AuthServerDiscovery

Prepare a buffered OAuth request without following redirects.

Validate and pin an OAuth endpoint within the prepared request's limits.

Determine whether the normalized host names a local development endpoint.

Normalize the host consistently with destination validation.

Resolve OAuth destination hostnames with the given callback instead of DNS.

The callback persists in a static property for the worker lifetime and supplies the addresses for every OAuth request.

Get the addresses the resolveHostsUsing() callback supplies for a hostname.

Discover and validate the resource's authorization server.

Require caller-supplied metadata to be advertised by the resource.

Validate each request hop against the OAuth destination policy and pin it to the vetted addresses.

Probe the resource for its unauthenticated authorization challenge.

Fetch optional or explicitly requested protected resource metadata.

Verify that metadata belongs to the requested resource.

Get the resource's first advertised authorization server.

Fetch authorization metadata from the issuer's supported discovery paths.

Get the OAuth and OpenID discovery URLs for an issuer.

Build a well-known metadata URL for the resource path and query.

Get the URL's origin.

Require HTTPS outside local development endpoints.

Validate a metadata endpoint before fetching it.

Prevent remote resources from directing authorization to local endpoints.

Determine whether a host is local or a non-public address literal.

Build an origin from parsed URL components.

Parse the URL components required for discovery.

Flush all static state.