Direct answer
An OAuth authorization server should apply its documented redirect URI validation rules to the registered client. An overly broad redirect can expose authorization responses or send users to an unintended destination.
Map the registered client
Record the authorization server, test client, approved redirect URI, grant type and any documented native-app exceptions. Obtain test client credentials through the owner and avoid capturing production authorization codes or tokens.
Reference: OWASP OAuth 2.0 Cheat Sheet.
Exercise allowed and denied redirects
Start a normal authorization flow with the registered redirect and confirm the expected result. With permission and a controlled destination, try a different host, path and port separately. A denial must occur before a code or token is delivered to an unregistered endpoint.
- Use a destination controlled by the testing team.
- Preserve client identifier and request parameters with secrets redacted.
- Do not rely on a browser error alone; observe where the response was sent.
Check the rest of the flow
Redirect matching is one control within the protocol. Review state or the applicable CSRF protection, PKCE where required, and authorization-code use according to the client type and current standards. Review any open redirects on the registered endpoint itself.
Retest and assess compatibility
After correcting registration or matching rules, repeat the valid client flow and each changed URI. Confirm legitimate mobile or local development clients use the authorization server's documented supported configuration instead of broadening a production redirect policy.
Assessment limits
OAuth deployments and native-app redirect rules vary. This focused check does not prove the complete authorization flow, identity-token validation or downstream API authorization is secure.
Frequently asked questions
Is matching the domain alone sufficient?
A broadly matched domain can still allow unintended paths or destinations. Follow the authorization server's protocol and client registration requirements.
Does PKCE make redirect validation unnecessary?
No. PKCE mitigates authorization-code interception, while redirect validation and other applicable controls protect different parts of the flow.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.