fix: make issuer url validation follow the same check rules as the domain url validator

__tests__/utils.test.ts

@@ -10,7 +10,8 @@ import {
   runIframe,
   urlDecodeB64,
   getCrypto,
-  validateCrypto
+  validateCrypto,
+  getTokenIssuer
 } from '../src/utils';
 
 import { DEFAULT_AUTHORIZE_TIMEOUT_IN_SECONDS } from '../src/constants';
@@ -493,4 +494,33 @@ describe('utils', () => {
     `);
     });
   });
+
+  describe('getTokenIssuer', () => {
+    it('should add https:// to a non well formed URL', () => {
+      const issuer = getTokenIssuer('www.issuer.com', 'https://www.domain.com');
+      expect(issuer).toBe('https://www.issuer.com/');
+    });
+    it('should not add https:// to a well formed URL with HTTPS protocol', () => {
+      const issuer = getTokenIssuer(
+        'https://www.issuer.com',
+        'https://www.domain.com'
+      );
+      expect(issuer).toBe('https://www.issuer.com');
+    });
+    it('should not add https:// to a well formed URL with HTTP protocol', () => {
+      const issuer = getTokenIssuer(
+        'http://www.issuer.com',
+        'https://www.domain.com'
+      );
+      expect(issuer).toBe('http://www.issuer.com');
+    });
+    it('should return domain when issuer is undefined', () => {
+      const issuer = getTokenIssuer(undefined, 'https://www.domain.com');
+      expect(issuer).toBe('https://www.domain.com/');
+    });
+    it('should return domain when issuer is an empty string', () => {
+      const issuer = getTokenIssuer('', 'https://www.domain.com');
+      expect(issuer).toBe('https://www.domain.com/');
+    });
+  });
 });

src/utils.ts

@@ -234,7 +234,7 @@ export const getTokenIssuer = (
   domainUrl: string
 ) => {
   if (issuer) {
-    return issuer.startsWith('https://') ? issuer : `https://${issuer}/`;
+    return /^https?:\/\//.test(issuer) ? issuer : `https://${issuer}/`;
   }
 
   return `${domainUrl}/`;