skills.rest
maronnjapan
maronnjapanCOMMUNITY
Explore all skills by this author →
GitHub

oidc-redirect-uri

Validate OpenID Connect redirect URIs against registered policies.

Updated Aug 27, 2026
Search Tags:#security#authentication#oauth-2.1#openid-connect#redirect-uri#uri-validation
One-click install
npx skills add https://github.com/maronnjapan/maronn-openid-provider --skill oidc-redirect-uri
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oidc-redirect-uri
Source: https://github.com/maronnjapan/maronn-openid-provider/tree/main/.claude/skills/oidc-redirect-uri
Command: npx skills add https://github.com/maronnjapan/maronn-openid-provider --skill oidc-redirect-uri

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

OpenID Connect Redirect URI validation is essential to prevent unauthorized redirects by ensuring only registered URIs are used, covering registration, exact matching, query parameter handling, and fragment rejection in Basic OP certification contexts.

Core Features & Use Cases

  • Complete URI registration enforcement for clients (including path components)
  • Exact string matching of redirect_uri with RFC 3986 rules
  • Preserve and validate query parameters, reject added or mismatched ones
  • Reject fragment components in registrations and handle fragments per RFC 6749
  • HTTPS requirement with localhost/loopback exceptions and clear error handling

Quick Start

Validate a sample redirect_uri against a registered list using exact matching and query-parameter rules.

Frequently Asked Questions about oidc-redirect-uri

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate OpenID Connect redirect URIs to prevent unauthorized redirects?▼

Validate OpenID Connect redirect URIs by enforcing exact string matching against registered client URIs, preserving allowed query parameters, rejecting mismatches, and blocking fragments per RFC 6749.

Does OAuth 2.1 redirect_uri validation allow HTTP or require HTTPS?▼

OAuth 2.1 redirect_uri validation enforces HTTPS for all URIs except localhost loopback addresses, providing clear error responses when non-HTTPS URIs are submitted without the loopback exception.

What happens if query parameters in a redirect_uri don't match the registered URI?▼

Redirect URI validation rejects added or mismatched query parameters, preserving only the exact query parameters registered during client registration to maintain strict exact string matching.

Why are URI fragments rejected during OpenID Connect client registration?▼

URI fragments are rejected during OpenID Connect client registration and validation to comply with RFC 6749, preventing redirect manipulation by ensuring no fragment components exist in registered or submitted redirect URIs.

Can I use exact string matching for redirect_uri validation with custom path components?▼

Exact string matching validates redirect URIs with custom path components per RFC 3986 rules, ensuring the entire URI including paths matches the registered client URI exactly before authorizing redirects.

What is redirect_uri validation in OpenID Connect Core 1.0 implementations?▼

Redirect URI validation in OpenID Connect Core 1.0 enforces registered client URI policies through exact string matching, query parameter preservation, fragment rejection, and HTTPS enforcement to prevent unauthorized redirects.

Related Skills

Explore More Software Engineering Skills→
thejefflarsonthejefflarson
20

oauth-implementation

Enforce strict JWT validation and redirect URI matching in OAuth/OIDC implementations.

Community
Advanced
mjunaidcamjunaidca
9

Better Auth OAuth/OIDC Setup Skill

Configure OAuth 2.1 and OpenID Connect with Better Auth's OIDC Provider plugin.

Community
Advanced
jpoutrinjpoutrin
14

oauth

Implement OAuth 2.0 and OpenID Connect authorization code flows with PKCE.

Community
Intermediate
yaklangyaklang
1.6k

oauth-oidc-misconfiguration

Identify OAuth 2.0 and OpenID Connect misconfigurations in redirects, state/nonce binding, PKCE, and token validation.

Official
Advanced