# OAuth2 redirect_uri validation allows path traversal or subdomain confusion

- **ID:** `security/oauth2-redirect-uri-validation-weak`
- **Domain:** security
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

The OAuth2 server validates the redirect_uri by checking if it starts with the registered URI string instead of performing exact or strict prefix matching, allowing an attacker to register a malicious redirect URI that passes validation.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Spring Authorization Server 1.1 | active | — | — |
| Keycloak 22.0 | active | — | — |
| Ory Hydra 2.2 | active | — | — |

## Workarounds

1. **Implement exact string matching for the redirect_uri against the registered value. In Spring Security, use a custom RedirectUriValidator that compares the full URI string.** (95% success)
   ```
   Implement exact string matching for the redirect_uri against the registered value. In Spring Security, use a custom RedirectUriValidator that compares the full URI string.
   ```
2. **Use a strict prefix match that includes the path and query, not just the host. For example, in Node.js: if (redirectUri !== registeredUri) { reject(); }** (90% success)
   ```
   Use a strict prefix match that includes the path and query, not just the host. For example, in Node.js: if (redirectUri !== registeredUri) { reject(); }
   ```
3. **Normalize the redirect_uri before validation by removing trailing slashes, default ports, and case-folding the scheme and host.** (85% success)
   ```
   Normalize the redirect_uri before validation by removing trailing slashes, default ports, and case-folding the scheme and host.
   ```

## Dead Ends

- **** — Simply adding more registered URIs to the allowlist doesn't fix the validation logic flaw; attackers can still craft URIs that pass the flawed check. (50% fail)
- **** — Blocking specific known malicious URIs is a reactive approach and cannot cover all possible bypasses. (60% fail)
- **** — Turning off redirect_uri validation entirely is dangerous and allows open redirect attacks. (80% fail)