OAuth 2.0 Redirect URI Attacks: Code Theft, Login CSRF, and PKCE

Core Concepts & Key Terms

Authorization Code

A short-lived credential returned through the browser redirect. The client exchanges it at the token endpoint; redemption is bound to the client and redirect URI, and to a PKCE verifier when PKCE is used.

redirect_uri exact matching

RFC 9700 requires the authorization server to compare a requested redirect URI with a pre-registered URI using exact string matching, with a narrow dynamic-port exception for native-app localhost redirects.

state and login CSRF

An unpredictable value bound to the browser session and checked on callback can correlate the response with a login the user initiated. Enforced PKCE can also provide CSRF protection; clients may use both for defense in depth.

PKCE (Proof Key for Code Exchange)

The client creates a secret code verifier and sends its derived challenge in the authorization request. The token endpoint requires the verifier to redeem the code, reducing code-interception risk for public and confidential clients.

Step-by-Step Redirect and Login-CSRF Attack Paths

Source Code: Flaw vs. Secure Implementation

# VULNERABLE: user input is embedded in redirect_uri; state and PKCE are absent.
from urllib.parse import urlencode
from flask import Flask, request, redirect

app = Flask(__name__)
AUTHORIZATION_ENDPOINT = "https://oauth-provider.example/authorize"

@app.route("/auth/login")
def oauth_login():
    next_url = request.args.get("next", "")
    # The callback is an open redirect, and this URI varies with user input.
    redirect_uri = "https://app.example/redirect?next=" + next_url
    params = {
        "client_id": "example-client",
        "response_type": "code",
        "redirect_uri": redirect_uri,
    }
    # Exploitation also requires the authorization server to accept this URI
    # under an unsafe wildcard or prefix rule.
    return redirect(AUTHORIZATION_ENDPOINT + "?" + urlencode(params))

@app.route("/auth/callback")
def oauth_callback():
    # No state check ties this response to the browser's login attempt.
    code = request.args.get("code")
    return exchange_code_for_tokens(code)  # no PKCE verifier provided

# SECURE: fixed registered redirect URI, session-bound state, and PKCE.
import base64
import hashlib
import secrets
from urllib.parse import urlencode
from flask import Flask, request, redirect, session, abort

app = Flask(__name__)
AUTHORIZATION_ENDPOINT = "https://oauth-provider.example/authorize"
REDIRECT_URI = "https://app.example/auth/callback"  # exact registered value
CLIENT_ID = "example-client"

@app.route("/auth/login")
def oauth_login():
    state = secrets.token_urlsafe(32)
    verifier = secrets.token_urlsafe(64)
    challenge = base64.urlsafe_b64encode(
        hashlib.sha256(verifier.encode("ascii")).digest()
    ).rstrip(b"=").decode("ascii")
    session["oauth_state"] = state
    session["pkce_verifier"] = verifier
    params = {
        "client_id": CLIENT_ID,
        "response_type": "code",
        "redirect_uri": REDIRECT_URI,
        "state": state,
        "code_challenge": challenge,
        "code_challenge_method": "S256",
    }
    return redirect(AUTHORIZATION_ENDPOINT + "?" + urlencode(params))

@app.route("/auth/callback")
def oauth_callback():
    expected = session.pop("oauth_state", None)
    if not expected or not secrets.compare_digest(
        request.args.get("state", ""), expected
    ):
        abort(403, "Invalid OAuth state")

    code = request.args.get("code")
    verifier = session.pop("pkce_verifier", None)
    if not code or not verifier:
        abort(400, "Missing authorization response")

    # The token request must use this exact redirect_uri and verifier.
    tokens = exchange_code_for_tokens(
        code=code, redirect_uri=REDIRECT_URI, code_verifier=verifier
    )
    session["user_id"] = tokens["user_id"]
    return redirect("/dashboard")

Engineering Hardening Checklist

• Configure the authorization server to compare redirect_uri with a pre-registered URI using exact string matching. Preserve only the RFC 9700 exception for native-app localhost ports.
• Do not put a user-controlled destination in an OAuth callback URI. Remove open redirects from callback paths and accept only allow-listed local route identifiers.
• Use authorization code flow with PKCE S256 for every client type. Send the same registered redirect_uri in the authorization and token requests.
• Bind the callback to the login attempt: validate a one-time, session-bound state, or rely on PKCE for CSRF only when the authorization server’s PKCE support is enforced. Using both is valid defense in depth.
• A captured authorization code is not sufficient by itself. Ensure token redemption also requires the correct client authentication and PKCE verifier; never put access tokens in redirect URLs.
• Avoid logging authorization codes and set a restrictive Referrer-Policy on callback pages; do not render third-party content before removing sensitive query parameters.