Whether a redirect URI is safe to hand an authorization code to.
A fragment would let a code land in a part of the URL the app never parses,
and embedded whitespace defeats the exact-match comparison the authorize
endpoint relies on, so both are rejected outright. The value must also parse
as a URL: https:// clears every other check here and is still not somewhere
a code can be delivered.
Parameters
value: string
Candidate redirect URI, already trimmed.
Returns boolean
True when the URI can be used as an allow-list entry.
Whether a redirect URI is safe to hand an authorization code to.
A fragment would let a code land in a part of the URL the app never parses, and embedded whitespace defeats the exact-match comparison the authorize endpoint relies on, so both are rejected outright. The value must also parse as a URL:
https://clears every other check here and is still not somewhere a code can be delivered.