matchesRegisteredRedirectUri (services/redirect-uri.ts)

Validates a redirect URI against a list of registered URIs, implementing OAuth 2.1 loopback port exceptions for secure authorization flows.

// Source: https://github.com/rekog-labs/MCP-Nest | License: MIT | Copyright 2025 Rekog Labs
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Hosts that name the user's own machine. Only these get the loopback port
 * exception below; every other host is matched byte for byte.
 *
 * OAuth 2.1 §8.4.2 (from RFC 8252 §7.3) names the IP literals. `localhost` is
 * included although that section calls it NOT RECOMMENDED, because the MCP
 * authorization spec allows it ("MUST be either `localhost` or use HTTPS") and
 * real clients use it — Claude Code's Client ID Metadata Document declares
 * `http://localhost/callback`.
 *
 * Deliberately narrower than the consent screen's loopback set: `0.0.0.0` is
 * "every interface", not loopback, so it gets no port leniency.
 */
con

... (truncated -- full source via MCP)