Skip to main content

13. Notes on OAuth redirect_uri Pitfalls

Loose validation of redirect_uri in OAuth/OIDC can lead to token theft or account-linking hijacks. Here is a short summary of patterns that often appear in CTFs.

Common validation weaknesses​

  • Confusing https://example.com/callback with https://example.com/callback/..
  • Scheme-relative bypasses such as //evil.com
  • Allowing overly broad query values (?next=https://evil.com)
  • Missing subdomain or port restrictions in the allowlist

Quick testing routine​

  • Apply encoding twice, as in %252f
  • Compare behavior before and after path normalization
  • Insert a #fragment into the redirect_uri value

Defensive measures​

  • Use exact string matching or compare after normalization
  • Pin the allowlist down to the scheme, host, and port
  • Remove intermediate redirects and allow only fixed callbacks

The moment validation accepts values because they are merely "similar," an attacker can construct a redirect chain. Strictness should be the default.