[FIXED] How does default redirect URL work in Spring Security 5?

Issue

I have gone through below posts. Still I am unable to understand redirection URI concept.

https://www.baeldung.com/spring-webclient-oauth2

href="https://docs.spring.io/spring-security/site/docs/5.0.7.RELEASE/reference/html/oauth2login-advanced.html#oauth2login-advanced-redirection-endpoint" rel="nofollow noreferrer">https://docs.spring.io/spring-security/site/docs/5.0.7.RELEASE/reference/html/oauth2login-advanced.html#oauth2login-advanced-redirection-endpoint

https://docs.spring.io/spring-security/site/docs/5.2.x/reference/html/oauth2.html#oauth2login-sample-redirect-uri

In identity server , we get our client application registered and for code grant type, we tell that this would be our redirect URL i.e. https://someserver:port/

However, spring and other post suggests that to set redirect URI as {baseUrl}/login/oauth2/code/{registrationId}.

I am confused if i have set redirect URI as https://someserver:port/ in identity server , how {baseUrl}/login/oauth2/code/{registrationId} i.e. https://someserver:port/login/oauth2/code/{registrationId} will work.

Should it not give invalid redirect URI?

Solution

The "redirectUrl" parameter is to protect the exchange of an authorization code with an access token so that it's performed by a service available at one of the URLs approved for redirect.

If you use https://someserver:port/*, then it will match all endpoints on that server. When relying on the default Spring Security endpoint {baseUrl}/login/oauth2/code/{registrationId}, it's better to be specific in the redirect URL configuration and use https://someserver:port/login/oauth2/code/{registrationId} as the value. Both options work correctly, but the latter is more secure.

Answered By - Thomas Vitale
Answer Checked By - Gilberto Lyons (JavaFixing Admin)