Handling Invalid and Unsupported Video URLs in ASP.NET Web Applications

Treat URL syntax validation and permission to fetch a resource as separate checks. Uri.TryCreate can parse an absolute URI, but a syntactically valid address can still target an internal service or an unsupported video provider.

Start with a small allowlist of supported providers, HTTPS and permitted ports. Compare the parsed hostname, not whether the input string contains a trusted name. Reject unsupported destinations before making any outbound request. Apply the same restrictions to redirects, and enforce outbound network controls so the server cannot reach private infrastructure through this feature.

For approved destinations, use asynchronous HttpClient calls with cancellation, a timeout and bounded response size; async improves scalability but does not make a request safe. Prefer a provider’s documented metadata API over downloading an entire video to validate it. Return separate messages for malformed input, unsupported providers and temporary retrieval failures, while logging diagnostic details privately rather than exposing raw exceptions.