Optionally(?) allow plaintext on localhost subdomains #2083

Description

validate_issuer_url() exempts localhost from the HTTPS requirement:

    # RFC 8414 requires HTTPS, but we allow localhost HTTP for testing
    if (
        url.scheme != "https"
        and url.host != "localhost"
        and (url.host is not None and not url.host.startswith("127.0.0.1"))
    ):

According to RFC 6761, subdomains of localhost are also reserved for special use and will not be registered on the public DNS.

We use subdomains of localhost to run multiple instances of our application stack in parallel. Putting them on separate ports instead would be less convenient. We'd also like to avoid setting up TLS for localhost because of the security implications, and because it's a pain to get all clients to work well with that.

Our current workaround is to use a monkey-patch to relax the check:

_original_validate_issuer_url = _mcp_auth_routes.validate_issuer_url


def _validate_issuer_url_with_localhost_tld(url):  # type: ignore[no-untyped-def]
    if url.scheme != "https" and url.host and url.host.endswith(".localhost"):
        return
    _original_validate_issuer_url(url)

It would be nice if there was a way to achieve this without having to resort to monkey-patching. Maybe default to endswith(".localhost"), or introduce an optional setting?

References

No response