Skip to content

Harden regional authority validation - #1056

Merged
Nilesh Choudhary (4gust) merged 1 commit into
devfrom
4gust-verify-region-validation
Aug 14, 2026
Merged

Harden regional authority validation#1056
Nilesh Choudhary (4gust) merged 1 commit into
devfrom
4gust-verify-region-validation

Conversation

@4gust

Copy link
Copy Markdown
Contributor

Summary

  • Reject invalid region values before they can be used in regional authority hostnames.
  • Fall back to the global endpoint when invalid values come from REGION_NAME or IMDS.
  • Add coverage for malicious inputs, DNS label boundaries, and China and US Gov regional hosts.

Testing

  • mvn -pl msal4j-sdk '-Dtest=AadInstanceDiscoveryTest,RegionDiscoveryTest' test

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 0d07c9a2-f21b-44ee-8b3f-7e0589f1abe9
@4gust
Nilesh Choudhary (4gust) requested a review from a team as a code owner August 7, 2026 14:30
@4gust
Nilesh Choudhary (4gust) merged commit 84d08ec into dev Aug 14, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants