From dc03f2136a981e909590a53f1f95ffab6cad1544 Mon Sep 17 00:00:00 2001
From: Ginger <ginger@gingershaped.computer>
Date: Tue, 27 Oct 2026 22:44:05 -0400
Subject: [PATCH] fix: Validate OAuth HTTPS redirect URIs are subdomains of the
 client domain

---
 src/service/oauth/client_metadata.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/service/oauth/client_metadata.rs b/src/service/oauth/client_metadata.rs
index 75d6d15b3..4ee946e8e 100644
--- a/src/service/oauth/client_metadata.rs
+++ b/src/service/oauth/client_metadata.rs
@@ -81,6 +81,15 @@ impl ClientMetadata {
 					if !uri.username().is_empty() || uri.password().is_some() {
 						return Err("HTTPS redirect URIs must not contain credentials.");
 					}
+
+					if !uri
+						.domain()
+						.is_some_and(|domain| is_subdomain(domain, client_domain))
+					{
+						return Err(
+							"All HTTPS redirect URIs must be subdomains of the client URI."
+						);
+					}
 				},
 				| "http" if self.application_type == ApplicationType::Native => {
 					if uri