{
  "id": "security/oauth2-authorization-code-interception-via-open-redirect",
  "signature": "OAuth2 authorization code intercepted via open redirect in redirect_uri",
  "signature_zh": "OAuth2授权码因redirect_uri开放重定向被拦截",
  "regex": "redirect_uri.*open.*redirect|authorization.*code.*intercepted|redirect_uri.*mismatch.*allowed",
  "domain": "security",
  "category": "protocol_error",
  "subcategory": null,
  "root_cause": "The OAuth2 authorization server does not strictly validate the redirect_uri against a registered whitelist, allowing an attacker to use an open redirect endpoint to intercept the authorization code.",
  "root_cause_type": "generic",
  "root_cause_zh": "OAuth2授权服务器未严格验证redirect_uri是否与注册白名单匹配，允许攻击者利用开放重定向端点拦截授权码。",
  "versions": [
    {
      "version": "OAuth 2.0 RFC 6749",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Spring Security OAuth2 2.3.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Auth0 Node.js SDK 2.12.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Okta OIDC Middleware 3.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "Add HTTPS requirement to redirect_uri without whitelist check",
      "why_fails": "HTTPS alone does not prevent open redirect attacks; the attacker can still use a valid HTTPS endpoint that redirects to their site.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "Use wildcard patterns in redirect_uri registration (e.g., https://*.example.com/*)",
      "why_fails": "Wildcards allow attackers to register subdomains or paths they control, bypassing the intent of strict matching.",
      "fail_rate": 0.85,
      "condition": "",
      "sources": []
    },
    {
      "action": "Rely on state parameter alone without redirect_uri validation",
      "why_fails": "The state parameter prevents CSRF but does not protect against authorization code interception via open redirect.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Strictly validate redirect_uri against an exact, registered whitelist. For example, in Spring Security OAuth2, configure the authorization server to reject any redirect_uri that does not exactly match a registered value:\n\n@Configuration\n@EnableAuthorizationServer\npublic class AuthServerConfig extends AuthorizationServerConfigurerAdapter {\n    @Override\n    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {\n        clients.inMemory()\n            .withClient(\"client1\")\n            .redirectUris(\"https://app.example.com/callback\")\n            .autoApprove(true)\n            .scopes(\"read\");\n    }\n}",
      "success_rate": 0.95,
      "how": "Strictly validate redirect_uri against an exact, registered whitelist. For example, in Spring Security OAuth2, configure the authorization server to reject any redirect_uri that does not exactly match a registered value:\n\n@Configuration\n@EnableAuthorizationServer\npublic class AuthServerConfig extends AuthorizationServerConfigurerAdapter {\n    @Override\n    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {\n        clients.inMemory()\n            .withClient(\"client1\")\n            .redirectUris(\"https://app.example.com/callback\")\n            .autoApprove(true)\n            .scopes(\"read\");\n    }\n}",
      "condition": "",
      "sources": []
    },
    {
      "action": "Implement a redirect_uri allowlist in the authorization server that rejects any URI not exactly matching a registered pattern. For example, in a Node.js OAuth2 library:\n\nconst allowedRedirectUris = ['https://app.example.com/callback'];\nfunction validateRedirectUri(uri) {\n  return allowedRedirectUris.includes(uri);\n}",
      "success_rate": 0.9,
      "how": "Implement a redirect_uri allowlist in the authorization server that rejects any URI not exactly matching a registered pattern. For example, in a Node.js OAuth2 library:\n\nconst allowedRedirectUris = ['https://app.example.com/callback'];\nfunction validateRedirectUri(uri) {\n  return allowedRedirectUris.includes(uri);\n}",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use PKCE (Proof Key for Code Exchange) to mitigate authorization code interception. PKCE ensures that even if the code is intercepted, it cannot be exchanged without the original code verifier. Example in Auth0:\n\nconst client = new OAuth2Client({\n  clientId: 'your-client-id',\n  authorizationUri: 'https://auth.example.com/authorize',\n  tokenUri: 'https://auth.example.com/token',\n  redirectUri: 'https://app.example.com/callback',\n  usePKCE: true\n});",
      "success_rate": 0.85,
      "how": "Use PKCE (Proof Key for Code Exchange) to mitigate authorization code interception. PKCE ensures that even if the code is intercepted, it cannot be exchanged without the original code verifier. Example in Auth0:\n\nconst client = new OAuth2Client({\n  clientId: 'your-client-id',\n  authorizationUri: 'https://auth.example.com/authorize',\n  tokenUri: 'https://auth.example.com/token',\n  redirectUri: 'https://app.example.com/callback',\n  usePKCE: true\n});",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Strictly validate redirect_uri against an exact, registered whitelist. For example, in Spring Security OAuth2, configure the authorization server to reject any redirect_uri that does not exactly match a registered value:\n\n@Configuration\n@EnableAuthorizationServer\npublic class AuthServerConfig extends AuthorizationServerConfigurerAdapter {\n    @Override\n    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {\n        clients.inMemory()\n            .withClient(\"client1\")\n            .redirectUris(\"https://app.example.com/callback\")\n            .autoApprove(true)\n            .scopes(\"read\");\n    }\n}",
    "Implement a redirect_uri allowlist in the authorization server that rejects any URI not exactly matching a registered pattern. For example, in a Node.js OAuth2 library:\n\nconst allowedRedirectUris = ['https://app.example.com/callback'];\nfunction validateRedirectUri(uri) {\n  return allowedRedirectUris.includes(uri);\n}",
    "Use PKCE (Proof Key for Code Exchange) to mitigate authorization code interception. PKCE ensures that even if the code is intercepted, it cannot be exchanged without the original code verifier. Example in Auth0:\n\nconst client = new OAuth2Client({\n  clientId: 'your-client-id',\n  authorizationUri: 'https://auth.example.com/authorize',\n  tokenUri: 'https://auth.example.com/token',\n  redirectUri: 'https://app.example.com/callback',\n  usePKCE: true\n});"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://datatracker.ietf.org/doc/html/rfc6749#section-10.6",
  "official_doc_section": null,
  "error_code": "AUTH_CODE_INTERCEPTION",
  "verification_tier": "ai_generated",
  "confidence": 0.85,
  "fix_success_rate": 0.8,
  "resolvable": "true",
  "first_seen": "2024-02-15",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}