1235
const body = await response.json();
1236
if (isAuthorizationProtectedResourceMetadata(body)) {
1237
>
// Validate that the resource matches the target resource
oauth.ts
1238
>
// Use URL constructor for normalization - it handles hostname case and trailing slashes
1239
>
const prmValue = new URL(body.resource).toString();
1240
>
const expectedResource = new URL(validateUrl).toString();
1241
>
if (prmValue !== expectedResource) {
1242
throw new Error(`Protected Resource Metadata 'resource' property value "${prmValue}" does not match expected value "${expectedResource}" for URL ${prmUrl}. Per RFC 9728, these MUST match. See https://datatracker.ietf.org/doc/html/rfc9728#PRConfigurationValidation`);
1243
}