OAuth Redirect URI Hijack Lab
An authorization server validates redirect_uri loosely. Steal an authorization code by redirecting it to your own endpoint.
An authorisation server that validates redirect_uri loosely. Because the authorisation code is delivered to that URI, controlling it means receiving the code — and the code exchanges for a token.
How to use it
- Walk through the normal authorisation flow.
- Alter redirect_uri within what the loose validation allows.
- Receive the authorisation code at your own endpoint.
What to take away
redirect_uri must be matched exactly
Prefix and substring matching both fail — an attacker appends a path or a subdomain the check accepts. Exact string comparison against registered values is the only safe rule.
PKCE closes the interception window
It binds the code to a secret the requesting client generated, so a stolen code cannot be exchanged by anyone else.
state is for CSRF, not this
The state parameter prevents cross-site request forgery in the flow. It does not stop code theft via a bad redirect.
Frequently asked questions
Why is exact matching required?
Because any flexibility becomes an attacker-controlled destination. Allowing subdomains means one XSS on any subdomain becomes account takeover across the whole platform.
What is PKCE?
Proof Key for Code Exchange. The client sends a hash of a random verifier when requesting the code and the verifier itself when exchanging it, so an intercepted code is useless alone. Now recommended for all client types.
Where this fits in the course
This security lab pairs with Path 21 — API Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Open Redirect Playground — A login page trusts a returnUrl parameter completely. Turn a genuinely trusted link into a post-login phishing weapon.
- JWT Forgery Lab — Tamper with a JSON Web Token — strip the signature, flip a claim, and watch a vulnerable "verify" endpoint accept it anyway.
- Webhook Signature Forgery Lab — Forge an HMAC-signed webhook without the secret, then flip on signature verification and watch it get rejected.
- CSRF Playground — A "bank" transfer endpoint trusts your cookie alone. Watch a malicious page forge a request on your behalf, then see a CSRF token stop it cold.