---
title: "Discussion on \"OAuth2: Why should we validate the `redirect_uri` when exchanging the authorization code for an access token?\" | Hashnode"
description: "Discussion on \"OAuth2: Why should we validate the `redirect_uri` when exchanging the authorization code for an access token?\". Beware, technical article ahead!\n\nOAuth 2 and OpenID are complex protocols. It's full of tiny details that are there for the sake of security and it's not always clear why some checks are necessary. This article is about such a detail.\nPrelude\nBefore..."
url: "https://hashnode.com/posts/oauth2-why-should-we-validate-the-redirecturi-when-exchanging-the-authorization-code-for-an-access-token/6476f73ee7c8f9a1c200e819"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [OAuth2: Why should we validate the \`redirect\_uri\` when exchanging the authorization code for an access token?](https://blog.passwordless.id/oauth2-why-should-we-validate-the-redirecturi-when-exchanging-the-authorization-code-for-an-access-token?utm_source=hashnode&utm_medium=feed)

Beware, technical article ahead! OAuth 2 and OpenID are complex protocols. It's full of tiny details that are there for the sake of security and it's not always clear why some checks are necessary. This article is about such a detail. Prelude Before...

May 31, 2023 · 3 min read · blog.passwordless.id  
Updated Jan 30, 2025  
Read the article

-   [#oauth2](https://hashnode.com/tag/oauth2)
-   [#oauth](https://hashnode.com/tag/oauth)
-   [#security](https://hashnode.com/tag/security)

## Written by

[Arnaud Dagnelies](https://hashnode.com/@dagnelies)

@dagnelies

  
[View profile](https://hashnode.com/@dagnelies)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.