Redirect URL

|A Consumer's redirect URL is where an OIDC provider (such as OBP-OIDC) sends the User's browser, with an authorisation code, after the User signs in. |Because the code goes wherever the redirect URL points, OBP checks every redirect URL when a Consumer is created or its redirect URL is updated. | |The redirect URL field can hold several URLs separated by commas or spaces. Each one must: | |* use https with a host, or |* use http only for localhost, 127.0.0.1 or [::1] (for development), or |* use an app scheme in reverse-domain form, such as com.example.app:/callback | |and must not contain a wildcard (*), user information (user@host) or a fragment (#). A redirect URL that breaks these rules is refused with OBP-20108. | |## Allowed hosts | |On this instance a redirect URL may point to any host that meets the redirect URL rules. | |An instance can optionally limit the hosts redirect URLs may point to. When it does, each https or http redirect URL must name one of the listed hosts, |or a host under a listed domain, and the API's own host is always allowed. A redirect URL whose host is not listed is refused with OBP-20109. |The host list is checked when a Consumer's redirect URL is created or updated. App schemes are not affected, and neither are |Berlin Group dynamic registration and TPP-Redirect-URI headers, which belong to third parties by definition, nor redirect URLs already stored. | |## Redirect URLs saved before these checks | |A Consumer saved before these checks existed may still hold a redirect URL that breaks them. Such an entry is left out when an OIDC provider reads the Consumer, |so it is never used as a redirect target, and the Consumer's owner should update it. |