OAuth2授权码因redirect_uri开放重定向被拦截

解决方案

1. Strictly validate redirect_uri against an exact, registered whitelist. For example, in Spring Security OAuth2, configure the authorization server to reject any redirect_uri that does not exactly match a registered value:
   
   @Configuration
   @EnableAuthorizationServer
   public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
       @Override
       public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
           clients.inMemory()
               .withClient("client1")
               .redirectUris("https://app.example.com/callback")
               .autoApprove(true)
               .scopes("read");
       }
   }

2. Implement a redirect_uri allowlist in the authorization server that rejects any URI not exactly matching a registered pattern. For example, in a Node.js OAuth2 library:
   
   const allowedRedirectUris = ['https://app.example.com/callback'];
   function validateRedirectUri(uri) {
     return allowedRedirectUris.includes(uri);
   }

3. Use PKCE (Proof Key for Code Exchange) to mitigate authorization code interception. PKCE ensures that even if the code is intercepted, it cannot be exchanged without the original code verifier. Example in Auth0:
   
   const client = new OAuth2Client({
     clientId: 'your-client-id',
     authorizationUri: 'https://auth.example.com/authorize',
     tokenUri: 'https://auth.example.com/token',
     redirectUri: 'https://app.example.com/callback',
     usePKCE: true
   });