OAuth redirect URI matcher
Test attacker-chosen redirect URIs against exact, prefix, host, and wildcard matching, and see which strategies leak an authorization code.
Goal
The client app registered https://app.contoso.example/callback as its redirect URI. An attacker sends victims authorization links with a different redirect_uri, hoping the authorization server will deliver the code somewhere they can read it.
Pick a matching strategy, test the six candidates or type your own, and see where the code would land. The client also has an open redirect at /go?url=, which matters more than it looks.
Matching strategy
Registered
https://app.contoso.example/callback
redirect_uri.startsWith("https://app.contoso.example/callback")- accepted
https://app.contoso.example/callbackThe code reaches the real callback. - leaks
https://app.contoso.example/callback/../go?url=https://evil.example/cThe browser resolves the path to /go, and the open redirect forwards the visitor, with the code still in the address, to evil.example. - rejected
https://app.contoso.example/go?url=https://evil.example/cThe authorization server refuses the request, so no code is issued. - rejected
https://evilcontoso.example/callbackThe authorization server refuses the request, so no code is issued. - rejected
https://evil.example/?.contoso.example/callbackThe authorization server refuses the request, so no code is issued. - rejected
http://app.contoso.example/callbackThe authorization server refuses the request, so no code is issued.
Steps
01Which strategy rejects every candidate that would leak the code?
02Which candidate gets through the prefix match and still sends the code to evil.example?
03Which host passes the wildcard pattern without any path tricks?
04The host match accepts http://app.contoso.example/callback. What goes wrong?
05Which OAuth extension stops an attacker from redeeming a stolen code, because they lack the original verifier?