{
  "id": "security/oauth2-redirect-uri-mismatch-allows-callback-interception",
  "signature": "OAuth2 redirect_uri mismatch allows callback interception",
  "signature_zh": "OAuth2重定向URI不匹配允许回调拦截",
  "regex": "OAuth2 redirect_uri mismatch: the provided redirect URI does not match any registered callback URL",
  "domain": "security",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "When the redirect_uri in an OAuth2 authorization request does not match the registered callback URL, an attacker can intercept the authorization code by using a different redirect URI that they control.",
  "root_cause_type": "generic",
  "root_cause_zh": "当OAuth2授权请求中的redirect_uri与注册的回调URL不匹配时，攻击者可以通过使用他们控制的不同重定向URI来拦截授权代码。",
  "versions": [
    {
      "version": "OAuth2.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Spring Security 5.6+",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Keycloak 21.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Okta 2023.09.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Using a wildcard in the registered redirect URI (e.g., https://*.example.com) allows attackers to register a subdomain they control, intercepting the code.",
      "fail_rate": 0.75,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Allowing redirect URIs with different paths but same host is insufficient because attackers can use a path they control (e.g., /attacker-callback).",
      "fail_rate": 0.65,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Validating only the hostname but not the path or query parameters leaves the system vulnerable to path-based interception.",
      "fail_rate": 0.6,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Register exact redirect URIs on the authorization server (e.g., https://myapp.com/callback) and validate that the request's redirect_uri matches exactly, including path and query parameters. Example in Keycloak: in client settings, set 'Valid Redirect URIs' to 'https://myapp.com/callback' without wildcards.",
      "success_rate": 0.95,
      "how": "Register exact redirect URIs on the authorization server (e.g., https://myapp.com/callback) and validate that the request's redirect_uri matches exactly, including path and query parameters. Example in Keycloak: in client settings, set 'Valid Redirect URIs' to 'https://myapp.com/callback' without wildcards.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Implement strict redirect URI validation on the client side: compare the received redirect URI against a whitelist of allowed URIs before processing the authorization code.",
      "success_rate": 0.9,
      "how": "Implement strict redirect URI validation on the client side: compare the received redirect URI against a whitelist of allowed URIs before processing the authorization code.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use PKCE in combination with exact redirect URI matching to prevent interception even if the redirect URI is slightly different.",
      "success_rate": 0.88,
      "how": "Use PKCE in combination with exact redirect URI matching to prevent interception even if the redirect URI is slightly different.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Register exact redirect URIs on the authorization server (e.g., https://myapp.com/callback) and validate that the request's redirect_uri matches exactly, including path and query parameters. Example in Keycloak: in client settings, set 'Valid Redirect URIs' to 'https://myapp.com/callback' without wildcards.",
    "Implement strict redirect URI validation on the client side: compare the received redirect URI against a whitelist of allowed URIs before processing the authorization code.",
    "Use PKCE in combination with exact redirect URI matching to prevent interception even if the redirect URI is slightly different."
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2",
  "official_doc_section": null,
  "error_code": "OAUTH2_REDIRECT_URI_MISMATCH",
  "verification_tier": "ai_generated",
  "confidence": 0.86,
  "fix_success_rate": 0.92,
  "resolvable": "true",
  "first_seen": "2023-11-20",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}