Bhauu Auth
OAuth

OAuth Redirect URIs Explained: Exact Matching, Security, and Common Mistakes

A redirect URI is an exact callback destination, not a flexible return URL. Learn which details matter and why state is separate.

A redirect URI is where an authorization server returns the browser after an authorization attempt. Treat it as a registered security boundary, not a free-form destination supplied at login time.

What must match?

For Bhauu Auth, register the complete callback URI in the Developer Portal and use that exact URI in the authorization request and code exchange. The scheme (https versus http), hostname, port, path, and trailing slash can all change the URI. If a query string is part of your callback registration, keep its representation consistent too; do not use changing query parameters as an unregistered return-path mechanism.

Registered: https://example.com/auth/callback

Different: http://example.com/auth/callback or https://example.com/auth/callback/

Production web callbacks should use HTTPS. A localhost callback can be used for development only when that exact URI is registered. Do not assume a wildcard, arbitrary subdomain, or nearby port will be accepted.

Redirect matching is not state validation

Registration constrains where Bhauu Auth may send a response. The application must still check the returned state against the pending login transaction in the same browser. A correctly registered callback with the wrong state is still invalid. Reject it before exchanging the code.

When a callback is rejected

  • Compare the exact requested URI with the registered one, including scheme, port, path, and slash.
  • Check that the code exchange uses the same redirect URI as the authorization request.
  • Verify that the selected client ID owns that registered callback; another application's registration does not count.
  • Keep application return destinations in a validated local transaction, not in an arbitrary OAuth callback URI.

Never put a password, access token, or client secret in a redirect URI. Avoid logging the one-time code returned to the callback.

Takeaway

Exact callback registration limits the destination; state validation ties the response to a real login attempt. You need both. See the Redirect URIs and Security guides for Bhauu Auth's current integration rules.