redirect_uri Validation

The redirect_uri is where auth tokens land. If you don't validate it, an attacker can steal tokens.

The attack:

Attacker registers their evil_app with auth server.
Attacker sends victim a link:
  https://oauth.example.com/authorize
    ?client_id=evil_app
    &redirect_uri=https://attacker.com/steal
    &...
Victim authorizes, thinking it's legit.
Auth code goes to attacker.com.
Attacker exchanges for token; impersonates victim.

Defense: server STRICTLY checks the redirect_uri matches a pre-registered URI for the client.

Strict matching rules:

• Exact match preferred: https://yourapp.com/callback
• Path matching with prefix: limited use cases
• NO wildcards in domain: *.evil.com defeats the check
• HTTPS in production: http:// only for localhost
• No fragments: redirect_uri can't have #anchor

Many breaches happened from lax redirect_uri matching:

• 2014: Facebook had open redirect via redirect_uri=https://allowed-domain.com/path/../../evil.com
• 2019: Various GitHub Apps had similar issues

Modern OAuth providers (Google, GitHub, Auth0) require URL pre-registration AND exact match. Strict by default.