Make profile URL fields clickable in ODP (safe link rendering)
We frequently need to store URLs (e.g. deep links to external systems) as profile attributes in ODP.
Today, string attributes are always rendered as plain text in the profile UI. Even if the value is a valid URL, users cannot click it and have to copy & paste the link manually, which creates unnecessary friction.
We are not requesting HTML support in profile fields, as this would come with security considerations. Instead, we would like to suggest a safe, controlled way to open URLs, for example:
- a dedicated Link / URL field type, or
- a string-based field type rendered as a link with a small “open” icon/button next to the value
Clicking the button would simply open the stored URL in a new tab. This could be safeguarded by:
- https-only URLs
- optional domain allowlists
- no inline rendering, no HTML execution
This would significantly improve usability for common scenarios without changing the underlying data model or introducing security risks.
Thanks for considering this — happy to provide more details if helpful.