Tag See all →

#oauth2

2 stories

Banner: OAuth token leak via prefix-matched redirect_uri and an open redirect in the next parameter

Security Bug Report

OAuth token leak via prefix-matched redirect_uri and an open redirect in next

Daniel Tran · Sep 9, 2025 · 8 min read

Our partner OAuth server matched redirect_uri by prefix, and our login page followed any next URL. Chained together with a legacy implicit flow, an access token could land on an outside domain. We moved to exact matching, relative-only next and code plus PKCE.

Banner: Google sign-in failing with Error 400 redirect_uri_mismatch behind a TLS proxy

Web Development Bug Report

Google sign-in fails with Error 400: redirect_uri_mismatch only in production

Daniel Tran · Aug 21, 2025 · 9 min read

Sign in with Google worked locally and on staging but failed in production with redirect_uri_mismatch. Behind the TLS proxy our FastAPI app built an http:// callback because Uvicorn did not trust the proxy's headers. How we traced and fixed it.