Skip to content

Harden regional authority validation - #1056

Open
Nilesh Choudhary (4gust) wants to merge 1 commit into
devfrom
4gust-verify-region-validation
Open

Harden regional authority validation#1056
Nilesh Choudhary (4gust) wants to merge 1 commit into
devfrom
4gust-verify-region-validation

Conversation

@4gust

Copy link
Copy Markdown
Contributor

Summary

  • Reject invalid region values before they can be used in regional authority hostnames.
  • Fall back to the global endpoint when invalid values come from REGION_NAME or IMDS.
  • Add coverage for malicious inputs, DNS label boundaries, and China and US Gov regional hosts.

Testing

  • mvn -pl msal4j-sdk '-Dtest=AadInstanceDiscoveryTest,RegionDiscoveryTest' test

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 0d07c9a2-f21b-44ee-8b3f-7e0589f1abe9
@4gust
Nilesh Choudhary (4gust) requested a review from a team as a code owner August 7, 2026 14:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants