Exact redirect URI matching

Authorization servers MUST compare redirection URIs with exact string matching rather than pattern matching: the two URIs must be equal under the Simple String Comparison of RFC 3986 Section 6.2.1. The only exception is native apps using a localhost URI, where the authorization server MUST allow variable port numbers as described in RFC 8252 Section 7.3. Web servers hosting redirection URIs MUST NOT expose open redirectors. Because browsers reattach URL fragments to a Location redirect only when the Location URL has no fragment of its own, servers MAY attach an arbitrary fragment identifier, for example #_, to URLs in Location headers. Clients SHOULD use the authorization code response type instead of response types that issue access tokens at the authorization endpoint, which enables countermeasures against reuse of leaked credentials and against token replay through sender-constraining. When the origin and integrity of the authorization request can be verified, for example with RFC 9101 or RFC 9126 together with client authentication, the authorization server MAY trust the redirection URI without further checks. Scope: OAuth 2.0 security. Reviewed October 4, 2026.