# OAuth2 redirect_uri open redirect allows attacker to intercept authorization code via unvalidated wildcard

- **ID:** `security/oauth2-redirect-uri-open-redirect`
- **Domain:** security
- **Category:** auth_error
- **Error Code:** `OAUTH2-003`
- **Verification:** ai_generated
- **Fix Rate:** 88%

## Root Cause

The OAuth2 authorization server accepts a redirect_uri with a wildcard domain (e.g., *.example.com) that matches an attacker-controlled subdomain, enabling authorization code interception.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| OAuth 2.0 RFC 6749 | active | — | — |
| Spring Security OAuth2 5.8.0 | active | — | — |
| Keycloak 22.0.0 | active | — | — |

## Workarounds

1. **Replace wildcard redirect_uri with an exact match list. Example in Spring Security: `clientRegistration.redirectUri("https://app.example.com/callback")`** (88% success)
   ```
   Replace wildcard redirect_uri with an exact match list. Example in Spring Security: `clientRegistration.redirectUri("https://app.example.com/callback")`
   ```
2. **Implement a strict URI validation that rejects any URI containing a wildcard or asterisk character. Add a check: `if (redirectUri.contains("*")) { throw new InvalidRedirectUriException(); }`** (85% success)
   ```
   Implement a strict URI validation that rejects any URI containing a wildcard or asterisk character. Add a check: `if (redirectUri.contains("*")) { throw new InvalidRedirectUriException(); }`
   ```
3. **Use a whitelist of exact redirect URIs with no wildcards; validate using string equality or exact prefix match** (92% success)
   ```
   Use a whitelist of exact redirect URIs with no wildcards; validate using string equality or exact prefix match
   ```

## Dead Ends

- **** — This completely bypasses security and allows any attacker to use any redirect URI (95% fail)
- **** — Regex still allows attacker-controlled subdomains; the wildcard itself is the vulnerability (80% fail)
- **** — Expanding wildcards increases attack surface and does not fix the core issue (90% fail)