{"record":{"id":"afab4690d4602a80","repo":"Hmbown/CodeWhale","slug":"oidc-discovery-returned-unsupported-field-scheme","errorCode":null,"errorMessage":"OIDC discovery returned unsupported {field} scheme","messagePattern":"OIDC discovery returned unsupported (.+?) scheme","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/oauth.rs","lineNumber":690,"sourceCode":"    Ok(())\n}\n\n/// Validate one discovered endpoint against the issuer: https-or-http scheme,\n/// no plaintext downgrade, no embedded credentials, same origin.\nfn validate_discovered_oauth_endpoint(\n    endpoint: Option<String>,\n    field: &str,\n    issuer: &str,\n) -> Result<String> {\n    let endpoint = endpoint\n        .as_deref()\n        .map(str::trim)\n        .filter(|endpoint| !endpoint.is_empty())\n        .with_context(|| format!(\"OIDC discovery missing {field}\"))?;\n    let parsed = reqwest::Url::parse(endpoint)\n        .with_context(|| format!(\"OIDC discovery returned an invalid {field}\"))?;\n    if !matches!(parsed.scheme(), \"http\" | \"https\") {\n        bail!(\"OIDC discovery returned unsupported {field} scheme\");\n    }\n    let issuer = oauth_endpoint_url(issuer).context(\"OIDC issuer is not a trusted URL\")?;\n    if issuer.scheme() == \"https\" && parsed.scheme() != \"https\" {\n        bail!(\"OIDC discovery attempted to downgrade {field} from HTTPS\");\n    }\n    if !parsed.username().is_empty() || parsed.password().is_some() {\n        bail!(\"OIDC discovery returned credentials in {field}\");\n    }\n    if parsed.origin() != issuer.origin() {\n        bail!(\"OIDC discovery returned {field} on a different origin than the issuer\");\n    }\n    let _ = oauth_endpoint_url(parsed.as_str())?;\n    Ok(endpoint.to_string())\n}\n\n/// Documented-path endpoints for a provider row, no discovery.\nfn fallback_oauth_endpoints(params: &OAuthProviderParams, issuer: &str) -> OAuthEndpoints {\n    OAuthEndpoints {","sourceCodeStart":672,"sourceCodeEnd":708,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/oauth.rs#L672-L708","documentation":"One of the OAuth endpoints advertised by the discovery document uses a URL scheme other than http or https (e.g. a javascript: or custom-scheme URL). Such an endpoint can never be a valid OAuth endpoint, so discovery validation rejects it before any token exchange is attempted.","triggerScenarios":"validate_discovered_oauth_endpoint parsing a non-empty {field} endpoint (device authorization, token, etc.) whose reqwest::Url scheme() is not \"http\" or \"https\".","commonSituations":"Misbehaving or malicious identity provider returning garbage or non-HTTP endpoint URLs; a discovery document field pointing at an app-specific custom scheme; typos in a self-hosted provider's static discovery doc.","solutions":["Inspect the provider's discovery document and check the {field} value's scheme.","Fix the provider configuration so the endpoint is a proper https URL.","If you operate the IdP, correct or regenerate its well-known document.","Switch to documented-path endpoints instead of discovery if the provider cannot be fixed."],"exampleFix":"// before\n\"device_authorization_endpoint\": \"myapp://device\" // unsupported scheme\n// after\n\"device_authorization_endpoint\": \"https://auth.example.com/device\"","handlingStrategy":"validation","validationCode":"if let Ok(url) = reqwest::Url::parse(endpoint) {\n    if !matches!(url.scheme(), \"http\" | \"https\") {\n        eprintln!(\"endpoint scheme {scheme} is not usable for OAuth\", scheme = url.scheme());\n    }\n}","typeGuard":"fn is_http_url(s: &str) -> bool {\n    reqwest::Url::parse(s).map(|u| matches!(u.scheme(), \"http\" | \"https\")).unwrap_or(false)\n}","tryCatchPattern":null,"preventionTips":["Only point discovery at IdPs that advertise proper https:// endpoint URLs.","Sanity-check a self-hosted provider's well-known document after every IdP upgrade.","Treat non-http(s) endpoints in a discovery document as a sign of a malicious or broken provider.","Prefer providers with a known, audited discovery implementation."],"tags":["oauth","oidc","url","discovery","security"],"backgroundTag":"invalid-url-format","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-22T21:17:16.096Z"}