invalidredirecturi

invalidredirecturi is an error encountered in OAuth 2.0 and OpenID Connect flows when the redirect_uri parameter in an authorization request does not match any pre-registered redirect URIs for the client, or is otherwise invalid. This check helps prevent authorization responses from being sent to an untrusted endpoint.

Causes and scope: The most common cause is a mismatch between the redirect_uri provided in the request and the ones registered for the client. Other issues include missing redirect_uri when required, using http instead of https, including an unexpected port, path, or query, or differences in trailing slashes or URL encoding. Some authorization servers require an exact match, while others may allow a subset or require a registered URI with a specific scheme. For native or mobile applications, redirect URIs may use custom URI schemes or loopback addresses and must be registered exactly.

Impact: When invalidredirecturi is detected, the authorization endpoint typically rejects the request and returns an error rather than proceeding with user authentication or token issuance. This prevents tokens or codes from being issued to an unapproved endpoint.

Resolution guidance: Verify that the redirect_uri in the authorization request exactly matches one of the client’s registered redirect URIs. Check for exact scheme, host, port, path, and any trailing slashes. Ensure the correct URI is used for the current environment (production vs. staging). If you control the client, update the registration or the request accordingly; if you do not, consult the administrator or provider documentation. Some providers also log details to help diagnose which URIs are registered and expected.

Security note: Strict redirect URI validation is a key defense against token interception and open redirect attacks.