url scheme validation in oauth plugin is limited by RFC3986

[ahmadnassri]

when assigning a redirect_uri in oauth2 plugin, some values are rejected (e.g. anything with underscore) while others are accepted (e.g. with dashes)

• documentation should list accepted charachter list for all parts of the URI (as defined in RFC3986 & RFC7230)
• schema should support underscore values.

[ahmadnassri]

cc: @lucamaraschi

[subnetmarco]

@ahmadnassri Can you post an example of an URL that doesn't work?

[ahmadnassri]

any_thing_with_underscore://my_custom_dns_name/oauth

[ahmadnassri]

doing a deep dive:

the url type validation is defined here:
dao/schemas_validation.lua#L20 which uses luasocket

which in turn is checking for RFC3986 validity in: src/url.lua#L140

specifically Section 3.1 where the scheme is defined as:

scheme      = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )

therefore underscores are in fact invalid and kong is properly propagating the error message.

that said, we should also document the reference to RFC3986 as it is made part of RFC7230

[subnetmarco]

That said, I guess we can close this ticket?

[ahmadnassri]

let's keep open for the documentation part

[subnetmarco]

The documentation already references the appropriate specification:

The URL in your app where users will be sent after authorization (RFC 6742 Section 3.1.2)

https://getkong.org/plugins/oauth2-authentication/#create-an-oauth-2.0-authentication-credential/application

Specifically it references the "Redirection Endpoint" of the OAuth 2.0 specification, which in turn references RFC3986.