How does default redirect URL work in Spring Security 5?

Question

I have gone through below posts. Still I am unable to understand redirection URI concept.

https://www.baeldung.com/spring-webclient-oauth2

https://docs.spring.io/spring-security/site/docs/5.0.7.RELEASE/reference/html/oauth2login-advanced.html#oauth2login-advanced-redirection-endpoint

https://docs.spring.io/spring-security/site/docs/5.2.x/reference/html/oauth2.html#oauth2login-sample-redirect-uri

In identity server , we get our client application registered and for code grant type, we tell that this would be our redirect URL i.e. https://someserver:port/

However, spring and other post suggests that to set redirect URI as {baseUrl}/login/oauth2/code/{registrationId}.

I am confused if i have set redirect URI as https://someserver:port/ in identity server , how {baseUrl}/login/oauth2/code/{registrationId} i.e. https://someserver:port/login/oauth2/code/{registrationId} will work.

Should it not give invalid redirect URI?

Answer 1

The "redirectUrl" parameter is to protect the exchange of an authorization code with an access token so that it's performed by a service available at one of the URLs approved for redirect.

If you use https://someserver:port/*, then it will match all endpoints on that server. When relying on the default Spring Security endpoint {baseUrl}/login/oauth2/code/{registrationId}, it's better to be specific in the redirect URL configuration and use https://someserver:port/login/oauth2/code/{registrationId} as the value. Both options work correctly, but the latter is more secure.