Fix OAuth redirect URI format to align with Microsoft's URL standards #260446

bluedog13 · 2025-08-08T01:23:51Z

OAuth Redirect URI Format Not Aligned with Microsoft's URL Standards

Problem

VS Code's OAuth implementation generates redirect URIs without trailing slashes, while Microsoft's own OAuth 2.0 documentation and standards-compliant identity providers (including Entra ID) require trailing slashes in redirect URIs per RFC specifications.

This creates a mismatch where:

VS Code generates: http://127.0.0.1:3000
IDP expects: http://127.0.0.1:3000/

Root Cause

Microsoft Entra ID (and other compliant IDPs) automatically append trailing slashes to redirect URIs during OAuth flows, following Microsoft's documented standards. However, VS Code's implementation returns URLs without trailing slashes, causing URI mismatch validation failures.

Recent Change Context

A June 29th PR that modified loopbackServer.ts removed the trailing slash, introducing this standards compliance issue. This change made VS Code generate non-compliant redirect URIs that don't align with Microsoft's own OAuth 2.0 format requirements.

Solution

This PR restores trailing slashes in two key locations:

loopbackServer.ts (line 105): Runtime redirect URI generation
oauth.ts (lines 739-746): Dynamic client registration redirect URIs

Changes:

http://127.0.0.1:${port} → http://127.0.0.1:${port}/
http://localhost → http://localhost/
http://127.0.0.1 → http://127.0.0.1/
http://localhost:${port} → http://localhost:${port}/

Impact

Resolves OAuth authentication failures with "redirect_uri_mismatch" errors
Ensures compatibility with standards-compliant OAuth providers
Aligns VS Code with Microsoft's documented OAuth 2.0 URL format requirements

Standards Reference

This change ensures VS Code follows Microsoft's own OAuth 2.0 redirect URI format requirements, improving compatibility with standards-compliant identity providers.

Fixes #260425

This change adds a trailing slash to the redirect URI returned by the loopbackServer's redirectUri getter to match the expected format for OAuth client registration. The issue occurs because Microsoft Entra ID automatically appends a trailing slash to redirect URIs without a path segment, but VS Code was returning URLs without the trailing slash, causing validation failures during OAuth authentication. Fixes microsoft#260425

TylerLeonhardt · 2025-08-08T16:20:20Z

src/vs/workbench/api/node/loopbackServer.ts

 		if (this._port === undefined) {
 			throw new Error('Server is not started yet');
 		}
-		return `http://127.0.0.1:${this._port}`;


Why did you only update this and not the redirect uris?

vscode/src/vs/base/common/oauth.ts

Lines 739 to 747 in a9c4b92

'http://localhost',

'http://127.0.0.1',

// Added these for any server that might do

// only exact match on the redirect URI even

// though the spec says it should not care

// about the port.

`http://localhost:${DEFAULT_AUTH_FLOW_PORT}`,

`http://127.0.0.1:${DEFAULT_AUTH_FLOW_PORT}`

],

The above file has not been updated in a while.

The June 29th PR that modified loopbackServer.ts, removed the trailing slash, introducing this standards compliance issue.

This change may have affected it
a62ed27

Let me update this PR.

Have updated the PR with changes to src/vs/base/common/oauth.ts

Complements the loopbackServer.ts fix by ensuring redirect URIs used in OAuth dynamic client registration also include trailing slashes for complete standards compliance with Microsoft's OAuth 2.0 URL format. Updated redirect URIs: - http://localhost -> http://localhost/ - http://127.0.0.1 -> http://127.0.0.1/ - http://localhost:{port} -> http://localhost:{port}/ - http://127.0.0.1:{port} -> http://127.0.0.1:{port}/

TylerLeonhardt

LGTM, just need you to agree to the contributor agreement and we can get this in!

bluedog13 · 2025-08-08T17:10:27Z

@microsoft-github-policy-service agree

Tyriar · 2025-08-08T18:50:07Z

Tests failing:

11805 passing (1m)
  82 pending
  1 failing

  1) OAuth
       Network Functions
         fetchDynamicRegistration should make correct request and parse response:

      
      + expected - actual

       [
         "https://insiders.vscode.dev/redirect"
         "https://vscode.dev/redirect"
      -  "http://localhost/"
      -  "http://127.0.0.1/"
      -  "http://localhost:33418/"
      -  "http://127.0.0.1:33418/"
      +  "http://localhost"
      +  "http://127.0.0.1/"
      +  "http://localhost:33418"
      +  "http://127.0.0.1:33418/"
       ]

bluedog13 · 2025-08-08T19:03:14Z

Do you want me to open a different PR to fix the tests or update the current one itself?

TylerLeonhardt · 2025-08-08T19:41:00Z

@bluedog13 can you update the current one please

The fetchDynamicRegistration function correctly includes trailing slashes on redirect URIs per the implementation. This updates the test expectations to match the actual behavior, fixing the test failure. The implementation in oauth.ts includes trailing slashes on localhost URIs: - 'http://localhost/' (with trailing slash) - 'http://127.0.0.1/' (with trailing slash) - 'http://localhost:/' (with trailing slash) - 'http://127.0.0.1:/' (with trailing slash) This test was expecting URIs without trailing slashes, causing the assertion to fail. The fix aligns the test with the correct implementation behavior.

bluedog13 · 2025-08-08T20:21:24Z

The tests have been updated.

TylerLeonhardt · 2025-08-08T22:41:55Z

Thanks for contributing @bluedog13!

bluedog13 · 2025-08-08T23:35:08Z

Thank you for accepting the PR. @TylerLeonhardt

bluedog13 mentioned this pull request Aug 8, 2025

VS Code OAuth Redirect URI Format Not Aligned with Microsoft's URL Standards #260425

Closed

vs-code-engineering bot assigned TylerLeonhardt Aug 8, 2025

TylerLeonhardt reviewed Aug 8, 2025

View reviewed changes

bluedog13 changed the title ~~Fix OAuth redirect URI validation by adding trailing slash~~ Fix OAuth redirect URI format to align with Microsoft's URL standards Aug 8, 2025

TylerLeonhardt previously approved these changes Aug 8, 2025

View reviewed changes

vs-code-engineering bot added this to the August 2025 milestone Aug 8, 2025

Tyriar previously approved these changes Aug 8, 2025

View reviewed changes

bluedog13 dismissed stale reviews from Tyriar and TylerLeonhardt via 3ff823a August 8, 2025 20:20

TylerLeonhardt enabled auto-merge (squash) August 8, 2025 20:25

TylerLeonhardt approved these changes Aug 8, 2025

View reviewed changes

Tyriar approved these changes Aug 8, 2025

View reviewed changes

TylerLeonhardt merged commit 8065598 into microsoft:main Aug 8, 2025
17 checks passed

vs-code-engineering bot locked and limited conversation to collaborators Sep 22, 2025

	'http://localhost',
	'http://127.0.0.1',
	// Added these for any server that might do
	// only exact match on the redirect URI even
	// though the spec says it should not care
	// about the port.
	`http://localhost:${DEFAULT_AUTH_FLOW_PORT}`,
	`http://127.0.0.1:${DEFAULT_AUTH_FLOW_PORT}`
	],

Fix OAuth redirect URI format to align with Microsoft's URL standards #260446

Fix OAuth redirect URI format to align with Microsoft's URL standards #260446

Conversation

bluedog13 commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

OAuth Redirect URI Format Not Aligned with Microsoft's URL Standards

Problem

Root Cause

Recent Change Context

Solution

Impact

Standards Reference

Uh oh!

TylerLeonhardt Aug 8, 2025

Choose a reason for hiding this comment

Uh oh!

bluedog13 Aug 8, 2025

Choose a reason for hiding this comment

Uh oh!

bluedog13 Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bluedog13 Aug 8, 2025

Choose a reason for hiding this comment

Uh oh!

TylerLeonhardt left a comment

Choose a reason for hiding this comment

Uh oh!

bluedog13 commented Aug 8, 2025

Uh oh!

Tyriar commented Aug 8, 2025

Uh oh!

bluedog13 commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TylerLeonhardt commented Aug 8, 2025

Uh oh!

bluedog13 commented Aug 8, 2025

Uh oh!

Uh oh!

TylerLeonhardt commented Aug 8, 2025

Uh oh!

bluedog13 commented Aug 8, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

bluedog13 commented Aug 8, 2025 •

edited

Loading

bluedog13 Aug 8, 2025 •

edited

Loading

bluedog13 commented Aug 8, 2025 •

edited

Loading