Protocols
Redirect URI
The registered address an authorization server sends the user back to, with the authorization code, after sign-in.
What Redirect URI means
A redirect URI is the client's callback address in an OAuth or OpenID Connect flow, where the authorization server returns the authorization code. It must be registered in advance, and RFC 9700 requires the server to compare it by exact string match, because a loosely matched redirect URI lets an attacker receive codes.
Defined in: RFC 6749 section 3.1.2; RFC 9700 section 4.1.
How it works
Wildcards and prefix matching are the historic source of code leakage: an attacker finds an open redirect or a user-content path under the allowed prefix and has codes delivered there.
RFC 8252 makes one exception for native apps: loopback redirect URIs may use any port at runtime.
The mistake people actually make
Registering a production redirect URI that points at a path serving user-generated content or containing an open redirect.
Related terms
Authorization code flow
The OAuth 2.0 flow where the browser receives a short-lived code that the application exchanges for tokens from its server.
PKCE
Proof Key for Code Exchange — binds an authorization code to the client that requested it, so a stolen code is useless.
OAuth 2.0
An authorization framework that lets an application obtain limited access to a resource without handling the user's credentials.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.