config/schema/cdn.data_types.schema.yml            |  2 +
 .../Constraint/CdnStreamWrapperConstraint.php      | 21 +++++++
 .../CdnStreamWrapperConstraintValidator.php        | 50 ++++++++++++++++
 .../CdnStreamWrapperConstraintValidatorTest.php    | 66 ++++++++++++++++++++++
 4 files changed, 139 insertions(+)

diff --git a/config/schema/cdn.data_types.schema.yml b/config/schema/cdn.data_types.schema.yml
index 77cd0dd..9f2006d 100644
--- a/config/schema/cdn.data_types.schema.yml
+++ b/config/schema/cdn.data_types.schema.yml
@@ -10,3 +10,5 @@ cdn.domain:
 cdn.stream_wrapper_scheme:
   type: string
   label: 'Stream wrapper scheme'
+  constraints:
+    CdnStreamWrapper: []
diff --git a/src/Plugin/Validation/Constraint/CdnStreamWrapperConstraint.php b/src/Plugin/Validation/Constraint/CdnStreamWrapperConstraint.php
new file mode 100644
index 0000000..2c26a0a
--- /dev/null
+++ b/src/Plugin/Validation/Constraint/CdnStreamWrapperConstraint.php
@@ -0,0 +1,21 @@
+<?php
+
+namespace Drupal\cdn\Plugin\Validation\Constraint;
+
+use Symfony\Component\Validator\Constraint;
+
+/**
+ * A CDN-supported stream wrapper.
+ *
+ * @Constraint(
+ *   id = "CdnStreamWrapper",
+ *   label = @Translation("CDN stream wrapper", context = "Validation"),
+ * )
+ *
+ * A stream wrapper as registered through Drupal's file system API.
+ */
+class CdnStreamWrapperConstraint extends Constraint {
+
+  public $message = 'The provided stream wrapper %stream_wrapper is not valid. Ensure it is properly registered and is not \'private\'.';
+
+}
diff --git a/src/Plugin/Validation/Constraint/CdnStreamWrapperConstraintValidator.php b/src/Plugin/Validation/Constraint/CdnStreamWrapperConstraintValidator.php
new file mode 100644
index 0000000..39f31ce
--- /dev/null
+++ b/src/Plugin/Validation/Constraint/CdnStreamWrapperConstraintValidator.php
@@ -0,0 +1,50 @@
+<?php
+
+namespace Drupal\cdn\Plugin\Validation\Constraint;
+
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\ConstraintValidator;
+use Symfony\Component\Validator\Exception\UnexpectedTypeException;
+
+/**
+ * CDN domain constraint validator.
+ */
+class CdnStreamWrapperConstraintValidator extends ConstraintValidator {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validate($streamWrapper, Constraint $constraint) {
+    if (!$constraint instanceof CdnStreamWrapperConstraint) {
+      throw new UnexpectedTypeException($constraint, __NAMESPACE__ . '\CdnStreamWrapper');
+    }
+
+    if ($streamWrapper === NULL) {
+      return;
+    }
+
+    if (!static::isValidCdnStreamWrapper($streamWrapper)) {
+      $this->context->buildViolation($constraint->message)
+        ->setParameter('%stream_wrapper', $streamWrapper)
+        ->setInvalidValue($streamWrapper)
+        ->addViolation();
+    }
+  }
+
+  /**
+   * Validates the given stream wrapper, with an exception for private.
+   *
+   * @param string $streamWrapper
+   *   A stream wrapper configured for use in Drupal.
+   *
+   * @return bool
+   */
+  protected static function isValidCdnStreamWrapper($streamWrapper) {
+    /** @var \Drupal\Core\StreamWrapper\StreamWrapperManagerInterface $stream_wrapper_manager */
+    $stream_wrapper_manager = \Drupal::service('stream_wrapper_manager');
+    $forbiddenWrappers = ['private'];
+    return !in_array($streamWrapper, $forbiddenWrappers)
+      && in_array($streamWrapper, array_keys($stream_wrapper_manager->getNames()), TRUE);
+  }
+
+}
diff --git a/tests/src/Functional/Plugin/Validation/Constraint/CdnStreamWrapperConstraintValidatorTest.php b/tests/src/Functional/Plugin/Validation/Constraint/CdnStreamWrapperConstraintValidatorTest.php
new file mode 100644
index 0000000..db205d3
--- /dev/null
+++ b/tests/src/Functional/Plugin/Validation/Constraint/CdnStreamWrapperConstraintValidatorTest.php
@@ -0,0 +1,66 @@
+<?php
+
+namespace Drupal\Tests\Core\Validation\Plugin\Validation\Constraint;
+
+use Drupal\cdn\Plugin\Validation\Constraint\CdnStreamWrapperConstraint;
+use Drupal\cdn\Plugin\Validation\Constraint\CdnStreamWrapperConstraintValidator;
+use Drupal\KernelTests\KernelTestBase;
+use Prophecy\Argument;
+use Symfony\Component\Validator\Context\ExecutionContextInterface;
+use Symfony\Component\Validator\Violation\ConstraintViolationBuilderInterface;
+
+/**
+ * @coversDefaultClass \Drupal\cdn\Plugin\Validation\Constraint\CdnStreamWrapperConstraintValidator
+ * @group cdn
+ */
+class CdnStreamWrapperConstraintValidatorTest extends KernelTestBase {
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = ['file_test', 'file'];
+
+  /**
+   * @covers ::validate
+   *
+   * @dataProvider provideTestValidate
+   */
+  public function testValidate($value, $valid) {
+    $constraint_violation_builder = $this->prophesize(ConstraintViolationBuilderInterface::class);
+    $constraint_violation_builder->setParameter('%stream_wrapper', $value)
+      ->willReturn($constraint_violation_builder->reveal());
+    $constraint_violation_builder->setInvalidValue($value)
+      ->willReturn($constraint_violation_builder->reveal());
+    $constraint_violation_builder->addViolation()
+      ->willReturn($constraint_violation_builder->reveal());
+    if ($valid) {
+      $constraint_violation_builder->addViolation()->shouldNotBeCalled();
+    }
+    else {
+      $constraint_violation_builder->addViolation()->shouldBeCalled();
+    }
+    $context = $this->prophesize(ExecutionContextInterface::class);
+    $context->buildViolation(Argument::type('string'))
+      ->willReturn($constraint_violation_builder->reveal());
+
+    $constraint = new CdnStreamWrapperConstraint();
+
+    $validate = new CdnStreamWrapperConstraintValidator();
+    $validate->initialize($context->reveal());
+    $validate->validate($value, $constraint);
+  }
+
+  public function provideTestValidate() {
+    $data = [];
+
+    $data['public, registered by default'] = ['public', TRUE];
+    $data['private, prohibited by rule'] = ['private', FALSE];
+    $data['unregistered'] = ['unregistered', FALSE];
+    $data['test-custom'] = ['dummy-remote', TRUE];
+
+    return $data;
+  }
+
+}