Aglet

Triage an OAuth redirect URI mismatch

An authorization flow can fail after consent when the callback does not match its registration or session. Freeze one callback and record the sent URI, configured URI, state label, environment, and result without tokens. Separate literal mismatch, stale session, host change, and missing state.

Establish what is happening

  1. Capture the callback attempt

    Record client, environment, authorization start, sent redirect label, callback host, state correlation, and result. Redact authorization codes and tokens. Note whether the failure happened before callback, during state validation, or during token exchange.

  2. Compare registered values

    Compare the exact sent and configured redirect URI, including scheme, host, path, port, and trailing slash. Check environment selection and callback route. A matching URI does not prove the state belongs to this browser session or authorization attempt.

  3. Bound flow variants

    Group failures by environment, redirect difference, browser session, client revision, and callback stage. Separate URI mismatch, missing state, expired session, and token exchange rejection. Keep raw callback data out of shared logs.

What to carry forward

Triage ends with one callback, exact URI comparison, state and session result, affected environment, and evidence gap. Stop before weakening checks. Route registration, session, and exchange questions separately. Keep the initiating session visible to the owner.

Technical background: RFC Editor reference.

Keep the decision with the work.

Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.

Create an account See the product workflow