URL scheme allowlisting is the practice of permitting only specific schemes such as http and https while blocking dangerous alternatives like javascript:, file:, and smb:. For AI agent clients, it is a basic control that prevents remote metadata from becoming code execution or token theft.
Expanded Definition
URL scheme allowlisting is a client-side validation control that accepts only a known set of URI schemes, typically http and https, while rejecting schemes that can invoke local file access, script execution, or alternate transport paths. In NHI and agentic AI systems, the control matters because agents often consume remote instructions, callbacks, and metadata that may be embedded in URLs. If a client follows an unsafe scheme, the result can be token leakage, local resource exposure, or untrusted code execution rather than simple navigation.
Definitions vary across vendors when the control is bundled into broader URL validation, redirect hardening, or content security measures, but the operational intent is consistent: reduce the attack surface created by scheme handling. NIST Cybersecurity Framework 2.0 frames this kind of safeguard within protective and defensive practices that limit unsafe execution paths, while implementers should pair it with input validation and explicit egress policy. The most common misapplication is allowing “any valid URL” while filtering only hostnames, which occurs when scheme parsing is skipped or performed after a redirect has already been followed.
Examples and Use Cases
Implementing URL scheme allowlisting rigorously often introduces compatibility constraints, requiring organisations to weigh agent flexibility against the security gain of blocking dangerous handlers.
- Agent callback URLs are restricted to http and https so a malicious prompt cannot redirect the client to javascript: or file: content during tool invocation.
- Webhook consumers validate the scheme before enqueueing a remote fetch, preventing a smuggled smb: or ftp: target from reaching internal network resources.
- Browser-like agent runtimes enforce scheme checks before opening user-supplied links, aligning with the identity and secret-protection concerns described in the Ultimate Guide to NHIs.
- OAuth and API clients reject non-HTTP schemes in redirect or callback parameters, reducing the chance that tokens are handed to a local handler or external application.
- Security review teams compare scheme handling against NIST Cybersecurity Framework 2.0 expectations for protective control validation and safe system operation.
For practitioners, the key design question is not whether to block dangerous schemes, but where to enforce the policy: at input validation, before navigation, and again after any redirect chain is resolved. That layered approach matters because one bypass in a parsing path can erase the benefit of the entire control.
Why It Matters in NHI Security
URL scheme allowlisting is especially important for AI agents because they routinely act on untrusted content with execution authority and access to secrets. A single unsafe scheme can transform a benign-looking reference into data exfiltration, local file access, or a pivot into internal services. This is why NHI governance treats URL handling as part of the trust boundary, not merely a usability feature.
The scale of the risk is reinforced by NHI breach patterns documented in the Ultimate Guide to NHIs, which reports that 79% of organisations have experienced secrets leaks, with 77% causing tangible damage. When an agent follows a malicious URL scheme, the exposed asset is often a token, API key, or session credential rather than a page view. That is why scheme control should be paired with least privilege, token scoping, and outbound request governance. The most serious failures tend to appear only after an incident reveals that a client trusted a URL more than the identity of the content that supplied it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 | URL handling controls help prevent unsafe scheme execution in NHI clients. |
| OWASP Agentic AI Top 10 | A-03 | Agent tool use requires strict validation of external URLs and callbacks. |
| NIST CSF 2.0 | PR.DS-1 | Protective controls should prevent unsafe data handling and execution paths. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust limits trust in inputs and requires controlled network flows. |
| NIST AI RMF | MAP | AI risk mapping should identify URL-driven agent actions as a misuse path. |
Reject non-HTTP schemes so agents cannot pivot from content retrieval to code or token theft.
Related resources from NHI Mgmt Group
- When should organisations use URL-mode instead of form-mode elicitation?
- Who is accountable when an external URL-based elicitation step fails or is bypassed?
- How should security teams govern URL-based OAuth client identities in MCP?
- Why do URL-based client IDs change the risk model for OAuth in MCP?
