As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/
we should validate the redirect url at 3 points:
- at time of app registration
- when the auth flow begins
- when granting an access token
At the time of registration, we need to validate that the redirect uri doesn't have a hash or the server may have some extra validations for native uris
At the time of the oauth flow, when the redirect uri is passed in the url, it possibly makes sense to validate as well because if the developer has setup multiple redirect uris then the selection would need to be based on the redirect uri passed in the oauth url (are there any other reasons to validate here?)
But at the time of exchanging access token, what security benefits does the redirect uri validation bring in?