AUTH_CODE_INTERCEPTION security protocol_error ai_generated true

OAuth2 authorization code intercepted via open redirect in redirect_uri

ID: security/oauth2-authorization-code-interception-via-open-redirect

Also available as: JSON · Markdown · 中文

80%Fix Rate

85%Confidence

1Evidence

2024-02-15First Seen

Version Compatibility

Version	Status	Introduced	Deprecated	Notes
OAuth 2.0 RFC 6749	active	—	—	—
Spring Security OAuth2 2.3.0	active	—	—	—
Auth0 Node.js SDK 2.12.0	active	—	—	—
Okta OIDC Middleware 3.0.0	active	—	—	—

Root Cause

The OAuth2 authorization server does not strictly validate the redirect_uri against a registered whitelist, allowing an attacker to use an open redirect endpoint to intercept the authorization code.

generic

中文

OAuth2授权服务器未严格验证redirect_uri是否与注册白名单匹配，允许攻击者利用开放重定向端点拦截授权码。

Official Documentation

https://datatracker.ietf.org/doc/html/rfc6749#section-10.6

Workarounds

95% success Strictly validate redirect_uri against an exact, registered whitelist. For example, in Spring Security OAuth2, configure the authorization server to reject any redirect_uri that does not exactly match a registered value: @Configuration @EnableAuthorizationServer public class AuthServerConfig extends AuthorizationServerConfigurerAdapter { @Override public void configure(ClientDetailsServiceConfigurer clients) throws Exception { clients.inMemory() .withClient("client1") .redirectUris("https://app.example.com/callback") .autoApprove(true) .scopes("read"); } }
```
Strictly validate redirect_uri against an exact, registered whitelist. For example, in Spring Security OAuth2, configure the authorization server to reject any redirect_uri that does not exactly match a registered value:

@Configuration
@EnableAuthorizationServer
public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
            .withClient("client1")
            .redirectUris("https://app.example.com/callback")
            .autoApprove(true)
            .scopes("read");
    }
}
```
90% success Implement a redirect_uri allowlist in the authorization server that rejects any URI not exactly matching a registered pattern. For example, in a Node.js OAuth2 library: const allowedRedirectUris = ['https://app.example.com/callback']; function validateRedirectUri(uri) { return allowedRedirectUris.includes(uri); }
```
Implement a redirect_uri allowlist in the authorization server that rejects any URI not exactly matching a registered pattern. For example, in a Node.js OAuth2 library:

const allowedRedirectUris = ['https://app.example.com/callback'];
function validateRedirectUri(uri) {
  return allowedRedirectUris.includes(uri);
}
```
85% success Use PKCE (Proof Key for Code Exchange) to mitigate authorization code interception. PKCE ensures that even if the code is intercepted, it cannot be exchanged without the original code verifier. Example in Auth0: const client = new OAuth2Client({ clientId: 'your-client-id', authorizationUri: 'https://auth.example.com/authorize', tokenUri: 'https://auth.example.com/token', redirectUri: 'https://app.example.com/callback', usePKCE: true });
```
Use PKCE (Proof Key for Code Exchange) to mitigate authorization code interception. PKCE ensures that even if the code is intercepted, it cannot be exchanged without the original code verifier. Example in Auth0:

const client = new OAuth2Client({
  clientId: 'your-client-id',
  authorizationUri: 'https://auth.example.com/authorize',
  tokenUri: 'https://auth.example.com/token',
  redirectUri: 'https://app.example.com/callback',
  usePKCE: true
});
```

中文步骤

Strictly validate redirect_uri against an exact, registered whitelist. For example, in Spring Security OAuth2, configure the authorization server to reject any redirect_uri that does not exactly match a registered value:

@Configuration
@EnableAuthorizationServer
public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
            .withClient("client1")
            .redirectUris("https://app.example.com/callback")
            .autoApprove(true)
            .scopes("read");
    }
}

Implement a redirect_uri allowlist in the authorization server that rejects any URI not exactly matching a registered pattern. For example, in a Node.js OAuth2 library:

const allowedRedirectUris = ['https://app.example.com/callback'];
function validateRedirectUri(uri) {
  return allowedRedirectUris.includes(uri);
}

Use PKCE (Proof Key for Code Exchange) to mitigate authorization code interception. PKCE ensures that even if the code is intercepted, it cannot be exchanged without the original code verifier. Example in Auth0:

const client = new OAuth2Client({
  clientId: 'your-client-id',
  authorizationUri: 'https://auth.example.com/authorize',
  tokenUri: 'https://auth.example.com/token',
  redirectUri: 'https://app.example.com/callback',
  usePKCE: true
});

Dead Ends

Common approaches that don't work:

Add HTTPS requirement to redirect_uri without whitelist check 90% fail
HTTPS alone does not prevent open redirect attacks; the attacker can still use a valid HTTPS endpoint that redirects to their site.
Use wildcard patterns in redirect_uri registration (e.g., https://*.example.com/*) 85% fail
Wildcards allow attackers to register subdomains or paths they control, bypassing the intent of strict matching.
Rely on state parameter alone without redirect_uri validation 95% fail
The state parameter prevents CSRF but does not protect against authorization code interception via open redirect.