New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.3.17

v26.3.17​

Loopback redirect URIs now require a matching scheme​

OAuth 2.0 loopback redirects (RFC 8252 section 7.3) with a dynamic port are now accepted only when the registered redirect URI also uses the http scheme. Previously, a client registered with an https loopback redirect URI, such as https://127.0.0.1/callback, also accepted plain http redirects to any port on that host.

Breaking changes​

After upgrading, OAuth2 authorization requests fail redirect URI validation if the client registers only an https loopback URI but the native app requests an http loopback URI with a dynamic port.

To restore the flow, update the OAuth2 client's redirect_uris so the registered URI uses the same scheme, loopback address, path, and query as the URI requested by the app. The port may remain dynamic. For example, if the app requests http://127.0.0.1:<port>/callback, register http://127.0.0.1/callback. For IPv6, register http://[::1]/callback.