OAuth and OIDC
Redirect URI matching
Understand exact callback matching and fix redirect_uri_mismatch safely.
The complete value must match
Authometry looks up the client before using a redirect target, then compares redirect_uri with its registered values. It does not normalize hosts, remove ports, add slashes, resolve relative paths, or accept wildcard subdomains.
Example
Registered: https://client.example/callback
Accepted: https://client.example/callback
Rejected: https://client.example/callback/
Rejected: http://client.example/callback
Rejected: https://www.client.example/callbackCorrect a mismatch
- Copy the observed redirect_uri from the denied authorization trace.
- Compare it with the application's registered values, including encoded query text.
- Fix the client when the observed value is unintended; register it only when it is a trusted callback.
- Retry with a fresh state, nonce, verifier, and authorization request.
Authometry does not redirect an invalid request to an untrusted URI. The error is rendered at the authorization server.