payload: {"action":"created","issue":{"url":"https://api.github.com/repos/laravel/passport/issues/1053","repository_url":"https://api.github.com/repos/laravel/passport","labels_url":"https://api.github.com/repos/laravel/passport/issues/1053/labels{/name}","comments_url":"https://api.github.com/repos/laravel/passport/issues/1053/comments","events_url":"https://api.github.com/repos/laravel/passport/issues/1053/events","html_url":"https://github.com/laravel/passport/issues/1053","id":473061034,"node_id":"MDU6SXNzdWU0NzMwNjEwMzQ=","number":1053,"title":"Private and Provisional URI schemes are disallowed for redirect_uri","user":{"login":"mastacheata","id":716261,"node_id":"MDQ6VXNlcjcxNjI2MQ==","avatar_url":"https://avatars2.githubusercontent.com/u/716261?v=4","gravatar_id":"","url":"https://api.github.com/users/mastacheata","html_url":"https://github.com/mastacheata","followers_url":"https://api.github.com/users/mastacheata/followers","following_url":"https://api.github.com/users/mastacheata/following{/other_user}","gists_url":"https://api.github.com/users/mastacheata/gists{/gist_id}","starred_url":"https://api.github.com/users/mastacheata/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mastacheata/subscriptions","organizations_url":"https://api.github.com/users/mastacheata/orgs","repos_url":"https://api.github.com/users/mastacheata/repos","events_url":"https://api.github.com/users/mastacheata/events{/privacy}","received_events_url":"https://api.github.com/users/mastacheata/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-07-25T20:41:56Z","updated_at":"2019-07-30T08:38:53Z","closed_at":null,"author_association":"NONE","body":"- Passport Version: 7.0\r\n\r\n### Description:\r\nSince Passport uses Laravel's own url Validator to check for valid redirect URIs it's impossible to use most private or provisional schemes as recommended by \"RFC8252 - OAuth 2.0 for Native Apps\" (see:  https://tools.ietf.org/html/rfc8252#page-4) for use with mobile apps or non-web-clients that can't listen on the loopback interface in general. (The latter is recommended for computer software, but isn't possible with the permission structure of modern mobile device operating systems)\r\n\r\nThe Laravel URL validator is made for forms on websites and will in 99% of all cases be used to validate a web URL. It's not good at all  for private or provisional URI schemes that are either registered with IANA or used in private contexts (like inter-app communication).\r\n\r\n### Steps To Reproduce:\r\nOption A: Try to use a valid permanent scheme that isn't hierarchicallly structured and therefore doesn't use the double forward slashes like urn:ietf:params:oauth:grant-type:device_code\r\nYou will not be able to pass through any authorization that requires a redirect and will instead see the \"One or more redirects have an invalid url format.\" error-message.\r\n\r\nOption B: Use a provisional or private URI scheme not included in the scheme list of the Laravel URL Regex like the android scheme. (see: https://www.iana.org/assignments/uri-schemes/prov/android)\r\nAgain you will not be able to pass through any authorization that requires a redirect and will instead see the \"One or more redirects have an invalid url format.\" error-message.\r\n\r\nThere has been a previous attempt at fixing that behaviour, but I think that went the wrong direction when the author wanted to fix the widely used Laravel URL Validator.\r\n\r\nI'd rather fix the broken behaviour of that validation rule separately from simply allowing all kinds of URIs conforming to the scheme set in RFC 3986 for the purpose of redirects.\r\n\r\nHere's the corresponding bug report at the main Laravel repo: https://github.com/laravel/framework/issues/29301\r\nThere I suggested limiting the current `url` Validator to the most common URI schemes and instead adding a secondary generic URI validator that just checks if the format is valid.\r\nI can see why one wouldn't want a too broad URI validation in the framework when that is used in form validation and stuff like that where one woudl want to prevent website users from doing bad things.\r\nTherefore I would very much welcome it if we could throw the half-hearted URL validator from the main framework out the window in this library and instead use a custom regex to validate just the format."},"comment":{"url":"https://api.github.com/repos/laravel/passport/issues/comments/516324025","html_url":"https://github.com/laravel/passport/issues/1053#issuecomment-516324025","issue_url":"https://api.github.com/repos/laravel/passport/issues/1053","id":516324025,"node_id":"MDEyOklzc3VlQ29tbWVudDUxNjMyNDAyNQ==","user":{"login":"driesvints","id":594614,"node_id":"MDQ6VXNlcjU5NDYxNA==","avatar_url":"https://avatars1.githubusercontent.com/u/594614?v=4","gravatar_id":"","url":"https://api.github.com/users/driesvints","html_url":"https://github.com/driesvints","followers_url":"https://api.github.com/users/driesvints/followers","following_url":"https://api.github.com/users/driesvints/following{/other_user}","gists_url":"https://api.github.com/users/driesvints/gists{/gist_id}","starred_url":"https://api.github.com/users/driesvints/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/driesvints/subscriptions","organizations_url":"https://api.github.com/users/driesvints/orgs","repos_url":"https://api.github.com/users/driesvints/repos","events_url":"https://api.github.com/users/driesvints/events{/privacy}","received_events_url":"https://api.github.com/users/driesvints/received_events","type":"User","site_admin":false},"created_at":"2019-07-30T08:38:53Z","updated_at":"2019-07-30T08:38:53Z","author_association":"MEMBER","body":"Isn't the main issue here that we should use a separate \"urn\" validator for this?"}}
other: {"actor":{"display_login":"driesvints"}}