URL field

Store and validate URLs with optional domain restrictions

The url field stores a single URL string and validates it against the standard URL format. You can optionally restrict which domains are allowed or blocked.

Configuration options

exceptDomains · []string

List of domains (hosts) that are NOT allowed. URLs with these domains will fail validation. Cannot be set if onlyDomains is specified.

onlyDomains · []string

List of domains (hosts) that are exclusively allowed. URLs must use one of these domains. Cannot be set if exceptDomains is specified.

required · bool · default: "false"

When true, requires the field value to be a non-empty, valid URL.

Validation rules

The url field validates:

• Format: Value must be a valid URL format (including scheme)
• Domain allowlist: If onlyDomains is set, URL host must be in the list
• Domain blocklist: If exceptDomains is set, URL host must NOT be in the list
• Required: If enabled, value cannot be empty

You cannot set both exceptDomains and onlyDomains at the same time. Choose one approach based on your use case.

Go examples

Basic usage

import "github.com/pocketbase/pocketbase/core"

field := &core.URLField{
    Name:     "website",
    Required: false,
}

collection.Fields.Add(field)

// Set field value
record.Set("website", "https://example.com")

Restrict to specific domains

field := &core.URLField{
    Name:        "socialProfile",
    OnlyDomains: []string{"twitter.com", "linkedin.com", "github.com"},
}

collection.Fields.Add(field)

// This will validate successfully
record.Set("socialProfile", "https://github.com/username")

// This will fail validation
record.Set("socialProfile", "https://facebook.com/username")

Block specific domains

field := &core.URLField{
    Name:          "externalLink",
    ExceptDomains: []string{"malicious.com", "spam-site.net"},
}

collection.Fields.Add(field)

// This will validate successfully
record.Set("externalLink", "https://trusted-site.com")

// This will fail validation
record.Set("externalLink", "https://malicious.com")

Multiple URL fields

// Website
collection.Fields.Add(&core.URLField{
    Name: "website",
})

// GitHub profile (restricted domain)
collection.Fields.Add(&core.URLField{
    Name:        "github",
    OnlyDomains: []string{"github.com"},
})

record.Set("website", "https://myblog.com")
record.Set("github", "https://github.com/myusername")

Database column type

TEXT DEFAULT '' NOT NULL

Common use cases

Social media profiles

field := &core.URLField{
    Name: "linkedin",
    OnlyDomains: []string{
        "linkedin.com",
        "www.linkedin.com",
    },
}

Domain matching

The domain matching is exact and includes the port if specified. For example:

• "example.com" matches https://example.com/path but NOT https://www.example.com/path
• "example.com:8080" matches https://example.com:8080 but NOT https://example.com

Make sure to include all variations (www, subdomains, ports) in your domain lists.

Best practices

• URLs must include the scheme (http://, https://, etc.)
• Use onlyDomains when restricting to specific platforms or services
• Use exceptDomains to block known malicious or unwanted domains
• Domain matching includes the port number if present in the URL
• Consider validating URL accessibility separately if needed

Zero value

The zero value for url fields is an empty string "".