I am currently implementing a first version/poc of an OIDC flow for our native .net application. When it comes to the redirect URL, I am currently not sure if I am handling it correctly or if what I am doing might be a potential security risk.
What I am currently doing is the following:
- Authenticate with users smartcard/certificate using the OIDC provider
- Use the cookie from step one to get an authorization code from the OIDC provider
- Exchange authorization code for an actual token
My “issue” is with step two. Since we are running a native client the redirect URL the OIDC provider in step two redirects to is just a dummy URL that I created that does absolutely nothing. In the client app I just grab the redirect response from step two, extract the authorization code and continue with the normal flow. No redirection takes place at any point.
This works and I can successfully retrieve a token, but I am wondering if I am opening up the application to security issues somewhere here.
For clarity… I obviously also use ClientId, ClientSecret, code challenge and code verifier in my flow. I just omitted them in step 1-3 to make the question clearer.
I am happy about any input. Thanks in advance!