Coding standards
Security in ResourceSpace
Developer reference
Database
User api session functions

get_api_session_destination()

Description

Resolve an allowlisted API credential destination and its delivery mode.

Parameters

ColumnTypeDefaultDescription
$system string Destination configuration key.
$url string|null Selected callback; required for destinations with multiple URLs.

Return

array|false Destination with a single resolved URL, or false for invalid configuration/input.

Location

include/user_api_session_functions.php lines 10 to 56

Definition

 
function get_api_session_destination(string $system, ?string $url = null): array|false
{
    global $api_issue_valid_destinations;

    $destination = $api_issue_valid_destinations[$system] ?? false;
    if (!is_array($destination)) {
        return false;
    }

    $delivery = $destination['delivery'] ?? 'post';
    $urls = $destination['url'] ?? [];
    $callback = is_array($urls) ? $url : $urls;
    if (
        !in_array($delivery, ['post', 'redirect_code'], true)
        || !is_string($callback)
        || $callback === ''
        || (is_array($urls) && !in_array($callback, $urls, true))
    ) {
        return false;
    }

    if ($delivery === 'redirect_code') {
        $parts = parse_url($callback);
        $stateparam = $destination['stateparam'] ?? '';
        if (
            strlen($system) > 100
            || !filter_var($callback, FILTER_VALIDATE_URL)
            || preg_match('/[\r\n]/', $callback)
            || $parts === false
            || isset($parts['user']) || isset($parts['pass']) || isset($parts['fragment'])
            || (
                ($parts['scheme'] ?? '') !== 'https'
                && !(($parts['scheme'] ?? '') === 'http'
                    && in_array($parts['host'] ?? '', ['localhost', '127.0.0.1', '[::1]'], true))
            )
            || !is_string($stateparam)
            || !preg_match('/\A[A-Za-z_][A-Za-z0-9_]*\z/', $stateparam)
            || in_array($stateparam, ['code', 'error', 'system', 'url', 'submit', 'cancel'], true)
        ) {
            return false;
        }
    }

    $destination['url'] = $callback;
    $destination['delivery'] = $delivery;
    return $destination;
}

This article was last updated 29th October 2026 18:35 Europe/London time based on the source file dated 29th October 2026 14:30 Europe/London time.