Doorkeeper::Errors::InvalidRedirectUri Raised When No Redirect URI Set

[brent-cybrid]

Steps to reproduce

Create an application with no redirect_uri set, i.e., redirect_uri=nil.

Set allow_blank_redirect_uri = true in the Doorkeeper config.

Hit GET /oauth/authorize with redirect_uri='' or redirect_uri=nil or omit the redirect_uri parameter.

Observe an Doorkeeper::Errors::InvalidRedirectUri exception with the message The requested redirect uri is malformed or doesn't match client redirect URI.

Expected behavior

In versions 5.6.6 and before an authorization code was returned.

Actual behavior

An Doorkeeper::Errors::InvalidRedirectUri exception with the message The requested redirect uri is malformed or doesn't match client redirect URI.

System configuration

Set allow_blank_redirect_uri = true in the Doorkeeper config.

[brent-cybrid]

Has this been looked at?

[nbulaj]

Hey @brent-cybrid .

In versions 5.6.6 and before an authorization code was returned.

I believe it was always like this 🤔

https://github.com/doorkeeper-gem/doorkeeper/blob/main/lib/doorkeeper/oauth/pre_authorization.rb#L100-L107

In any case this behavior should be reviewed ,m more details here #1678