DpopInterceptor: isPdsApiRequest uses String.contains() for URL routing #42

New issue

Closed

opened 2026-06-22 20:10:24 +00:00 by starsetbyte · 0 comments

starsetbyte commented

2026-06-22 20:10:24 +00:00

Owner

What

DpopInterceptor.isPdsApiRequest() used String.contains() with heuristic substrings (/.well-known/, /oauth/, plc.directory) to decide whether to apply DPoP. This is fragile — substrings can match in unexpected positions (query params, opaque path segments).

Fix

Replaced with path-based routing: extract the URL path and check path.startsWith("/xrpc/"). Positive match on what we WANT (XRPC endpoints) instead of negative exclusion of what we do not. Hand-written path extraction to avoid OkHttp deprecation issues.

Updated DpopInterceptorTest URLs from /api/test to /xrpc/app.bsky.feed.getTimeline so they actually match the new routing logic.

Fixed in PR #36.

## What `DpopInterceptor.isPdsApiRequest()` used `String.contains()` with heuristic substrings (`/.well-known/`, `/oauth/`, `plc.directory`) to decide whether to apply DPoP. This is fragile — substrings can match in unexpected positions (query params, opaque path segments). ## Fix Replaced with path-based routing: extract the URL path and check `path.startsWith("/xrpc/")`. Positive match on what we WANT (XRPC endpoints) instead of negative exclusion of what we do not. Hand-written path extraction to avoid OkHttp deprecation issues. Updated `DpopInterceptorTest` URLs from `/api/test` to `/xrpc/app.bsky.feed.getTimeline` so they actually match the new routing logic. **Fixed in PR #36.**

starsetbyte

2026-06-22 20:10:24 +00:00