{"record":{"id":"b813e071eaddf118","repo":"langgenius/dify","slug":"redirect-uri-is-invalid","errorCode":null,"errorMessage":"redirect_uri is invalid","messagePattern":"redirect_uri is invalid","errorType":"http","errorClass":"BadRequest","httpStatus":400,"severity":"error","filePath":"api/controllers/console/auth/oauth_server.py","lineNumber":163,"sourceCode":"\n        return view(self, oauth_provider_app, account, *args, **kwargs)\n\n    return decorated\n\n\n@console_ns.route(\"/oauth/provider\")\nclass OAuthServerAppApi(Resource):\n    @setup_required\n    @console_ns.expect(console_ns.models[OAuthProviderRequest.__name__])\n    @console_ns.response(200, \"Success\", console_ns.models[OAuthProviderAppResponse.__name__])\n    @oauth_server_client_id_required\n    @model_validate(OAuthProviderRequest)\n    def post(self, payload: OAuthProviderRequest, oauth_provider_app: OAuthProviderApp):\n        redirect_uri = payload.redirect_uri\n\n        # check if redirect_uri is valid\n        if redirect_uri not in oauth_provider_app.redirect_uris:\n            raise BadRequest(\"redirect_uri is invalid\")\n\n        return jsonable_encoder(\n            {\n                \"app_icon\": oauth_provider_app.app_icon,\n                \"app_label\": oauth_provider_app.app_label,\n                \"scope\": oauth_provider_app.scope,\n            }\n        )\n\n\n@console_ns.route(\"/oauth/provider/authorize\")\nclass OAuthServerUserAuthorizeApi(Resource):\n    @setup_required\n    @login_required\n    @account_initialization_required\n    @with_current_user\n    @console_ns.expect(console_ns.models[OAuthClientPayload.__name__])\n    @console_ns.response(200, \"Success\", console_ns.models[OAuthProviderAuthorizeResponse.__name__])","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/controllers/console/auth/oauth_server.py#L145-L181","documentation":"Flask BadRequest (HTTP 400) raised at oauth_server.py:163 in OAuthServerAppApi.post (POST /console/api/oauth/provider) when the payload.redirect_uri is not present in oauth_provider_app.redirect_uris. This is the standard OAuth 2.0 redirect_uri allow-list check performed before returning app metadata (icon/label/scope) to the client.","triggerScenarios":"POST /console/api/oauth/provider with a valid client_id and a redirect_uri that is not in the registered allow-list for that OAuthProviderApp. The exact-match membership test `redirect_uri not in oauth_provider_app.redirect_uris` fails.","commonSituations":"Client changed its callback URL (e.g. localhost -> production domain) without updating the app registration; trailing slash mismatch; http vs https mismatch; or a completely wrong callback entered.","solutions":["Register the exact redirect_uri (scheme, host, port, path, and trailing slash) in the OAuthProviderApp.redirect_uris list.","Copy the redirect_uri from the registered list verbatim into the request rather than retyping it.","If multiple environments are needed, register all of them rather than reusing one app across envs.","Pre-validate the URI locally against the fetched allow-list before calling the endpoint."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Fetch the registered redirect_uris and ensure yours is in the list before calling.\nconst meta = await fetch('/console/api/oauth/provider', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({client_id: cid, redirect_uri: ru})}).then(r=>r.json());\nif (!meta || meta.error) { throw new Error('redirect_uri not allowed'); }","typeGuard":"function redirectUriAllowed(uri: string, allowed: string[]): boolean {\n  return allowed.includes(uri);\n}","tryCatchPattern":"try {\n  await getAppMetadata(cid, redirectUri);\n} catch (e) {\n  if (/redirect_uri is invalid/i.test(e.message)) { registerRedirectUri(redirectUri); }\n  else throw e;\n}","preventionTips":["Register every callback variant (http/https, trailing slash) you will use.","Copy URIs from the registration rather than typing them.","Avoid reusing one app across environments with different callbacks."],"tags":["oauth-server","redirect-uri","validation","registration"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}