# OAuth2 authorization code intercepted via open redirect in redirect_uri

- **ID:** `security/oauth2-authorization-code-interception-via-open-redirect`
- **Domain:** security
- **Category:** protocol_error
- **Error Code:** `AUTH_CODE_INTERCEPTION`
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The OAuth2 authorization server does not strictly validate the redirect_uri against a registered whitelist, allowing an attacker to use an open redirect endpoint to intercept the authorization code.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| OAuth 2.0 RFC 6749 | active | — | — |
| Spring Security OAuth2 2.3.0 | active | — | — |
| Auth0 Node.js SDK 2.12.0 | active | — | — |
| Okta OIDC Middleware 3.0.0 | active | — | — |

## Workarounds

1. **Strictly validate redirect_uri against an exact, registered whitelist. For example, in Spring Security OAuth2, configure the authorization server to reject any redirect_uri that does not exactly match a registered value:

@Configuration
@EnableAuthorizationServer
public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
            .withClient("client1")
            .redirectUris("https://app.example.com/callback")
            .autoApprove(true)
            .scopes("read");
    }
}** (95% success)
   ```
   Strictly validate redirect_uri against an exact, registered whitelist. For example, in Spring Security OAuth2, configure the authorization server to reject any redirect_uri that does not exactly match a registered value:

@Configuration
@EnableAuthorizationServer
public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
            .withClient("client1")
            .redirectUris("https://app.example.com/callback")
            .autoApprove(true)
            .scopes("read");
    }
}
   ```
2. **Implement a redirect_uri allowlist in the authorization server that rejects any URI not exactly matching a registered pattern. For example, in a Node.js OAuth2 library:

const allowedRedirectUris = ['https://app.example.com/callback'];
function validateRedirectUri(uri) {
  return allowedRedirectUris.includes(uri);
}** (90% success)
   ```
   Implement a redirect_uri allowlist in the authorization server that rejects any URI not exactly matching a registered pattern. For example, in a Node.js OAuth2 library:

const allowedRedirectUris = ['https://app.example.com/callback'];
function validateRedirectUri(uri) {
  return allowedRedirectUris.includes(uri);
}
   ```
3. **Use PKCE (Proof Key for Code Exchange) to mitigate authorization code interception. PKCE ensures that even if the code is intercepted, it cannot be exchanged without the original code verifier. Example in Auth0:

const client = new OAuth2Client({
  clientId: 'your-client-id',
  authorizationUri: 'https://auth.example.com/authorize',
  tokenUri: 'https://auth.example.com/token',
  redirectUri: 'https://app.example.com/callback',
  usePKCE: true
});** (85% success)
   ```
   Use PKCE (Proof Key for Code Exchange) to mitigate authorization code interception. PKCE ensures that even if the code is intercepted, it cannot be exchanged without the original code verifier. Example in Auth0:

const client = new OAuth2Client({
  clientId: 'your-client-id',
  authorizationUri: 'https://auth.example.com/authorize',
  tokenUri: 'https://auth.example.com/token',
  redirectUri: 'https://app.example.com/callback',
  usePKCE: true
});
   ```

## Dead Ends

- **Add HTTPS requirement to redirect_uri without whitelist check** — HTTPS alone does not prevent open redirect attacks; the attacker can still use a valid HTTPS endpoint that redirects to their site. (90% fail)
- **Use wildcard patterns in redirect_uri registration (e.g., https://*.example.com/*)** — Wildcards allow attackers to register subdomains or paths they control, bypassing the intent of strict matching. (85% fail)
- **Rely on state parameter alone without redirect_uri validation** — The state parameter prevents CSRF but does not protect against authorization code interception via open redirect. (95% fail)