As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/

we should validate the redirect url at 3 points:

  • at time of app registration
  • when the auth flow begins
  • when granting an access token

At the time of registration, we need to validate that the redirect uri doesn't have a hash or the server may have some extra validations for native uris

At the time of the oauth flow, when the redirect uri is passed in the url, it possibly makes sense to validate as well because if the developer has setup multiple redirect uris then the selection would need to be based on the redirect uri passed in the oauth url (are there any other reasons to validate here?)

But at the time of exchanging access token, what security benefits does the redirect uri validation bring in?


1 Answer 1


You need to make sure that the access token is sent back to a valid requester and not just anyone.

  • sure, but what does the redirect uri has to do with that? we are already passing client ID, and client secret (for secure clients), isn't that enough?
    – gaurav5430
    Jan 13, 2023 at 9:34
  • Both of these could have been compromised Jan 13, 2023 at 15:26
  • 1
    yeah, so what does the extra redirect uri check giving us?
    – gaurav5430
    Jan 13, 2023 at 15:33
  • 1
    i think we are talking about different things here. My question is why do we need to pass redirect uri when exchanging for access token, i guess your answer is more relevant to why we pass it in the url and why does it need to be validated in the url
    – gaurav5430
    Jan 14, 2023 at 3:41
  • 1
    The link in my question is actually for text written by the same author. Also this particular page that you linked to does not have specific answers
    – gaurav5430
    Jan 17, 2023 at 11:37

Not the answer you're looking for? Browse other questions tagged .