OAuth 2.0 Redirect URI Validation Falls Short, Literally
Tommaso Innocenti, Matteo Golinelli, Kaan Onarlıoğlu, Ali Mirheidari, Bruno Crispo, Engin Kirda · Annual Computer Security Applications Conference · 2023
OAuth 2.0 requires a complex redirection trail between websites and Identity Providers (IdPs). In particular, the "redirect URI" parameter included in the popular Authorization Grant Code flow governs the callback endpoint that users are routed to, together with their security tokens. The protocol specification, therefore, includes guidelines on protecting the integrity of the redirect URI.