[guruchill]

Summary

Removes the two remaining url.parse() calls, so the authorization endpoint no longer emits Node's runtime deprecation DEP0169. As the maintainer asked in #513, this is option 2, the non-breaking one: the redirect URI is parsed with the WHATWG URL API and returned in the same shape url.parse() gave, and url.format() still serializes it.

• lib/utils/url-util.js adds parseRedirectUri(redirectUri, parseQueryString). It parses with new URL() and returns the same fields as url.parse(): protocol, slashes, auth, host, port, hostname, hash, search, query, pathname, path, href. With parseQueryString it returns a null-prototype query object, as url.parse(value, true) does.
• CodeResponseType#buildRedirectUri and AuthorizeHandler#buildErrorRedirectUri call it in place of url.parse(). updateResponse() is unchanged.

Compatibility. I compared the two through the exact steps the library takes (the query / search changes in buildRedirectUri, buildErrorRedirectUri and updateResponse, then url.format()). For both the success and the error redirect, the serialized redirect was identical for these URIs:

• http(s), with and without a path, port or query;
• loopback hosts, including IPv6 [::1];
• userinfo and percent-encoded path and query;
• an empty query (…/cb?);
• uppercase hosts;
• private-use schemes from RFC 8252 (com.example.app:/oauth2redirect, com.example.app://callback).

The one behaviour change: a redirect URI that isn't an absolute URI now throws InvalidArgumentError (Invalid parameter: \redirectUri`), where url.parse()` accepted it. RFC 6749 §3.1.2 requires the redirection endpoint URI to be absolute.

Linked issue(s)

Closes #513. Thanks to @DmitryMarkov for the analysis there, including the two options.

Involved parts of the project

• The authorization endpoint (AuthorizeHandler), success and error redirects. Authorization Code Grant.
• CodeResponseType#buildRedirectUri.
• New internal helper lib/utils/url-util.js, which isn't exported, so index.d.ts is unchanged.
• docs/api regenerated with npm run docs:api: the updated @throws line, and the new util page.

Added tests?

Yes.

• test/unit/utils/url-util_test.js covers:
  • the parsed fields and the null-prototype query;
  • the empty-query and IPv6 cases, and RFC 8252 schemes;
  • url.format() output for the URIs above;
  • invalid URIs, and malformed percent-encoding in userinfo.
• The integration tests check that neither redirect path calls url.parse() (a Sinon spy, through handle() for both a granted and a denied request), and that buildRedirectUri and buildErrorRedirectUri throw on a non-absolute URI.
• The existing updateResponse() test now builds its input with the helper rather than url.parse().

npm test gives 479 passing (464 before), and the whole run no longer prints DEP0169. npm run lint and npm run format are clean. On npm run test:coverage, url-util.js is at 100% for statements, branches, functions and lines, and the suite overall is at 99.44% lines.

OAuth2 standard

• RFC 6749 §3.1.2 (absolute redirection URI) and §4.1.2 / §4.1.2.1 (code and error redirects). The parameters added to the redirect are unchanged.
• RFC 8252 §7.1 (private-use URI schemes) still works.

Reproduction

On Node 24 or later, call OAuth2Server#authorize with a valid response_type=code request. Before this change the first call writes DEP0169 to stderr; after it, nothing is written. npm test shows the same.

🤖 Generated with Claude Code

https://claude.ai/code/session_017dGfgEVLYhZcaAAT8TgTZN