RFC 6749 §4.1.3 says the `redirect_uri` used at the token endpoint must match the one used at authorization, if one was supplied there. Right now the token endpoint doesn't even declare `redirect_uri` in its route args, let alone check it.
Same mechanism as PKCE (#1): store it on the authorization code, check it in `validate()`. But enforcing it strictly would break every existing client that doesn't send `redirect_uri` at exchange, so this needs a soft-enforcement flag (store and check when supplied, don't require it yet) with a deprecation window before it becomes mandatory.
RFC 6749 §4.1.3 says the `redirect_uri` used at the token endpoint must match the one used at authorization, if one was supplied there. Right now the token endpoint doesn't even declare `redirect_uri` in its route args, let alone check it.
Same mechanism as PKCE (#1): store it on the authorization code, check it in `validate()`. But enforcing it strictly would break every existing client that doesn't send `redirect_uri` at exchange, so this needs a soft-enforcement flag (store and check when supplied, don't require it yet) with a deprecation window before it becomes mandatory.