# OAuth2 redirect_uri mismatch allows callback interception

- **ID:** `security/oauth2-redirect-uri-mismatch-allows-callback-interception`
- **Domain:** security
- **Category:** auth_error
- **Error Code:** `OAUTH2_REDIRECT_URI_MISMATCH`
- **Verification:** ai_generated
- **Fix Rate:** 92%

## Root Cause

When the redirect_uri in an OAuth2 authorization request does not match the registered callback URL, an attacker can intercept the authorization code by using a different redirect URI that they control.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| OAuth2.0 | active | — | — |
| Spring Security 5.6+ | active | — | — |
| Keycloak 21.0.0 | active | — | — |
| Okta 2023.09.0 | active | — | — |

## Workarounds

1. **Register exact redirect URIs on the authorization server (e.g., https://myapp.com/callback) and validate that the request's redirect_uri matches exactly, including path and query parameters. Example in Keycloak: in client settings, set 'Valid Redirect URIs' to 'https://myapp.com/callback' without wildcards.** (95% success)
   ```
   Register exact redirect URIs on the authorization server (e.g., https://myapp.com/callback) and validate that the request's redirect_uri matches exactly, including path and query parameters. Example in Keycloak: in client settings, set 'Valid Redirect URIs' to 'https://myapp.com/callback' without wildcards.
   ```
2. **Implement strict redirect URI validation on the client side: compare the received redirect URI against a whitelist of allowed URIs before processing the authorization code.** (90% success)
   ```
   Implement strict redirect URI validation on the client side: compare the received redirect URI against a whitelist of allowed URIs before processing the authorization code.
   ```
3. **Use PKCE in combination with exact redirect URI matching to prevent interception even if the redirect URI is slightly different.** (88% success)
   ```
   Use PKCE in combination with exact redirect URI matching to prevent interception even if the redirect URI is slightly different.
   ```

## Dead Ends

- **** — Using a wildcard in the registered redirect URI (e.g., https://*.example.com) allows attackers to register a subdomain they control, intercepting the code. (75% fail)
- **** — Allowing redirect URIs with different paths but same host is insufficient because attackers can use a path they control (e.g., /attacker-callback). (65% fail)
- **** — Validating only the hostname but not the path or query parameters leaves the system vulnerable to path-based interception. (60% fail)