5b29e80..dfffca9da7 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -275,8 +275,11 @@ export const createOktaProvider = ( const audience = envConfig.getString('audience'); const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`; - if (!audience.startsWith('https')) { - throw new Error("URL for 'audience' must start with 'https'."); + // This is a safe assumption as `passport-okta-oauth` uses the audience + // as the base for building the authorization, token, and user info URLs. + // https://github.com/fischerdan/passport-okta-oauth/blob/ea9ac42d/lib/passport-okta-oauth/oauth2.js#L12-L14 + if (!audience.startsWith('https://')) { + throw new Error("URL for 'audience' must start with 'https://'."); } const catalogIdentityClient = new CatalogIdentityClient({