feat(auth): support distinct redirect URIs for OAuth mix-up defense (…

[guptamilind0099]

feat(auth): support distinct redirect URIs for OAuth mix-up defense (#2474)

What kind of change does this PR introduce?

Feature / Security Enhancement & Documentation Update

What is the current behavior?

All external OAuth providers share the single redirect URI endpoint (/auth/v1/callback).

As outlined in RFC 9700 § 4.4.2.2 (OAuth 2.0 Security Best Current Practice), using a single shared redirect URI across multiple identity providers presents potential risks for OAuth Mix-Up attacks if an attacker compromises a provider or operates a malicious custom OAuth provider.

Fixes #2474

What is the new behavior?

1. Distinct Redirect URIs per Provider:

   • Added support for provider-specific callback URIs (/auth/v1/callback/{provider}).
   • When a callback is received at /auth/v1/callback/{provider}, GoTrue verifies that {provider} in the URL path matches the flow_state provider saved in the database. If there is a mismatch, the request is rejected with 400 Bad Request (ErrorCodeBadOAuthCallback) and an explicit OAuth mix-up error.

2. Configuration Setting:

   • Added GOTRUE_EXTERNAL_USE_DISTINCT_REDIRECT_URIS setting to ProviderConfiguration (default false). When set to true, outgoing /authorize requests append /{provider} to the redirect URI sent to external identity providers.

3. 100% Backward Compatibility:

   • Existing applications using /auth/v1/callback continue to work without modification.
   • GOTRUE_EXTERNAL_USE_DISTINCT_REDIRECT_URIS defaults to false, keeping existing default behavior unchanged unless explicitly enabled.

4. Environment & Testing:

   • Documented GOTRUE_EXTERNAL_USE_DISTINCT_REDIRECT_URIS in example.env.
   • Added unit tests covering distinct URI generation, mix-up mismatch rejection, and legacy callback backward compatibility.

Additional context

Verification Tests

$ go test -v ./internal/api/ -run "TestOAuthMixUpCallbackCheck|TestUseDistinctRedirectURIsConfig|TestLegacyCallbackBackwardCompatibility"
=== RUN   TestUseDistinctRedirectURIsConfig
--- PASS: TestUseDistinctRedirectURIsConfig (0.00s)
=== RUN   TestOAuthMixUpCallbackCheck
--- PASS: TestOAuthMixUpCallbackCheck (0.00s)
=== RUN   TestLegacyCallbackBackwardCompatibility
--- PASS: TestLegacyCallbackBackwardCompatibility (0.00s)
PASS
ok  	github.com/supabase/auth/internal/api	0.483s