github.com/anthropics/anthropic-sdk-go@v1.70.1/internal/auth/https.go (about)

     1  package auth
     2  
     3  import (
     4  	"fmt"
     5  	"net/url"
     6  	"strings"
     7  )
     8  
     9  // requireSecureTokenEndpoint rejects base URLs that would cause a JWT
    10  // assertion or refresh token to be sent over cleartext HTTP. Local
    11  // development hosts (localhost, 127.0.0.1, ::1) are allowed.
    12  func requireSecureTokenEndpoint(base string) error {
    13  	if base == "" {
    14  		return nil
    15  	}
    16  	u, err := url.Parse(base)
    17  	if err != nil {
    18  		return fmt.Errorf("invalid token endpoint base URL %q: %w", base, err)
    19  	}
    20  	if u.Scheme == "https" {
    21  		return nil
    22  	}
    23  	if u.Scheme == "http" && isLoopbackHost(u.Hostname()) {
    24  		return nil
    25  	}
    26  	return fmt.Errorf("refusing to send credential over non-https token endpoint %q", base)
    27  }
    28  
    29  func isLoopbackHost(host string) bool {
    30  	host = strings.ToLower(host)
    31  	return host == "localhost" || host == "127.0.0.1" || host == "::1"
    32  }