Why is the redirect_uri critical in OAuth flows?

Why is the redirect_uri critical in OAuth flows?

• A. It defines token expiration
• B. It ensures the authorization server redirects to the correct client after authorization
• C. It holds user credentials
• D. It controls the UI color theme

Answer: (B)

Redirect URI tells the authorization server where to send the user back after they grant access, so the response (like an authorization code or token) goes to the legitimate client application. In OAuth, clients register one or more redirect URIs ahead of time, and the server must redirect to one of these exact locations. This ensures the token or code isn’t sent to a malicious site and helps the client complete the flow securely by delivering the response to the right place. The redirect URI also serves as a security check: if the URI in the request doesn’t match a registered one, the server can reject the flow, preventing certain attacks. The other options don’t fit because token expiration is a property of the token itself, not where the server redirects; user credentials aren’t exposed through the redirect; and the UI theme has no role in the OAuth authorization flow.

Redirect URI tells the authorization server where to send the user back after they grant access, so the response (like an authorization code or token) goes to the legitimate client application. In OAuth, clients register one or more redirect URIs ahead of time, and the server must redirect to one of these exact locations. This ensures the token or code isn’t sent to a malicious site and helps the client complete the flow securely by delivering the response to the right place. The redirect URI also serves as a security check: if the URI in the request doesn’t match a registered one, the server can reject the flow, preventing certain attacks.

The other options don’t fit because token expiration is a property of the token itself, not where the server redirects; user credentials aren’t exposed through the redirect; and the UI theme has no role in the OAuth authorization flow.