https://nalar.dev/tags/oauth/ Recent content in OAuth on Nalar Hugo en-us Mon, 07 Sep 2026 00:00:00 +0700 https://nalar.dev/match-oauth-redirect-uris-exactly/ Mon, 07 Sep 2026 00:00:00 +0700 https://nalar.dev/match-oauth-redirect-uris-exactly/ <p>An OAuth authorization server eventually has to answer a deceptively simple question: <strong>where may it send the browser after authorization?</strong></p> <p>If that destination is validated too loosely, an authorization response intended for one client can be sent somewhere the client does not control. In an authorization-code flow, that can expose the authorization code to another endpoint. Other protections may still limit what can be done with a leaked code, but redirect validation should not create the leak in the first place.</p>