Server tests · Authorization requests
S208 Refuses an unregistered cross-origin redirect URI
Required Browser check
What this test does
Sends a request whose redirect_uri is on a different host from the client_id and is not listed in the client metadata.
How it passes
Your server shows an error and never sends the browser to the unregistered URI. Showing the full redirect URL on the consent screen instead is a warning; redirecting with a code is a failure.
- Specification
- §4.2.2, §10.1, RFC 6749 §4.1.2.1
- Needs
- S106 Authorization endpoint is listed