Intermediate LevelWeb Security & Cyber Defense
What is Redirect URI Poisoning in OAuth 2.0 and how do Auth Servers prevent it?
❓ Interview Prompt: Explain OAuth 2.0 Redirect URI Poisoning, wildcard redirect URI risks, authorization code theft, and strict string matching.
Redirect URI Poisoning in OAuth 2.0 allows an attacker to intercept authorization codes by manipulating the 'redirect_uri' parameter:
Attack Scenario:
If an OAuth provider permits wildcard matching ('https://example.com/*'), an attacker submits 'redirect_uri=https://example.com.evil.com/callback' or 'https://example.com/open-redirect?next=http://evil.com'.
•
The Auth Server sends the 'authorization_code' to the attacker's server!
•
Defense: Authorization Servers MUST enforce exact literal string matching on pre-registered redirect URIs.
Code Implementation Example
typescript
// Strict Redirect URI Validation on Auth Server
export function isValidRedirectUri(requestedUri: string, registeredUris: string[]): boolean {
// ❌ Dangerous: requestedUri.startsWith('https://example.com')
// ✅ Secure: Strict exact string comparison!
return registeredUris.includes(requestedUri);
}💡Enforcing exact literal string matching on OAuth 2.0 redirect URIs.
🎯 Interview Key Takeaway
Enforce exact literal string matching on pre-registered OAuth 2.0 redirect URIs to prevent authorization code theft.
#OAuth 2.0#Redirect URI#Security#Intermediate
Back to all Web Security & Cyber Defense Questions→