OAUTH2_REDIRECT_URI_MISMATCH security auth_error ai_generated true

OAuth2重定向URI不匹配允许回调拦截

OAuth2 redirect_uri mismatch allows callback interception

ID: security/oauth2-redirect-uri-mismatch-allows-callback-interception

其他格式: JSON · Markdown 中文 · English
92%修复率
86%置信度
1证据数
2023-11-20首次发现

版本兼容性

版本状态引入弃用备注
OAuth2.0 active — — —
Spring Security 5.6+ active — — —
Keycloak 21.0.0 active — — —
Okta 2023.09.0 active — — —

根因分析

当OAuth2授权请求中的redirect_uri与注册的回调URL不匹配时，攻击者可以通过使用他们控制的不同重定向URI来拦截授权代码。

English

When the redirect_uri in an OAuth2 authorization request does not match the registered callback URL, an attacker can intercept the authorization code by using a different redirect URI that they control.

generic

官方文档

https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2

解决方案

  1. Register exact redirect URIs on the authorization server (e.g., https://myapp.com/callback) and validate that the request's redirect_uri matches exactly, including path and query parameters. Example in Keycloak: in client settings, set 'Valid Redirect URIs' to 'https://myapp.com/callback' without wildcards.
  2. Implement strict redirect URI validation on the client side: compare the received redirect URI against a whitelist of allowed URIs before processing the authorization code.
  3. Use PKCE in combination with exact redirect URI matching to prevent interception even if the redirect URI is slightly different.

无效尝试

常见但无效的做法:

  1. 75% 失败

    Using a wildcard in the registered redirect URI (e.g., https://*.example.com) allows attackers to register a subdomain they control, intercepting the code.

  2. 65% 失败

    Allowing redirect URIs with different paths but same host is insufficient because attackers can use a path they control (e.g., /attacker-callback).

  3. 60% 失败

    Validating only the hostname but not the path or query parameters leaves the system vulnerable to path-based interception.