Is it allowed for a Native App client to use any random available port in a redirect URI?

user_12376654 0
Viewed 360

I'm in the process of understanding how to implement OAuth 2.0 native app the right way for Windows. And I've stumbled across this example written in C#. But this is what bugs me about this example:

// Creates a redirect URI using an available port on the loopback address.
string redirectUri = $"http://{IPAddress.Loopback}:{GetRandomUnusedPort()}/";

Everywhere I've read about OAuth 2.0, it's explicitly said that redirect_uri must be pre-registered on OAuth server and can't be dynamic. Is the example wrong or I am missing something?

oauth-2.0 google-oauth c#
2 Answers

According to OAuth for Native Apps you should be able to register a static redirect URI like this:

  • http://localhost/callback

Then at runtime you should be able to use various redirect URLs like this:

  • http://localhost:8001/callback
  • http://localhost:8002/callback
  • http://localhost:8003/callback

I have rarely seen this supported though, and more commonly you need to register three or so specific URLs instead. You need to test for your provider to be sure.

user_90198850

Thanks to the Gary's reply and his link provided, I've found this piece:

The authorization server MUST allow any port to be specified at the time of the request for loopback IP redirect URIs, to accommodate clients that obtain an available ephemeral port from the operating system at the time of the request.

In my original post I was confused by the example utilizing a random available port that made redirect-uri dynamic. But it turns out, the oauth server must allow any port of redirect-uri that comes from the client as soon as it's on a loopback interface.

user_123766540
Related