Allow empty redirect_url in authorization_code flow

I'm using Authorization Code flow to authorize OAuth2 client. The redirect_uri will be dynamic, different each time for the same client.

The issue is that AuthCodeGrant does not allow to authorize when client has empty redirect_url set in configuration.

The same issue is true for any Grant extending from AbstractGrant class, because validation method does not allow empty redirect_uri in ClientEntity.

Here is how I create the client:

./bin/console trikoder:oauth:create-client --grant-type=authorization_code --grant-type=refresh_token --public my_client_id

 [OK] New oAuth2 client created successfully.                                                                           

 -------------- -------- 
  Identifier     Secret  
 -------------- -------- 
  my_client_id           
 -------------- --------

and the database entry is as follow:

# identifier, secret, redirect_uris, grants, scopes, active, allow_plain_text_pkce
'my_client_id', NULL, NULL, 'authorization_code refresh_token', NULL, '1', '0'

The code that should allow empty redirect_uri is in AbstractGrant. Please note that this method does not check if $client->getRedirectUri() is an empty array:

    protected function validateRedirectUri(
        string $redirectUri,
        ClientEntityInterface $client,
        ServerRequestInterface $request
    ) {
        if (\is_string($client->getRedirectUri())
            && (strcmp($client->getRedirectUri(), $redirectUri) !== 0)
        ) {
            $this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
            throw OAuthServerException::invalidClient($request);
        } elseif (\is_array($client->getRedirectUri())
            && \in_array($redirectUri, $client->getRedirectUri(), true) === false
        ) {
            $this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
            throw OAuthServerException::invalidClient($request);
        }
    }

trikoder / oauth2-bundle

Allow empty redirect_url in authorization_code flow #188