Defend browser redirects from mix-up, replay, and redirect attacks.
OAuth clients must use registered redirect addresses and verify correlation values. OpenID Connect also uses a nonce value to connect an identity result to the sign-in request that created it.
Why this lesson?
A web client receives an OAuth and OpenID Connect authorization response through the browser and must know that the response belongs to the login it started and returns only to an approved endpoint.
Learning goal and prerequisites
Validate the redirect address exactly
The client generates unpredictable state and nonce values for this browser transaction and stores them with the local login attempt. It sends those values with the authorization request so the returned browser response and later OpenID Connect identity result can be matched to the correct transaction.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
OAuth and OpenID Connect send important results through the browser. That creates several risks: a response could be delivered to an unapproved endpoint, attached to the wrong browser transaction, or replayed in another sign-in. Redirect validation, state, and nonce values protect different parts of that front-channel flow.
The redirect address tells the authorization server where the response is allowed to go. The server should compare it with a registered value instead of accepting an arbitrary address supplied at runtime. This prevents an attacker from quietly changing the destination to an endpoint they control.
The state value lets the client connect the returned authorization response to the request it started. The client creates an unpredictable value, stores it with the pending transaction, and requires the same value in the response. In OpenID Connect, a nonce similarly connects the identity result to the sign-in request and helps prevent replay of an old ID token.
These values are useful because they protect different relationships in the flow. The redirect address protects the destination. State protects the browser transaction. Nonce protects the identity result. None of them replaces Proof Key for Code Exchange, issuer checks, or normal token validation.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.