security config_error ai_generated true

OAuth2 redirect_uri validation allows path traversal or subdomain confusion

ID: security/oauth2-redirect-uri-validation-weak

Also available as: JSON · Markdown · 中文
90%Fix Rate
86%Confidence
1Evidence
2024-05-22First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Spring Authorization Server 1.1 active — — —
Keycloak 22.0 active — — —
Ory Hydra 2.2 active — — —

Root Cause

The OAuth2 server validates the redirect_uri by checking if it starts with the registered URI string instead of performing exact or strict prefix matching, allowing an attacker to register a malicious redirect URI that passes validation.

generic

中文

OAuth2服务器通过检查redirect_uri是否以注册URI字符串开头来验证，而不是执行精确或严格前缀匹配，允许攻击者注册一个通过验证的恶意重定向URI。

Official Documentation

https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2

Workarounds

  1. 95% success Implement exact string matching for the redirect_uri against the registered value. In Spring Security, use a custom RedirectUriValidator that compares the full URI string. 
    Implement exact string matching for the redirect_uri against the registered value. In Spring Security, use a custom RedirectUriValidator that compares the full URI string.
  2. 90% success Use a strict prefix match that includes the path and query, not just the host. For example, in Node.js: if (redirectUri !== registeredUri) { reject(); } 
    Use a strict prefix match that includes the path and query, not just the host. For example, in Node.js: if (redirectUri !== registeredUri) { reject(); }
  3. 85% success Normalize the redirect_uri before validation by removing trailing slashes, default ports, and case-folding the scheme and host. 
    Normalize the redirect_uri before validation by removing trailing slashes, default ports, and case-folding the scheme and host.

中文步骤

  1. 对redirect_uri与注册值实现精确字符串匹配。在Spring Security中，使用自定义RedirectUriValidator比较完整URI字符串。
  2. 使用包含路径和查询的严格前缀匹配，而不仅仅是主机。例如，在Node.js中：if (redirectUri !== registeredUri) { reject(); }
  3. 在验证前标准化redirect_uri，去除尾部斜杠、默认端口，并对方案和主机进行大小写折叠。

Dead Ends

Common approaches that don't work:

  1. 50% fail

    Simply adding more registered URIs to the allowlist doesn't fix the validation logic flaw; attackers can still craft URIs that pass the flawed check.

  2. 60% fail

    Blocking specific known malicious URIs is a reactive approach and cannot cover all possible bypasses.

  3. 80% fail

    Turning off redirect_uri validation entirely is dangerous and allows open redirect attacks.