Authorization Code Grant redirect_uri is not optional about oauth2

[LyricTian]

Ok, let me fix this bug.

[LyricTian]

The changes have been submitted, you can try to update:

go get -u gopkg.in/oauth2.v3/...

[LyricTian]

From the perspective of the protocol, the redirect url is indeed optional, but the protocol specification does not give a better implementation. Do you have any better implementation? Let's discuss it.

[phisch]

The ClientStore currently stores objects of the type Client, which contains a Domain field. This field should actually be an array of redirection URIs (https://tools.ietf.org/html/rfc6749#section-2). When a request contains a redirection uri, you should check if the given client has this uri in its redirection uris. When the redirection uri is omitted, you should redirect to the only registered redirection_uri of the client, or provide an option to mark one of the registered redirection uris as the default one.

The part with the omitted redirection uri is a bit vague and up to interpretation. I think the solution where you check for the only registered, or the default redurection uri seems like the most reasonable one.

[nihiluis]

@LyricTian can close this I think

[R-omk]

related: #99 #105

I consider this to be a serious vulnerability. It cannot redirect anywhere other than explicitly permitted urls.

https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1

If the request fails due to a missing, invalid, or mismatching
redirection URI, or if the client identifier is missing or invalid,
the authorization server SHOULD inform the resource owner of the
error and MUST NOT automatically redirect the user-agent to the
invalid redirection URI.