'Oauth redirect endpoint - should it be verified to avoid unwanted traffic to domains that are not under the client's control?
I'm exploring the best practices in implementing OAuth for our users. When our users are creating a client, they are also registering an endpoint where they can be redirected to during the authorization grant.
My question is how should we go on about verifying that the redirect URI belongs to them? This is to prevent them from using a random domain like google.com.
I couldn't find any services that do this sort of verification. Wouldn't this lead to users sending unwanted traffic to domains that they don't own?
In our case, we have found that most of our test clients are using google.com as the redirect endpoint. Could anyone point to the best practice here?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|