[chr-hertel]

Follow-up to #666: SecureUrl::parse() now refuses hosts that reach this machine or a private network without looking like it - 0.0.0.0, ::, IPv4 within IPv6 ([::ffff:127.0.0.1]) and IPv4 in another form than four decimal numbers (127.1, 2130706433, 0x7f000001). Over plain http they were already refused, but over https they got past the loopback check.

[BC Break] for the server's issuer, jwks_uri and resource and for the URLs a client discovers, both in the CHANGELOG. A DNS name that resolves to loopback is still left to egress control, e.g. NoPrivateNetworkHttpClient.

[Copilot]

🟡 Changes recommended

Percent-encoded hosts bypass the loopback restriction because browsers normalize accepted URLs to local addresses, allowing an untrusted authorization server to redirect users to local services.

1 open issue

• Reject percent-encoded loopback hosts in authorization endpoints · New

What changed in this PR

Hardens shared OAuth URL validation for the server and client by rejecting address forms that can conceal local or private-network destinations.

Changes:

• Rejects unspecified addresses, IPv4 embedded in IPv6, and non-standard IPv4 forms.
• Adds accepted- and rejected-URL test cases.
• Documents the compatibility changes and the need for separate DNS-based egress controls.

File	Description
tests/​Unit/​Server/​Transport/​Http/​OAuth/​SecureUrlTest.php	Adds coverage for allowed hosts and rejected address forms.
src/​Server/​Transport/​Http/​OAuth/​SecureUrl.php	Adds host-address validation to OAuth URL parsing.
docs/​client/​authorization.md	Explains new rejections and remaining DNS-related risks.
CHANGELOG.md	Records server and client compatibility breaks.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The review identifies no active issues requiring changes to the OAuth URL validation hardening.

No open issues 🎉

1 resolved since last review

• Reject percent-encoded loopback hosts in authorization endpoints

_{Review effort: Balanced}