Web Security · Middle · Question 52 of 75
Why must the authorization server match redirect_uri exactly against registered values?
- 1Because URLs with query strings are not allowed in OAuth
- ✓Correct answer: Loose matching lets an attacker redirect codes or tokens to a URL they control
- 3Because the browser checks redirect URIs itself
Explanation
Prefix or wildcard matching has caused many real token leaks. Exact string matching is required by the security best practices.