{
  "id": "security/oauth2-authorization-code-injection-via-open-redirector",
  "signature": "OAuth2 authorization code can be injected by attacker via open redirector on client",
  "signature_zh": "OAuth2授权码可通过客户端开放重定向被攻击者注入",
  "regex": "redirect_uri.*open.*redirect|authorization.*code.*injection|state.*predictable",
  "domain": "security",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "Client application allows open redirects that an attacker can use to inject a stolen authorization code into the redirect URI, bypassing the state parameter check if the state is predictable or reused.",
  "root_cause_type": "generic",
  "root_cause_zh": "客户端应用程序允许开放重定向，攻击者可以利用它将窃取的授权码注入到重定向URI中，如果状态参数可预测或重用，则绕过状态参数检查。",
  "versions": [
    {
      "version": "OAuth 2.0 RFC 6749",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Spring Security OAuth2 2.5.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Microsoft Identity Platform v2.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "If the state is predictable (e.g., timestamp-based) or reused, an attacker can craft a valid redirect with a stolen code.",
      "fail_rate": 0.7,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Wildcard patterns can be exploited to match attacker-controlled subdomains.",
      "fail_rate": 0.6,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "The client must validate the redirect_uri to prevent code injection via open redirectors.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Implement strict redirect_uri validation on the client side: match exactly the registered URI, no wildcards or partial matches. Example in Spring Security: `http.authorizeRequests().oauth2Login().authorizationEndpoint().authorizationRequestRepository(new HttpSessionOAuth2AuthorizationRequestRepository())`.",
      "success_rate": 0.85,
      "how": "Implement strict redirect_uri validation on the client side: match exactly the registered URI, no wildcards or partial matches. Example in Spring Security: `http.authorizeRequests().oauth2Login().authorizationEndpoint().authorizationRequestRepository(new HttpSessionOAuth2AuthorizationRequestRepository())`.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Ensure the state parameter is a cryptographically random, non-reusable value per authorization request. Example in Node.js: `const state = crypto.randomBytes(16).toString('hex');` and store it in session for verification.",
      "success_rate": 0.8,
      "how": "Ensure the state parameter is a cryptographically random, non-reusable value per authorization request. Example in Node.js: `const state = crypto.randomBytes(16).toString('hex');` and store it in session for verification.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Disable open redirect functionality on the client application entirely. Audit all redirect endpoints and remove or restrict them to allowed whitelist.",
      "success_rate": 0.95,
      "how": "Disable open redirect functionality on the client application entirely. Audit all redirect endpoints and remove or restrict them to allowed whitelist.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "在客户端实施严格的重定向URI验证：精确匹配已注册的URI，不允许通配符或部分匹配。Spring Security示例：`http.authorizeRequests().oauth2Login().authorizationEndpoint().authorizationRequestRepository(new HttpSessionOAuth2AuthorizationRequestRepository())`。",
    "确保state参数是每个授权请求的加密随机且不可重用的值。Node.js示例：`const state = crypto.randomBytes(16).toString('hex');` 并将其存储在会话中供验证。",
    "完全禁用客户端应用程序上的开放重定向功能。审计所有重定向端点，并将其删除或限制到允许的白名单中。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://datatracker.ietf.org/doc/html/rfc6749#section-10.12",
  "official_doc_section": null,
  "error_code": "OAUTH2-CODE-INJECTION-001",
  "verification_tier": "ai_generated",
  "confidence": 0.88,
  "fix_success_rate": 0.85,
  "resolvable": "true",
  "first_seen": "2024-03-15",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}