RFC 9700 / ATTACKS & DEFENSES

Redirect URI validation

A permissive redirect pattern can send a code or token straight to an attacker-controlled address.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

DIAGRAM§ 4.1 ↗

RFC 9700 · § 4.1DEFENSE

3 / 3

Send only to the validated callback.

PKCE adds another layer against misuse of a leaked code.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references

WHAT CHANGED

RFC 6749 § 3.1.2.3RFC 9700 § 4.1.3

The framework allowed partial URI registration in some cases. The BCP requires exact string matching, with the native loopback-port exception and the authenticated-request exception described in § 4.1.3.

Read the updated RFC section ↗

KEY POINT

Match registered redirect URIs exactly.

Servers MUST use exact string matching; native localhost redirect ports are the exception.
Callback hosts MUST NOT expose open redirectors. Prefer code over front-channel access tokens.
§ 4.1.3 permits trusting the URI when request origin and integrity are verified, for example authenticated JAR or PAR.

DETAILS

Wildcards can fail even when their parser is correct: an attacker may take over a permitted subdomain. A fragment such as #_ on onward redirects can prevent browser fragment reattachment; it does not replace redirect validation.

Read the RFC section ↗

Diagrams simplify the RFC. Read the linked sections for complete requirements.

Privacy

All chapters in this RFC