Strict redirect uri validation on authorization request

bshaffer / oauth2-server-php

A library for implementing an OAuth2 Server in php

http://bshaffer.github.io/oauth2-server-php-docs

MIT License

3.26k stars 950 forks source link

Strict redirect uri validation on authorization request #981

Open sgoranov opened 4 years ago

sgoranov commented 4 years ago

It is allowed to insert an empty string or NULL for redirect_uri in oauth_clients table. In these two cases the library blindly trusts on the redirect uri coming from request and uses it to redirect the user there. Probably it's more appropriate to be more restrictive regarding the redirect_uri especially in case of authorization_code flow.