Allow http:// loopback redirect URIs for native OAuth apps (RFC 8252) by Copilot · Pull Request #11255 · outline/outline

Copilot · 2026-01-24T02:32:15Z

Native apps (CLI tools, desktop apps) require http://localhost callback servers for OAuth flows per RFC 8252 §7.3. Current validation rejects all http:// URIs, blocking this standard pattern.

Changes

Modified validateRedirectUri to allow http:// for loopback addresses (127.0.0.1, [::1], localhost)
Fragment, wildcard, and whitelist checks still apply to loopback URIs
Non-loopback URIs continue to require https://

Example OAuth client configuration now supported:

const client = {
  redirectUris: [
    "http://127.0.0.1:8080/callback",  // Now allowed
    "http://localhost:3000/callback",  // Now allowed
    "http://[::1]:9000/callback"       // Now allowed
  ]
};

This completes native app OAuth support alongside existing PKCE and public client features.

Original prompt

This section details on the original issue you should resolve

<issue_title>Support http://localhost redirect URIs for native/CLI OAuth apps (RFC 8252)</issue_title>
<issue_description>## Use Case

CLI tools and native desktop apps that use OAuth PKCE with a local callback server to authenticate users. The standard flow is:

CLI starts a local HTTP server on a random port (e.g. http://127.0.0.1:8765/callback)

CLI opens the browser to the OAuth authorization URL

User authorizes the app in the browser

Browser redirects to the local callback server with the authorization code

CLI exchanges the code for a token using PKCE (no client secret needed)

This is the recommended approach for native apps per RFC 8252 Section 7.3 (Loopback Interface Redirection).

Current Limitation

validateRedirectUri in server/utils/oauth/OAuthInterface.ts calls:
if (!isUrl(uri, { requireHttps: true })) {
  return false;
}
The isUrl function in shared/utils/urls.ts unconditionally blocks http:// protocol when requireHttps: true:
if (requireHttps && url.protocol === "http:") {
  return false;
}
This means http://127.0.0.1:PORT/callback and http://localhost:PORT/callback are rejected, even though they are the standard mechanism for native app OAuth.

Suggested Fix

Add a loopback exception in validateRedirectUri before the isUrl check:
async validateRedirectUri(uri, client) {
  // ...existing checks...

  // Allow loopback redirects for native/CLI apps (RFC 8252 §7.3)
  const url = new URL(uri);
  const isLoopback = url.hostname === '127.0.0.1' 
    || url.hostname === '[::1]' 
    || url.hostname === 'localhost';
  
  if (!isLoopback && !isUrl(uri, { requireHttps: true })) {
    return false;
  }

  return true;
}
Per RFC 8252, loopback redirects:

MUST use http (not https) since TLS certificates cannot be obtained for loopback addresses

SHOULD use 127.0.0.1 (IPv4) or [::1] (IPv6) rather than localhost to avoid DNS resolution issues

The port MAY vary between requests (the authorization server should allow any port)

Context

Outline already supports the other half of native app OAuth:

PKCE (code_challenge / code_challenge_method in the authorize endpoint)

Public clients that don't require a client secret (feat: Allow PKCE clients to refresh tokens #10769)

The only missing piece for full native app support is allowing http:// redirect URIs for loopback addresses.

References

Implement OAuth PKCE browser login Doist/outline-cli#7</issue_description>

Comments on the Issue (you are @copilot in this section)
@tommoor Seems pretty reasonable 👍

Fixes Support http://localhost redirect URIs for native/CLI OAuth apps (RFC 8252) #11254

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: tommoor <380914+tommoor@users.noreply.github.com>

CLAassistant · 2026-01-24T02:36:58Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [outline/outline](https://github.com/outline/outline) | minor | `1.3.0` → `1.4.0` | --- ### Release Notes <details> <summary>outline/outline (outline/outline)</summary> ### [`v1.4.0`](https://github.com/outline/outline/releases/tag/v1.4.0) [Compare Source](outline/outline@v1.3.0...v1.4.0) #### What's Changed ##### Highlights - New **"Toggle blocks"** allow creating content that is collapsed by default in [#8317](outline/outline#8317) - Table cells can now have a custom background color set in [#10930](outline/outline#10930) - Search results are now highlighted in the document when navigating from search in [#11262](outline/outline#11262) ##### Other improvements - A new Figma integration allows unfurling information about Figma links in documents by [@hmacr](https://github.com/hmacr) in [#11044](outline/outline#11044) - Added support for sorting dates in table columns by [@lucawimmer](https://github.com/lucawimmer) in [#11198](outline/outline#11198) - Document changes made through the API are now synced to clients in realtime in [#11186](outline/outline#11186) - The rate limiter now prefers user ID over ip address for logged in sessions, prevents issues on larger office networks in [#11215](outline/outline#11215) - The markdown importer now supports more file layouts in [#11278](outline/outline#11278) ##### Fixes - Fixed some typos comments and messages by [@NAM-MAN](https://github.com/NAM-MAN) in [#11203](outline/outline#11203) - Fixed an issue where mentions would sometimes break when using drag and drop in a list in [#11208](outline/outline#11208) - The edit diagram control no longer appears in read-only mode in [#11207](outline/outline#11207) - Infinite recursion in `dd-trace` dependency causes memory issues in [#11211](outline/outline#11211) - Imported content now gracefully handles HTTP links in [#11210](outline/outline#11210) - Editor suggestions on mobile now uses a drawer in [#11213](outline/outline#11213) - When importing markdown checkboxes are now supported in table cells in [#11217](outline/outline#11217) - GCS uniform bucket-level access now supported by [@maycuatroi1](https://github.com/maycuatroi1) in [#11222](outline/outline#11222) - Fixed a hanging read stream handle causing excessive memory usage on export in [#11237](outline/outline#11237) - Fixed mermaid diagrams do not render when pasting markdown in [#11243](outline/outline#11243) - Remote edits no longer exit Mermaid editing state in [#11244](outline/outline#11244) - Table row is now inserted correctly with merged first column cells in [#11245](outline/outline#11245) - Allow http\:// loopback redirect URIs for native OAuth apps (RFC 8252) in [#11255](outline/outline#11255) - "Split cell" option now works without accurate selection in [#11256](outline/outline#11256) - Adding text below images is now easier as trailing paragraph is enforcedd by [@RudraPrasad001](https://github.com/RudraPrasad001) in [#11257](outline/outline#11257) - Tooltip in editor toolbar with submenu is now hidden when submenu is open in [#11263](outline/outline#11263) - Non-platform passkeys such as Yubikey and mobile QRcode are now allowed in [#11265](outline/outline#11265) - diagrams.net theme now matches editor theme by [@Twometer](https://github.com/Twometer) in [#11267](outline/outline#11267) - Custom emoji characters are now displayed correctly in TOC in [#11275](outline/outline#11275) - Fixed an issue where the policy for documents restore was too broad in [#11279](outline/outline#11279) - Passkey setup is now available to non-admin users by [@Raphmatt](https://github.com/Raphmatt) in [#11286](outline/outline#11286) #### New Contributors - [@NAM-MAN](https://github.com/NAM-MAN) made their first contribution in [#11203](outline/outline#11203) - [@lucawimmer](https://github.com/lucawimmer) made their first contribution in [#11198](outline/outline#11198) - [@maycuatroi1](https://github.com/maycuatroi1) made their first contribution in [#11222](outline/outline#11222) - [@RudraPrasad001](https://github.com/RudraPrasad001) made their first contribution in [#11257](outline/outline#11257) - [@Twometer](https://github.com/Twometer) made their first contribution in [#11267](outline/outline#11267) - [@Raphmatt](https://github.com/Raphmatt) made their first contribution in [#11286](outline/outline#11286) **Full Changelog**: <outline/outline@v1.3.0...v1.4.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/3546 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [outlinewiki/outline](https://github.com/outline/outline) | minor | `1.3.0` → `1.4.0` | --- ### Release Notes <details> <summary>outline/outline (outlinewiki/outline)</summary> ### [`v1.4.0`](https://github.com/outline/outline/releases/tag/v1.4.0) [Compare Source](outline/outline@v1.3.0...v1.4.0) ##### What's Changed ##### Highlights - New **"Toggle blocks"** allow creating content that is collapsed by default in [#8317](outline/outline#8317) - Table cells can now have a custom background color set in [#10930](outline/outline#10930) - Search results are now highlighted in the document when navigating from search in [#11262](outline/outline#11262) ##### Other improvements - A new Figma integration allows unfurling information about Figma links in documents by [@hmacr](https://github.com/hmacr) in [#11044](outline/outline#11044) - Added support for sorting dates in table columns by [@lucawimmer](https://github.com/lucawimmer) in [#11198](outline/outline#11198) - Document changes made through the API are now synced to clients in realtime in [#11186](outline/outline#11186) - The rate limiter now prefers user ID over ip address for logged in sessions, prevents issues on larger office networks in [#11215](outline/outline#11215) - The markdown importer now supports more file layouts in [#11278](outline/outline#11278) ##### Fixes - Fixed some typos comments and messages by [@NAM-MAN](https://github.com/NAM-MAN) in [#11203](outline/outline#11203) - Fixed an issue where mentions would sometimes break when using drag and drop in a list in [#11208](outline/outline#11208) - The edit diagram control no longer appears in read-only mode in [#11207](outline/outline#11207) - Infinite recursion in `dd-trace` dependency causes memory issues in [#11211](outline/outline#11211) - Imported content now gracefully handles HTTP links in [#11210](outline/outline#11210) - Editor suggestions on mobile now uses a drawer in [#11213](outline/outline#11213) - When importing markdown checkboxes are now supported in table cells in [#11217](outline/outline#11217) - GCS uniform bucket-level access now supported by [@maycuatroi1](https://github.com/maycuatroi1) in [#11222](outline/outline#11222) - Fixed a hanging read stream handle causing excessive memory usage on export in [#11237](outline/outline#11237) - Fixed mermaid diagrams do not render when pasting markdown in [#11243](outline/outline#11243) - Remote edits no longer exit Mermaid editing state in [#11244](outline/outline#11244) - Table row is now inserted correctly with merged first column cells in [#11245](outline/outline#11245) - Allow http\:// loopback redirect URIs for native OAuth apps (RFC 8252) in [#11255](outline/outline#11255) - "Split cell" option now works without accurate selection in [#11256](outline/outline#11256) - Adding text below images is now easier as trailing paragraph is enforcedd by [@RudraPrasad001](https://github.com/RudraPrasad001) in [#11257](outline/outline#11257) - Tooltip in editor toolbar with submenu is now hidden when submenu is open in [#11263](outline/outline#11263) - Non-platform passkeys such as Yubikey and mobile QRcode are now allowed in [#11265](outline/outline#11265) - diagrams.net theme now matches editor theme by [@Twometer](https://github.com/Twometer) in [#11267](outline/outline#11267) - Custom emoji characters are now displayed correctly in TOC in [#11275](outline/outline#11275) - Fixed an issue where the policy for documents restore was too broad in [#11279](outline/outline#11279) - Passkey setup is now available to non-admin users by [@Raphmatt](https://github.com/Raphmatt) in [#11286](outline/outline#11286) ##### New Contributors - [@NAM-MAN](https://github.com/NAM-MAN) made their first contribution in [#11203](outline/outline#11203) - [@lucawimmer](https://github.com/lucawimmer) made their first contribution in [#11198](outline/outline#11198) - [@maycuatroi1](https://github.com/maycuatroi1) made their first contribution in [#11222](outline/outline#11222) - [@RudraPrasad001](https://github.com/RudraPrasad001) made their first contribution in [#11257](outline/outline#11257) - [@Twometer](https://github.com/Twometer) made their first contribution in [#11267](outline/outline#11267) - [@Raphmatt](https://github.com/Raphmatt) made their first contribution in [#11286](outline/outline#11286) **Full Changelog**: <outline/outline@v1.3.0...v1.4.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/3547 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

Initial plan

a18801a

Copilot AI assigned Copilot and tommoor Jan 24, 2026

Copilot started work on behalf of tommoor January 24, 2026 02:32 View session

Add RFC 8252 loopback redirect URI support for native OAuth apps

81647ef

Co-authored-by: tommoor <380914+tommoor@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Support localhost redirect URIs for native OAuth apps~~ Allow http:// loopback redirect URIs for native OAuth apps (RFC 8252) Jan 24, 2026

Copilot AI requested a review from tommoor January 24, 2026 02:40

Copilot finished work on behalf of tommoor January 24, 2026 02:40

tommoor marked this pull request as ready for review January 24, 2026 02:42

tommoor approved these changes Jan 24, 2026

View reviewed changes

tommoor merged commit 07514cb into main Jan 24, 2026
12 of 13 checks passed

tommoor deleted the copilot/support-localhost-redirects branch January 24, 2026 02:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Allow http:// loopback redirect URIs for native OAuth apps (RFC 8252)#11255

Allow http:// loopback redirect URIs for native OAuth apps (RFC 8252)#11255
tommoor merged 2 commits into
mainfrom
copilot/support-localhost-redirects

Copilot AI commented Jan 24, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Jan 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Jan 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Current Limitation

Suggested Fix

Context

References

Comments on the Issue (you are @copilot in this section)

Uh oh!

CLAassistant commented Jan 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jan 24, 2026 •

edited

Loading