Validate redirect URL for token response type

oauth/client.go

@@ -17,6 +17,8 @@ var (
 	ErrInvalidClientSecret = errors.New("Invalid client secret")
 	// ErrClientIDTaken ...
 	ErrClientIDTaken = errors.New("Client ID taken")
+	// ErrInvalidRedirectURL ...
+	ErrInvalidRedirectURL = errors.New("Invalid redirect URL")
 )
 
 // ClientExists returns true if client exists
@@ -66,6 +68,14 @@ func (s *Service) AuthClient(clientID, secret string) (*models.OauthClient, erro
 	return client, nil
 }
 
+// CheckRedirectURL -> validate the redirect url
+func (s *Service) CheckRedirectURL(client *Client, redirectURL string) error {
+	if redirectURL != client.RedirectURI.String {
+		return ErrInvalidRedirectURL
+	}
+	return nil
+}
+
 func (s *Service) createClientCommon(db *gorm.DB, clientID, secret, redirectURI string) (*models.OauthClient, error) {
 	// Check client ID
 	if s.ClientExists(clientID) {

oauth/service_interface.go

@@ -32,6 +32,7 @@ type ServiceInterface interface {
 	AuthUser(username, thePassword string) (*models.OauthUser, error)
 	GetScope(requestedScope string) (string, error)
 	Login(client *models.OauthClient, user *models.OauthUser, scope string) (*models.OauthAccessToken, *models.OauthRefreshToken, error)
+	CheckRedirectURL(client *Client, redirectURL string) error
 	GrantAuthorizationCode(client *models.OauthClient, user *models.OauthUser, expiresIn int, redirectURI, scope string) (*models.OauthAuthorizationCode, error)
 	GrantAccessToken(client *models.OauthClient, user *models.OauthUser, expiresIn int, scope string) (*models.OauthAccessToken, error)
 	GetOrCreateRefreshToken(client *models.OauthClient, user *models.OauthUser, expiresIn int, scope string) (*models.OauthRefreshToken, error)

web/authorize.go

@@ -94,6 +94,12 @@ func (s *Service) authorize(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
+		err = s.oauthService.CheckRedirectURL(client, redirectURI.String())
+		if err != nil {
+			errorRedirect(w, r, redirectURI, "invalid_redirect_uri", state, responseType)
+			return
+		}
+
 		// Grant an access token
 		accessToken, err := s.oauthService.GrantAccessToken(
 			client,   // client