# OAuth2 redirect_uri验证允许路径遍历或子域名混淆

- **ID:** `security/oauth2-redirect-uri-validation-weak`
- **领域:** security
- **类别:** config_error
- **验证级别:** ai_generated
- **修复率:** 90%

## 根因

OAuth2服务器通过检查redirect_uri是否以注册URI字符串开头来验证，而不是执行精确或严格前缀匹配，允许攻击者注册一个通过验证的恶意重定向URI。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| Spring Authorization Server 1.1 | active | — | — |
| Keycloak 22.0 | active | — | — |
| Ory Hydra 2.2 | active | — | — |

## 解决方案

1. ```
   对redirect_uri与注册值实现精确字符串匹配。在Spring Security中，使用自定义RedirectUriValidator比较完整URI字符串。
   ```
2. ```
   使用包含路径和查询的严格前缀匹配，而不仅仅是主机。例如，在Node.js中：if (redirectUri !== registeredUri) { reject(); }
   ```
3. ```
   在验证前标准化redirect_uri，去除尾部斜杠、默认端口，并对方案和主机进行大小写折叠。
   ```

## 无效尝试

- **** — Simply adding more registered URIs to the allowlist doesn't fix the validation logic flaw; attackers can still craft URIs that pass the flawed check. (50% 失败率)
- **** — Blocking specific known malicious URIs is a reactive approach and cannot cover all possible bypasses. (60% 失败率)
- **** — Turning off redirect_uri validation entirely is dangerous and allows open redirect attacks. (80% 失败率)