My question may seem silly, but I really do not understand - what the purpose of catching redirect_uri from request and compare it with URI specified in the clients table? Is it due to a security issue?
Related Questions in OAUTH-2.0
- discord.py - Oauth2 - join user to guild
- Implementing Incremental consent when using both application and delegated permissions
- Verifying Google Identity OAuth2 token with Ruby
- spring security error Caused by: org.attoparser.ParseException: Exception evaluating SpringEL expression: s
- Encountering HttpError 403 and 500 When Using Google Sheets API with Service Account
- get refresh token in axios interceptor
- spring error exception with oauth2 and securityconfig
- What oauth 2.0 endpoint is used to validate a bearer token
- Not enough permissions to access API request https://api.linkedin.com/v2/me
- How to specify the client ID and redirect URI in Swagger OAuth2.0 configuration for Swagger UI?
- OAuth2 PHP change invalid_token response
- Call Databricks API from an ASP.NET Core web application
- Secure to share Access Token over public API using CORs?
- How to use Oauth in order to log‑in on .googleapis.com on almost any arbitrary endpoints domains from the web browser?
- OAuth access token attribute based reverse proxying of http ressources
Related Questions in OAUTH2-SERVER
- Best way to do the login + authorization step on a OAuth2 flow (authorization_code grant)
- setting the roles for the user when using Google/FB/Github as Authorization server
- Why am I getting a 401 for a public route when using express-oauth-server
- Method Laravel\\Passport\\Bridge\\AccessToken::__toString() must not throw an exception
- authentication server microservice, should I use different services for different user functionalities
- How to scale horizontally a spring-boot oauth2 server with JDBC implementation
- Error Invalid grant: refresh token is invalid in getRefreshToken
- FriendsOfSymfony/FOSOAuthServerBundle not set username
- app.oauth.grant is not a function (oauth2-server)
- How to override default Yii2 - Filsh Oauth Server response
- Unable to get User Credential grant type working
- Should I setup an OAuth2 Server?
- Oauth2 access to API by email/password
- automatic logout from simple-ember-auth/oauth2-server after inactivity
- Module.exports in meteor
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
Popular Tags
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Pre-registering redirect URIs itself is a security measurement because the authorization requests in OAuth 2.0 are not signed. Attackers could phish the user in clicking a link that would result in an authorization request with a redirect_uri pointing to a site that they control.
Sending the
redirect_uriin the request itself does not serve a security purpose but is just there to let the Authorization Sever know where the client wants to receive the authorization response in the case there are multiple redirect URIs registered for this particular Client.The
redirect_uriparameter is optional by spec anyhow. If there's only one registered, then theredirect_uriparameter may be omitted from the request. If multiple redirect URIs are registered and no redirect URI is provided in the request, the result is unspecified: the AS may pick the first, anyone or none of them.