diff --git a/.env.example b/.env.example index baf02c49..bd9843bf 100644 --- a/.env.example +++ b/.env.example @@ -235,6 +235,8 @@ TINYAUTH_LDAP_GROUPCACHETTL=900 # Enable the OAuth bridge, uses a new way to format OAuth user information. TINYAUTH_EXPERIMENTAL_OAUTHBRIDGEENABLED=false +# Disable the fallback to forward_auth modules when auth_request or ext_authz fail. +TINYAUTH_EXPERIMENTAL_DISABLEAUTHMODULEFALLBACK=false # tailscale config diff --git a/internal/controller/oauth_controller.go b/internal/controller/oauth_controller.go index fd6c2658..f48c3fde 100644 --- a/internal/controller/oauth_controller.go +++ b/internal/controller/oauth_controller.go @@ -294,7 +294,9 @@ func (controller *OAuthController) getCookieDomain() string { func (controller *OAuthController) isRedirectSafe(redirectURI string) bool { v := validators.NewDomainValidator(validators.DomainValidatorOptions{ - WithPort: true, + WithPort: true, + WithScheme: true, + AllowedSchemes: []string{"https", "http"}, }) _, err := v.SafeHostname(controller.runtime.AppURL) diff --git a/internal/controller/proxy_controller.go b/internal/controller/proxy_controller.go index c239e29f..7349a2ca 100644 --- a/internal/controller/proxy_controller.go +++ b/internal/controller/proxy_controller.go @@ -57,6 +57,7 @@ type ProxyContext struct { type ProxyController struct { log *logger.Logger runtime *model.RuntimeConfig + config *model.Config acls *service.AccessControlsService auth *service.AuthService policyEngine *service.PolicyEngine @@ -67,6 +68,7 @@ type ProxyControllerInput struct { Log *logger.Logger RuntimeConfig *model.RuntimeConfig + Config *model.Config RouterGroup *gin.RouterGroup `name:"apiRouterGroup"` ACLsService *service.AccessControlsService AuthService *service.AuthService @@ -77,6 +79,7 @@ func NewProxyController(i ProxyControllerInput) *ProxyController { controller := &ProxyController{ log: i.Log, runtime: i.RuntimeConfig, + config: i.Config, acls: i.ACLsService, auth: i.AuthService, policyEngine: i.PolicyEngine, @@ -465,6 +468,10 @@ func (controller *ProxyController) getExtAuthzContext(c *gin.Context) (ProxyCont // We get the path from the query string path := c.Query("path") + if strings.TrimSpace(path) == "" { + return ProxyContext{}, errors.New("path not found") + } + // For envoy we need to support every method method := c.Request.Method @@ -477,14 +484,22 @@ func (controller *ProxyController) getExtAuthzContext(c *gin.Context) (ProxyCont }, nil } -func (controller *ProxyController) determineAuthModules(proxy ProxyType) []AuthModuleType { +func (controller *ProxyController) determineAuthModules(proxy ProxyType, fallbacks bool) []AuthModuleType { switch proxy { case Traefik, Caddy: return []AuthModuleType{ForwardAuth} case Envoy: - return []AuthModuleType{ExtAuthz, ForwardAuth} + authModules := []AuthModuleType{ExtAuthz} + if fallbacks { + authModules = append(authModules, ForwardAuth) + } + return authModules case Nginx: - return []AuthModuleType{AuthRequest, ForwardAuth} + authModules := []AuthModuleType{AuthRequest} + if fallbacks { + authModules = append(authModules, ForwardAuth) + } + return authModules default: return []AuthModuleType{} } @@ -514,6 +529,39 @@ func (controller *ProxyController) getContextFromAuthModule(c *gin.Context, modu return ProxyContext{}, fmt.Errorf("unsupported auth module: %v", module) } +func (controller *ProxyController) authModuleIdentifiersPresent(c *gin.Context, module AuthModuleType) bool { + switch module { + case ForwardAuth: + _, host := controller.getHeader(c, "x-forwarded-host") + _, uri := controller.getHeader(c, "x-forwarded-uri") + return host || uri + case AuthRequest: + _, ok := controller.getHeader(c, "x-original-url") + return ok + case ExtAuthz: + return strings.TrimSpace(c.Query("path")) != "" + default: + return false + } +} + +func (controller *ProxyController) ensureNoMultipleAuthModules(c *gin.Context, authModules []AuthModuleType) error { + present := 0 + + for _, module := range authModules { + if controller.authModuleIdentifiersPresent(c, module) { + present++ + } + } + + if present > 1 { + controller.log.App.Warn().Msg("Request carries headers for multiple auth modules, possible spoofing attempt, denying") + return fmt.Errorf("conflicting auth module headers") + } + + return nil +} + func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext, error) { var req Proxy @@ -530,28 +578,36 @@ func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext controller.log.App.Debug().Msgf("Determined proxy type: %v", proxy) - authModules := controller.determineAuthModules(proxy) + authModules := controller.determineAuthModules(proxy, !controller.config.Experimental.DisableAuthModuleFallback) if len(authModules) == 0 { return ProxyContext{}, fmt.Errorf("no auth modules supported for proxy: %v", req.Proxy) } - var ctx ProxyContext - - for _, module := range authModules { - controller.log.App.Debug().Msgf("Trying to get context from auth module %v", module) - ctx, err = controller.getContextFromAuthModule(c, module) - if err == nil { - controller.log.App.Debug().Msgf("Successfully got context from auth module %v", module) - break - } - controller.log.App.Debug().Msgf("Failed to get context from auth module %v: %v", module, err) - } + err = controller.ensureNoMultipleAuthModules(c, controller.determineAuthModules(proxy, true)) if err != nil { return ProxyContext{}, err } + var ctx *ProxyContext + + for _, module := range authModules { + controller.log.App.Debug().Msgf("Trying to get context from auth module %v", module) + authModuleCtx, err := controller.getContextFromAuthModule(c, module) + if err != nil { + controller.log.App.Debug().Msgf("Failed to get context from auth module %v: %v", module, err) + continue + } + controller.log.App.Debug().Msgf("Successfully got context from auth module %v", module) + ctx = &authModuleCtx + break + } + + if ctx == nil { + return ProxyContext{}, fmt.Errorf("failed to get context from any auth module") + } + // Parse the raw path to populate the cleaned path used for ACLs upath, err := url.Parse(ctx.PathRaw) @@ -577,5 +633,5 @@ func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext ctx.IsBrowser = isBrowser ctx.ProxyType = proxy - return ctx, nil + return *ctx, nil } diff --git a/internal/controller/proxy_controller_test.go b/internal/controller/proxy_controller_test.go index 4d2e23a3..fd06ae39 100644 --- a/internal/controller/proxy_controller_test.go +++ b/internal/controller/proxy_controller_test.go @@ -213,7 +213,7 @@ func TestProxyController(t *testing.T) { description: "Ensure forward auth fallback for envoy", middlewares: []gin.HandlerFunc{}, run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) { - req := httptest.NewRequest("HEAD", "/api/auth/envoy?path=/hello", nil) + req := httptest.NewRequest("HEAD", "/api/auth/envoy", nil) req.Host = "" req.Header.Set("x-forwarded-host", "test.example.com") req.Header.Set("x-forwarded-proto", "https") @@ -261,7 +261,7 @@ func TestProxyController(t *testing.T) { description: "Ensure extauthz with envoy non browser returns json", middlewares: []gin.HandlerFunc{}, run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) { - req := httptest.NewRequest("HEAD", "/api/auth/envoy?path=/hello", nil) + req := httptest.NewRequest("HEAD", "/api/auth/envoy", nil) req.Header.Set("x-forwarded-host", "test.example.com") req.Header.Set("x-forwarded-proto", "https") req.Header.Set("x-forwarded-uri", "/hello") @@ -877,6 +877,32 @@ func TestProxyController(t *testing.T) { assert.Equal(t, "bar", recorder.Header().Get("x-foo")) }, }, + { + description: "Forward auth and auth request headers should fail for nginx", + run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) { + req := httptest.NewRequest("GET", "/api/auth/nginx", nil) + req.Header.Set("x-forwarded-host", "foo.example.com") + req.Header.Set("x-forwarded-proto", "https") + req.Header.Set("x-forwarded-uri", "/foo?bar=foo") + req.Header.Set("x-original-url", "https://foo.example.com/foo?bar=foo") + router.ServeHTTP(recorder, req) + + assert.Equal(t, http.StatusBadRequest, recorder.Code) + }, + }, + { + description: "Forward auth and ext authz headers should fail for envoy", + run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) { + req := httptest.NewRequest("HEAD", "/api/auth/envoy?path=/hello", nil) + req.Host = "foo.example.com" + req.Header.Set("x-forwarded-host", "foo.example.com") + req.Header.Set("x-forwarded-proto", "https") + req.Header.Set("x-forwarded-uri", "/foo?bar=foo") + router.ServeHTTP(recorder, req) + + assert.Equal(t, http.StatusBadRequest, recorder.Code) + }, + }, } store := memory.New() @@ -892,6 +918,7 @@ func TestProxyController(t *testing.T) { aclsService := service.NewAccessControlsService(service.AccessControlServiceInput{ Log: log, Config: &cfg, + Runtime: &runtime, LabelProvider: nil, }) @@ -952,6 +979,7 @@ func TestProxyController(t *testing.T) { NewProxyController(ProxyControllerInput{ Log: log, RuntimeConfig: &runtime, + Config: &cfg, RouterGroup: group, ACLsService: aclsService, AuthService: authService, diff --git a/internal/model/config.go b/internal/model/config.go index 642c00a9..80b986f0 100644 --- a/internal/model/config.go +++ b/internal/model/config.go @@ -239,7 +239,8 @@ type LogStreamConfig struct { } type ExperimentalConfig struct { - OAuthBridgeEnabled bool `description:"Enable the OAuth bridge, uses a new way to format OAuth user information." yaml:"oauthBridgeEnabled,omitempty"` + OAuthBridgeEnabled bool `description:"Enable the OAuth bridge, uses a new way to format OAuth user information." yaml:"oauthBridgeEnabled,omitempty"` + DisableAuthModuleFallback bool `description:"Disable the fallback to forward_auth modules when auth_request or ext_authz fail." yaml:"disableAuthModuleFallback,omitempty"` } type TailscaleConfig struct { diff --git a/internal/service/access_controls_service.go b/internal/service/access_controls_service.go index f8816a1f..922926bd 100644 --- a/internal/service/access_controls_service.go +++ b/internal/service/access_controls_service.go @@ -2,11 +2,13 @@ package service import ( "errors" + "fmt" + "net" "strings" + "unicode" "github.com/tinyauthapp/tinyauth/internal/model" "github.com/tinyauthapp/tinyauth/internal/utils/logger" - "github.com/tinyauthapp/tinyauth/pkg/validators" "go.uber.org/dig" ) @@ -17,6 +19,7 @@ type LabelProvider interface { type AccessControlsService struct { log *logger.Logger config *model.Config + runtime *model.RuntimeConfig labelProvider LabelProvider } @@ -25,6 +28,7 @@ type AccessControlServiceInput struct { Log *logger.Logger Config *model.Config + Runtime *model.RuntimeConfig LabelProvider LabelProvider `optional:"true"` } @@ -33,12 +37,38 @@ func NewAccessControlsService(i AccessControlServiceInput) *AccessControlsServic return &AccessControlsService{ log: i.Log, config: i.Config, + runtime: i.Runtime, labelProvider: i.LabelProvider, } } +func (service *AccessControlsService) ensureAscii(str string) bool { + for i := 0; i < len(str); i++ { + if str[i] > unicode.MaxASCII { + return false + } + } + return true +} + +func (service *AccessControlsService) normalizeDomain(domain string) string { + if host, _, err := net.SplitHostPort(domain); err == nil { + domain = host + } + domain = strings.TrimRight(domain, ".") + return strings.ToLower(domain) +} + func (service *AccessControlsService) getACLs(domain string, lookup func(locator func(name string, app *model.App) bool) error) (*model.App, error) { - v := validators.NewDomainValidator(validators.DomainValidatorOptions{}) + if !service.ensureAscii(domain) { + return nil, errors.New("domain contains non-ascii characters") + } + + normalizedDomain := service.normalizeDomain(domain) + + if !strings.HasSuffix(normalizedDomain, "."+service.runtime.CookieDomain) && normalizedDomain != service.runtime.CookieDomain { + return nil, fmt.Errorf("domain does not match cookie domain, expected %s (or a subdomain), got %s", service.runtime.CookieDomain, domain) + } var domainMatch *model.App var nameMatch *model.App @@ -46,16 +76,18 @@ func (service *AccessControlsService) getACLs(domain string, lookup func(locator locatorFunc := func(name string, app *model.App) bool { if app.Config.Domain != "" { - err := v.Validate(app.Config.Domain, domain) - if err == nil { + if !service.ensureAscii(app.Config.Domain) { + service.log.App.Warn().Str("name", name).Str("domain", app.Config.Domain).Msg("Domain contains non-ascii characters, skipping") + return false + } + if normalizedDomain == service.normalizeDomain(app.Config.Domain) { service.log.App.Debug().Str("name", name).Msg("Found matching container by domain") domainMatch = app return true - } else if !errors.Is(err, validators.ErrHostnameMismatch) { - service.log.App.Debug().Str("name", name).Err(err).Msg("Domain validation failed") } + return false } - if strings.HasPrefix(strings.ToLower(domain), strings.ToLower(name+".")) { + if strings.HasPrefix(normalizedDomain, strings.ToLower(name+".")) { service.log.App.Debug().Str("name", name).Msg("Found matching container by app name") nameMatch = app nameMatchedApps = append(nameMatchedApps, name) @@ -79,7 +111,7 @@ func (service *AccessControlsService) getACLs(domain string, lookup func(locator } if len(nameMatchedApps) > 1 { - service.log.App.Warn().Str("domain", domain).Strs("apps", nameMatchedApps).Msg("Multiple apps matched domain by name, app names must be unique, using last match") + return nil, fmt.Errorf("domain matched multiple apps by name prefix, use explicit domain config") } service.log.App.Debug().Str("domain", domain).Msg("Found matching app by app name") diff --git a/internal/service/access_controls_service_test.go b/internal/service/access_controls_service_test.go index 30415933..c5d00b7c 100644 --- a/internal/service/access_controls_service_test.go +++ b/internal/service/access_controls_service_test.go @@ -4,8 +4,10 @@ import ( "errors" "testing" + "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/tinyauthapp/tinyauth/internal/model" + "github.com/tinyauthapp/tinyauth/internal/test" "github.com/tinyauthapp/tinyauth/internal/utils/logger" ) @@ -34,14 +36,25 @@ func TestAccessControlsService(t *testing.T) { log := logger.NewLogger().WithTestConfig() log.Init() + _, runtime := test.CreateTestConfigs(t) + tests := []struct { - name string - domain string - acls map[string]model.App - want *model.App + name string + domain string + acls map[string]model.App + want *model.App + errorFunc func(t *testing.T, e error) }{ { name: "returns ACLs for domain", + domain: "app.example.com", + acls: map[string]model.App{ + "foo": {Config: model.AppConfig{Domain: "app.example.com"}}, + }, + want: &model.App{Config: model.AppConfig{Domain: "app.example.com"}}, + }, + { + name: "returns ACLs for root domain", domain: "example.com", acls: map[string]model.App{ "foo": {Config: model.AppConfig{Domain: "example.com"}}, @@ -65,20 +78,11 @@ func TestAccessControlsService(t *testing.T) { want: &model.App{Config: model.AppConfig{Domain: "example.com"}}, }, { - name: "returns ACLs for non-ascii domain", + name: "returns error for non-ascii domain", domain: "bücher.example.com", - acls: map[string]model.App{ - "foo": {Config: model.AppConfig{Domain: "bücher.example.com"}}, + errorFunc: func(t *testing.T, e error) { + assert.ErrorContains(t, e, "domain contains non-ascii characters") }, - want: &model.App{Config: model.AppConfig{Domain: "bücher.example.com"}}, - }, - { - name: "returns ACLs for punycode domain and non-ascii config", - domain: "bücher.example.com", - acls: map[string]model.App{ - "foo": {Config: model.AppConfig{Domain: "xn--bcher-kva.example.com"}}, - }, - want: &model.App{Config: model.AppConfig{Domain: "xn--bcher-kva.example.com"}}, }, { name: "returns ACLs with case-insensitive matching", @@ -110,6 +114,33 @@ func TestAccessControlsService(t *testing.T) { acls: map[string]model.App{}, want: nil, }, + { + name: "App in domain not matching with the cookie domain should return nothing with name matching", + domain: "foo.bad_example.com", + acls: map[string]model.App{ + "foo": { + Path: model.AppPath{Allow: "/foo"}, + }, + }, + want: nil, + errorFunc: func(t *testing.T, e error) { + assert.ErrorContains(t, e, "domain does not match cookie domain") + }, + }, + { + name: "App in domain not matching with the cookie domain should return nothing with domain matching", + domain: "foo.bad_example.com", + acls: map[string]model.App{ + "foo": { + Path: model.AppPath{Allow: "/foo"}, + Config: model.AppConfig{Domain: "foo.bad_example.com"}, + }, + }, + want: nil, + errorFunc: func(t *testing.T, e error) { + assert.ErrorContains(t, e, "domain does not match cookie domain") + }, + }, } // run once for a mock provider @@ -118,10 +149,15 @@ func TestAccessControlsService(t *testing.T) { mock := newMockProvider(test.acls, false) acls := NewAccessControlsService(AccessControlServiceInput{ Log: log, + Runtime: &runtime, Config: &model.Config{}, LabelProvider: mock, }) app, err := acls.getACLs(test.domain, mock.Lookup) + if test.errorFunc != nil { + test.errorFunc(t, err) + return + } require.NoError(t, err) require.Equal(t, test.want, app) }) @@ -131,12 +167,17 @@ func TestAccessControlsService(t *testing.T) { for _, test := range tests { t.Run(test.name+"(staticACLs)", func(t *testing.T) { acls := NewAccessControlsService(AccessControlServiceInput{ - Log: log, + Log: log, + Runtime: &runtime, Config: &model.Config{ Apps: test.acls, }, }) app, err := acls.lookupStaticACLs(test.domain) + if test.errorFunc != nil { + test.errorFunc(t, err) + return + } require.NoError(t, err) require.Equal(t, test.want, app) }) @@ -145,16 +186,32 @@ func TestAccessControlsService(t *testing.T) { // get acls should return an error when the provider fails mock := newMockProvider(map[string]model.App{}, true) acls := NewAccessControlsService(AccessControlServiceInput{ - Log: log, - Config: &model.Config{}, + Log: log, + Runtime: &runtime, + Config: &model.Config{}, }) _, err := acls.getACLs("example.com", mock.Lookup) - require.Error(t, err) + assert.Error(t, err) + + // get acls should return an error when multiple apps with the same domain exist + acls = NewAccessControlsService(AccessControlServiceInput{ + Log: log, + Runtime: &runtime, + Config: &model.Config{ + Apps: map[string]model.App{ + "foo": {Path: model.AppPath{Allow: "/foo"}}, + "foo.bar": {Path: model.AppPath{Allow: "/bar"}}, + }, + }, + }) + _, err = acls.GetAccessControls("foo.bar.example.com") + assert.ErrorContains(t, err, "domain matched multiple apps by name prefix, use explicit domain config") // get access controls should get acls from // static when static acls are configured acls = NewAccessControlsService(AccessControlServiceInput{ - Log: log, + Log: log, + Runtime: &runtime, Config: &model.Config{ Apps: map[string]model.App{ "foo": {Config: model.AppConfig{Domain: "foo.example.com"}}, @@ -163,12 +220,12 @@ func TestAccessControlsService(t *testing.T) { }) app, err := acls.GetAccessControls("foo.example.com") require.NoError(t, err) - require.Equal(t, &model.App{Config: model.AppConfig{Domain: "foo.example.com"}}, app) + assert.Equal(t, &model.App{Config: model.AppConfig{Domain: "foo.example.com"}}, app) // should return nil for no apps app, err = acls.GetAccessControls("bar.example.com") require.NoError(t, err) - require.Nil(t, app) + assert.Nil(t, app) // Should use label provider if available mock = newMockProvider(map[string]model.App{ @@ -178,10 +235,11 @@ func TestAccessControlsService(t *testing.T) { }, false) acls = NewAccessControlsService(AccessControlServiceInput{ Log: log, + Runtime: &runtime, Config: &model.Config{}, LabelProvider: mock, }) app, err = acls.GetAccessControls("bar.example.com") require.NoError(t, err) - require.Equal(t, &model.App{Config: model.AppConfig{Domain: "bar.example.com"}}, app) + assert.Equal(t, &model.App{Config: model.AppConfig{Domain: "bar.example.com"}}, app) } diff --git a/internal/utils/app_utils.go b/internal/utils/app_utils.go index 3bc3546a..7c168423 100644 --- a/internal/utils/app_utils.go +++ b/internal/utils/app_utils.go @@ -38,7 +38,16 @@ func SafeParseAppURL(str string) (string, error) { return "", fmt.Errorf("ip addresses not allowed") } - hostname, err = idna.Lookup.ToASCII(hostname) + i := idna.New( + idna.MapForLookup(), + idna.Transitional(false), + idna.BidiRule(), + idna.StrictDomainName(false), + idna.CheckHyphens(true), + idna.CheckJoiners(false), + ) + + hostname, err = i.ToASCII(hostname) if err != nil { return "", fmt.Errorf("failed to convert hostname to ascii: %w", err) diff --git a/internal/utils/app_utils_test.go b/internal/utils/app_utils_test.go index 8c9e9bc5..6dbe4492 100644 --- a/internal/utils/app_utils_test.go +++ b/internal/utils/app_utils_test.go @@ -43,6 +43,13 @@ func TestSafeParseAPPURL(t *testing.T) { assert.NoError(t, err) assert.Equal(t, expected, result) + // Underscores + appURL = "http://sub_tinyauth.app" + expected = "http://sub_tinyauth.app" + result, err = utils.SafeParseAppURL(appURL) + assert.NoError(t, err) + assert.Equal(t, expected, result) + // Lowercase appURL = "HTTP://SUb.tinyAUth.aPP" expected = "http://sub.tinyauth.app" @@ -66,7 +73,7 @@ func TestSafeParseAPPURL(t *testing.T) { assert.ErrorContains(t, err, "invalid url") // Invalid punycode - appURL = "http://ab--cd.example.com" + appURL = "http://xn--h-kva.example.com" _, err = utils.SafeParseAppURL(appURL) assert.ErrorContains(t, err, "failed to convert hostname to ascii") diff --git a/pkg/validators/domain_validator.go b/pkg/validators/domain_validator.go index d41d82b3..9d0503f8 100644 --- a/pkg/validators/domain_validator.go +++ b/pkg/validators/domain_validator.go @@ -11,8 +11,6 @@ import ( "net" "net/url" "strings" - - "golang.org/x/net/idna" ) // Errors @@ -115,14 +113,10 @@ func (v *DomainValidator) getURL(i string) (*url.URL, error) { func (v *DomainValidator) getHostname(hostname string) (string, error) { hostname = strings.ToLower(hostname) - hostname = strings.TrimSuffix(hostname, ".") + hostname = strings.TrimRight(hostname, ".") if net.ParseIP(hostname) != nil { return "", fmt.Errorf("ip addresses are not supported") } - hostname, err := idna.Lookup.ToASCII(hostname) - if err != nil { - return "", fmt.Errorf("failed to convert hostname to ascii: %w", err) - } return hostname, nil } diff --git a/pkg/validators/domain_validator_test.go b/pkg/validators/domain_validator_test.go index aa7587f1..b47c52ec 100644 --- a/pkg/validators/domain_validator_test.go +++ b/pkg/validators/domain_validator_test.go @@ -101,18 +101,6 @@ func TestDomainValidator_SafeHostname(t *testing.T) { assert.ErrorContains(t, e, "ip addresses are not supported") }, }, - { - description: "Domains with unicode characters should be allowed", - input: "bücher.example.com", - expected: "xn--bcher-kva.example.com", - }, - { - description: "Invalid IDNA domain should fail", - input: "ab--cd.example.com", - errorFunc: func(t *testing.T, e error) { - assert.ErrorContains(t, e, "invalid label") - }, - }, { description: "With port enabled without any port should work", options: DomainValidatorOptions{WithPort: true}, @@ -194,22 +182,6 @@ func TestDomainValidator_Validate(t *testing.T) { expected: "https://example.com:443", actual: "https://example.com:443", }, - { - description: "Failure to format expected domain should fail", - expected: "ab--cd.example.com", - actual: "example.com", - errorFunc: func(t *testing.T, e error) { - assert.ErrorContains(t, e, "idna: invalid label") - }, - }, - { - description: "Failure to format check domain should fail", - expected: "example.com", - actual: "ab--cd.example.com", - errorFunc: func(t *testing.T, e error) { - assert.ErrorContains(t, e, "idna: invalid label") - }, - }, { description: "Valid domains with matching schemes and ports should pass", options: DomainValidatorOptions{WithScheme: true, AllowedSchemes: []string{"https", "http"}, WithPort: true}, @@ -236,16 +208,6 @@ func TestDomainValidator_Validate(t *testing.T) { actual: "example.com", expected: "example.com", }, - { - description: "Unicode valid domains should pass", - expected: "xn--bcher-kva.example.com", - actual: "bücher.example.com", - }, - { - description: "Unicode valid domains should pass (reverse)", - expected: "bücher.example.com", - actual: "xn--bcher-kva.example.com", - }, { description: "Non matching hostnames should fail", expected: "example.com",