An app-supplied authorization hook for BYOD source URLs. addByodSource runs it on
every http: or https: URL, before the network fetch. Return { valid: true } to
allow the fetch or { valid: false, reason } to block it (see
ByodSourceUrlValidation). It may be sync or async, such as an allowlist lookup.
It replaces the built-in policy, which allows only public https: URLs: no
http:, no page origin, no localhost-style hostname and no loopback, private,
link-local or other non-public IP address. The size cap, the timeout, the omitted
credentials and the refused redirects apply either way. Set it via the
byod.validateSourceUrl option on createMapAgent, or assign
state.byod.sourceUrlValidator directly.
An app-supplied authorization hook for BYOD source URLs.
addByodSourceruns it on everyhttp:orhttps:URL, before the network fetch. Return{ valid: true }to allow the fetch or{ valid: false, reason }to block it (see ByodSourceUrlValidation). It may be sync or async, such as an allowlist lookup.It replaces the built-in policy, which allows only public
https:URLs: nohttp:, no page origin, nolocalhost-style hostname and no loopback, private, link-local or other non-public IP address. The size cap, the timeout, the omitted credentials and the refused redirects apply either way. Set it via thebyod.validateSourceUrloption oncreateMapAgent, or assignstate.byod.sourceUrlValidatordirectly.