Skip to main content

validate_outbound_url

omni_dev::browser::auth

Function validate_outbound_url 

Source 
pub fn validate_outbound_url(
    url: &str,
    allowed: &[&str],
) -> Result<(), ScopeError>
Expand description

Enforces the default-closed outbound scope.

Relative URLs (page-origin) are always allowed. Absolute or protocol-relative URLs are rejected unless their origin matches one of the allowed origins. An empty allowed slice permits relative URLs only.

The caller resolves allowed: the per-request override (a single origin) or the per-origin allowlist entry for the tab a request is routed to (see OriginAllowlist::outbound_for).