message: Validate that OAuth URLs are absolute
  Check that we get an absolute URL back from the OAuth server metadata.
  Treat relative URLs as errors. This fixes a problem where incorrect
  endpoints are used when the console starts before the OAuth server.
diff: @@ -5,6 +5,7 @@ import (
  "encoding/json"
  "fmt"
  "net/http"
  + "net/url"
  "strings"
  "time"
  @@ -25,6 +26,19 @@ type openShiftConfig struct {
  secureCookies bool
  }
  +func validateAbsURL(value string) error {
  + ur, err := url.Parse(value)
  + if err != nil {
  + return err
  + }
  +
  + if ur == nil || !ur.IsAbs() {
  + return fmt.Errorf("url is not absolute: %v", ur)
  + }
  +
  + return nil
  +}
  +
  func newOpenShiftAuth(ctx context.Context, c *openShiftConfig) (oauth2.Endpoint, *openShiftAuth, error) {
  // Use metadata discovery to determine the OAuth2 token and authorization URL.
  // https://docs.openshift.com/container-platform/3.9/architecture/additional_concepts/authentication.html#oauth-server-metadata
  @@ -56,6 +70,14 @@ func newOpenShiftAuth(ctx context.Context, c *openShiftConfig) (oauth2.Endpoint,
  wellKnownURL, err)
  }
  + if err := validateAbsURL(metadata.Auth); err != nil {
  + return oauth2.Endpoint{}, nil, err
  + }
  +
  + if err := validateAbsURL(metadata.Token); err != nil {
  + return oauth2.Endpoint{}, nil, err
  + }
  +
  return oauth2.Endpoint{
  AuthURL: metadata.Auth,
  TokenURL: metadata.Token,
  