Redirect-uri-validation (Section)#
Path: /profiles/profile/settings/authorization-server/ephemeral-client/redirect-uri-validation
Controls which redirect_uris an ephemeral client may register in its Client ID Metadata Document. Only applies when the code capability is enabled.
Parameters#
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| redirect-uri-same-origin | boolean | optional | true | When enabled, redirect_uris in the Client ID Metadata Document that use the https scheme and resolve to a regular domain name (i.e. that are neither loopback nor IP-literal addresses) must have the same origin (scheme, host and port) as the client_id. When disabled, any https redirect_uri listed in the metadata document is accepted regardless of its domain. Loopback redirect URIs are governed by allow-loopback-redirect-uris. |
| allow-loopback-redirect-uris | boolean | optional | false | When enabled, ephemeral clients may list cross-origin loopback redirect URIs (http or https on a different origin than the client_id). This is only relevant when the client_id is not itself a loopback address: a loopback redirect_uri on the same origin as a loopback client_id (which requires localhost-allowed) is always accepted regardless of this setting. The port is not validated when a loopback redirect_uri is used in an authorization request. |