OAuth redirect_uri Lab: Steal a Login Code With a Loose Check

This article describes a critical OAuth vulnerability where loose redirect_uri validation allows attackers to intercept login authorization codes. The lab demonstrates how substring-based checks—validating that a redirect_uri merely contains a trusted domain rather than matching it exactly—can be bypassed by crafting URLs under attacker control that still pass the weak validation. This matters because the authorization code can be exchanged for full account access, making redirect_uri validation a fundamental security boundary in OAuth flows.

• Substring validation fails completelyAuthHub accepts any redirect_uri containing the string 'trustedclient.com' anywhere within it, without anchoring to the host start or comparing against an exact pre-registered value. This allows URLs like 'trustedclient.com.attacker.example' or paths on attacker hosts to pass validation, because the substring match succeeds even though the actual destination is attacker-controlled.
• How the attack works in practiceAn attacker constructs a URL containing the trusted domain as a subdomain label or in the path, then initiates the OAuth flow with this malicious redirect_uri. The weak substring check passes, the user approves login, and the authorization code is sent to the attacker's destination instead of the legitimate app, where it can be intercepted and exchanged for account access.
• Authorization code becomes account takeover vectorBecause the authorization code can be exchanged for access to the user's account, controlling where it is delivered is equivalent to controlling account access. The redirect_uri is the final step ensuring the code reaches only the real application, making loose validation a direct path to account compromise.
• Correct validation requires exact matchingThe OAuth specification mandates exact string matching of the redirect_uri against a pre-registered value, anchored to the full scheme, host, and path. Substring checks, unanchored 'starts-with' checks, and other partial matching strategies are all bypassable and must be rejected entirely.
• Real-world prevalence and impact mappingLoose redirect_uri validation is documented as a recurring source of OAuth account-takeover reports because developers often choose the shortcut of substring validation. The OWASP Top 10 (2021) maps this vulnerability to Broken Access Control (A01) and Security Misconfiguration (A05), reflecting its significance in production systems.
• PKCE provides defense-in-depth but not primary fixThe article notes that PKCE (Proof Key for Code Exchange) reduces the damage of a stolen code but does not replace exact redirect_uri matching. Both controls must be implemented together; PKCE alone is insufficient to prevent redirect_uri bypass attacks.
• Testing approach for security assessmentWhen authorized to test OAuth systems, probe the redirect_uri validation by using your own domain while carrying the trusted string as a subdomain or path element. If the provider accepts such a URL, the matching logic is too loose and requires remediation.

Bottom line: OAuth redirect_uri validation must perform exact string matching against a pre-registered value anchored to the full scheme, host, and path; any substring, prefix, or partial matching approach enables attackers to redirect authorization codes to attacker-controlled destinations and compromise user accounts. Defenders must reject loose validation patterns entirely and treat exact matching as a non-negotiable requirement, not a nice-to-have optimization.