Which statement best describes the redirect_uri in OAuth?

Which statement best describes the redirect_uri in OAuth?

• A. The base API endpoint of the resource server
• B. The URI where the authorization server redirects the user after authorization
• C. The client's display name
• D. The token used for session management

Answer: (B)

The redirect_uri is the URL to which the authorization server sends the user after they grant consent. This address is pre-registered with the server and provided in the authorization request so the server knows where to deliver the response, which typically includes an authorization code (for the authorization code flow) or tokens (for other flows). It also helps prevent redirection to untrusted sites by ensuring the response lands at the legitimate client. It’s not the base API endpoint of the resource server, not the client’s display name, and not the token used for session management.

The redirect_uri is the URL to which the authorization server sends the user after they grant consent. This address is pre-registered with the server and provided in the authorization request so the server knows where to deliver the response, which typically includes an authorization code (for the authorization code flow) or tokens (for other flows). It also helps prevent redirection to untrusted sites by ensuring the response lands at the legitimate client. It’s not the base API endpoint of the resource server, not the client’s display name, and not the token used for session management.