Redirect URI validation

OAuth 2.0 servers must check the redirect_uri of received authorisation requests for being identical with a redirection URI registered for the client. Failure to validate the redirect_uri exactly opens the server to attacks, such as authorisation code exfiltration attacks.

Exact URI string matching is the most secure way to validate a redirect_uri and thus the recommendation of the OAuth working group.

OAuth 2.0 server implementers that choose to check the redirect_uri by some other method, for example by means of pattern matching in order to enable wildcards in a portion of the URI, run a significant risk. If the check is vulnerable an attacker might be able to craft an exploit to steal tokens. Always use strict URI string matching!

The OAuth 2.0 / OpenID Connect SDK includes a special RedirectURIValidator class used internally by the parse methods of AuthorizationRequests and ClientMetadata. It enforces extra security checks on the redirect_uri and will reject it if the URI is deemed suspicious and / or vulnerable.

As of version 10.14 a validation exception will be thrown when the following is detected:

• The redirect URI includes a fragment (fragments are not allowed).

• The redirect URI has a “data”, “javascript” or “vbscript” schema that can be used in a attack described by Lauritz Holtmann in 2020.

• The redirect URI includes a “code” or “state” query parameter that can be used in a attack described in the “OAuth 2.0 Redirect URI Validation Falls Short, Literally” talk by Tommaso Innocenti, Matteo Golinelli, Kaan Onarlioglu, Bruno Crispo, Engin Kirda at OAuth Security Workshop 2023. We added the “response” query parameter used in JARM to be above blacklist.