# OAuth2 authorization code can be injected by attacker via open redirector on client

- **ID:** `security/oauth2-authorization-code-injection-via-open-redirector`
- **Domain:** security
- **Category:** auth_error
- **Error Code:** `OAUTH2-CODE-INJECTION-001`
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

Client application allows open redirects that an attacker can use to inject a stolen authorization code into the redirect URI, bypassing the state parameter check if the state is predictable or reused.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| OAuth 2.0 RFC 6749 | active | — | — |
| Spring Security OAuth2 2.5.x | active | — | — |
| Microsoft Identity Platform v2.0 | active | — | — |

## Workarounds

1. **Implement strict redirect_uri validation on the client side: match exactly the registered URI, no wildcards or partial matches. Example in Spring Security: `http.authorizeRequests().oauth2Login().authorizationEndpoint().authorizationRequestRepository(new HttpSessionOAuth2AuthorizationRequestRepository())`.** (85% success)
   ```
   Implement strict redirect_uri validation on the client side: match exactly the registered URI, no wildcards or partial matches. Example in Spring Security: `http.authorizeRequests().oauth2Login().authorizationEndpoint().authorizationRequestRepository(new HttpSessionOAuth2AuthorizationRequestRepository())`.
   ```
2. **Ensure the state parameter is a cryptographically random, non-reusable value per authorization request. Example in Node.js: `const state = crypto.randomBytes(16).toString('hex');` and store it in session for verification.** (80% success)
   ```
   Ensure the state parameter is a cryptographically random, non-reusable value per authorization request. Example in Node.js: `const state = crypto.randomBytes(16).toString('hex');` and store it in session for verification.
   ```
3. **Disable open redirect functionality on the client application entirely. Audit all redirect endpoints and remove or restrict them to allowed whitelist.** (95% success)
   ```
   Disable open redirect functionality on the client application entirely. Audit all redirect endpoints and remove or restrict them to allowed whitelist.
   ```

## Dead Ends

- **** — If the state is predictable (e.g., timestamp-based) or reused, an attacker can craft a valid redirect with a stolen code. (70% fail)
- **** — Wildcard patterns can be exploited to match attacker-controlled subdomains. (60% fail)
- **** — The client must validate the redirect_uri to prevent code injection via open redirectors. (90% fail)