"localhost" is not considered a valid host for "openIdConnectUrl"

[JenswBE]

Problem

Linter doesn't like localhost in openIdConnectUrl

# File: openapi.yml
  securitySchemes:
    localAuth:
      type: openIdConnect
      openIdConnectUrl: http://localhost:9001/auth/realms/go-commerce/.well-known/openid-configuration

  Message :   openIdConnectUrl must be defined for openIdConnect property and must be a valid URL
  Rule    :   builtin
  Path    :   securitySchemes.localAuth
  Line    :   0

Workaround

A simple workaround is to use 127.0.0.1 instead.

Possible solutions

After some digging in the source code, I see you're using the helper isURL from package validate to check this url: https://github.com/IBM/openapi-validator/blob/main/src/plugins/validation/oas3/semantic-validators/security-definitions-ibm.js#L168

I see 2 solutions to this issue:

1. Use option { host_whitelist: ['localhost'] } as second argument to isURL. This seems the cleanest solution to me. Unfortunately, there is a related issue and PR. The fix is not yet merged on the latest release, but the option could already be provided. Therefore, the issue will be automatically solved when the version of validate can be bumped.
2. Use option { require_tld: false } as second argument to isURL. This will immediately solve the issue, but also allow non fully qualified domain names. Depending on how strict you want the check to be, this might be a show stopper.

[dpopp07]

Thanks for the issue and explanations. It is my preference that we wait on this to see if validator releases a new version soon to take advantage of default behavior. If they do not, I would be happy to accept a PR specifically allow-listing "localhost"

[JenswBE]

If I understood correctly the issue, it only fixes the order of host_whitelist vs other options. So, localhost won't be allow-listed by default and still an explicit allow-listing is needed using host_whitelist or require_tld.

But fine for me to wait for the next release as there is an easy workaround available.

[JenswBE]

Seems validator will never put it as default as it's not valid accordingly to the RFC. See validatorjs/validator.js#1609 for more info.

Are you open to consider { host_whitelist: ['localhost'] }? If not, feel free to close this ticket.

[dpopp07]

Hey @JenswBE after some internal discussion, we decided not to support localhost as a valid URL. Thank you for the issue!