Bind the response to the app’s request
07A callback arriving on the device must correspond to an outstanding authorization request.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 8.9 ↗
RFC 8252 · § 8.9EXAMPLE
3 / 3
03
Reject a callback without a pending match.
Do not attach foreign authorization to the current app session.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 8252 § 8.10RFC 9700 § 4.4.2
Later mix-up guidance describes checking the response issuer (iss); distinct redirect URIs should be used when other options are unavailable.
Read the updated RFC section ↗Reject unsolicited or mismatched callbacks.
- Use a high-entropy state value and match it against a pending request, as recommended here.
- For multiple authorization servers, § 8.10 requires a unique redirect URI per server and recording that URI in the session.
- All exact redirect checks remain necessary.
The later OAuth security BCP describes issuer identification as the preferred mix-up defense and distinct redirect URIs as a fallback.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy