[hugoalves-dev]

Summary

• Accept HTTPS callbacks and HTTP callbacks only on the exact hosts localhost, 127.0.0.1, and [::1] during anonymous RFC 7591 registration.
• Allow RFC 8252 ephemeral HTTP loopback port changes during authorization, while requiring the same registered scheme, host, path, and query.
• Apply the port exception only to DCR-registered public PKCE clients; keep Spring Authorization Server's built-in redirect URI validator for all other clients and continue using its default scope validator.
• Preserve requireProofKey(true), public client authentication, registration rate limiting, grant and scope handling, and all other OAuth configuration.

Automated coverage

• Accepted HTTPS, localhost, IPv4, and IPv6 loopback registration callbacks.
• Rejected external HTTP, lookalike hosts, non-loopback IPv4/IPv6, userinfo, fragments, invalid ports, and non-HTTP schemes.
• Authorization with an ephemeral localhost/IPv4/IPv6 port.
• Rejection when host, path, query, or scheme differs; HTTPS callbacks require exact port matches.
• Confirm DCR clients stay public and have PKCE enabled.

References

• RFC 8252 §§7.3, 8.4
• RFC 7591 §2
• Spring Authorization Server authorization-request validation

Tests are added; CI status must be verified before merging.

[github-actions]

Qodana for JVM

It seems all right 👌

No new problems were found according to the checks applied

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

• Register at Qodana Cloud and configure the action
• Use GitHub Code Scanning with Qodana
• Host Qodana report at GitHub Pages
• Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2025.3.2
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions