# OAuth2 redirect_uri 开放重定向允许攻击者通过未验证的通配符拦截授权码

- **ID:** `security/oauth2-redirect-uri-open-redirect`
- **领域:** security
- **类别:** auth_error
- **错误码:** `OAUTH2-003`
- **验证级别:** ai_generated
- **修复率:** 88%

## 根因

OAuth2 授权服务器接受带有通配符域名的 redirect_uri（例如 *.example.com），该通配符匹配攻击者控制的子域名，从而允许授权码拦截。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| OAuth 2.0 RFC 6749 | active | — | — |
| Spring Security OAuth2 5.8.0 | active | — | — |
| Keycloak 22.0.0 | active | — | — |

## 解决方案

1. ```
   Replace wildcard redirect_uri with an exact match list. Example in Spring Security: `clientRegistration.redirectUri("https://app.example.com/callback")`
   ```
2. ```
   Implement a strict URI validation that rejects any URI containing a wildcard or asterisk character. Add a check: `if (redirectUri.contains("*")) { throw new InvalidRedirectUriException(); }`
   ```
3. ```
   Use a whitelist of exact redirect URIs with no wildcards; validate using string equality or exact prefix match
   ```

## 无效尝试

- **** — This completely bypasses security and allows any attacker to use any redirect URI (95% 失败率)
- **** — Regex still allows attacker-controlled subdomains; the wildcard itself is the vulnerability (80% 失败率)
- **** — Expanding wildcards increases attack surface and does not fix the core issue (90% 失败率)