Pitfall Redirect URI Exact Matching

Pitfall: Redirect URI exact matching

Affects: OAuth redirect URI validation
Category: Configuration

---

The rule

RFC 6749 §3.1.2.3 requires exact string match for redirect URIs, except when the registered URI contains a wildcard (*) at the end of the path.

This server supports two URI forms:

Registered pattern	Matches
Exact URI	Only that exact URI
Pattern ending in *	Any URI with the same scheme, host, and path prefix

---

Common mistakes

Trailing slash mismatch

Registered:  https://chatgpt.com/connector/oauth/callback
Actual sent: https://chatgpt.com/connector/oauth/callback/

→ invalid_redirect_uri

Wrong path segment

Registered:  https://claude.ai/api/oauth/callback
Actual sent: https://claude.ai/api/mcp/auth_callback

→ invalid_redirect_uri (see Pitfall Claude auth_callback vs oauth_callback)

http vs https

Registered:  https://chatgpt.com/connector/oauth/callback
Actual sent: http://chatgpt.com/connector/oauth/callback

→ invalid_redirect_uri (scheme mismatch)

---

Wildcard URIs

For ChatGPT, which uses dynamic per-session callback paths, register a wildcard:

redirect_uris:
  - https://chatgpt.com/connector/oauth/*

This matches any URI with the prefix https://chatgpt.com/connector/oauth/.

Do not register wildcards for clients that have known fixed callback URIs (e.g. Claude.ai) — use exact URIs to minimise redirect hijacking surface.

---

Diagnosis

# The authorize response body will contain invalid_redirect_uri
curl -sk "https://mcp.arleo.eu/authorize?response_type=code&client_id=claude-admin&redirect_uri=THE_URI_CLAUDE_SENT&..."

Check the redirect_uri query parameter in the browser network inspector on the authorize request.