Hi team, quick security question: We’re using the default OIDC Federated App for our BFF auth gateway. I noticed there’s no field to restrict allowed redirect_uris in the console. Does Descope handle redirect validation automatically, or is there a way to configure a registered allowlist to prevent open redirect attacks?

Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. ### Redirect URI Validation in Descope No Per-App Redirect URI Allowlist The OIDC Federated Application settings in Descope focus on: • Flow Hosting URL — where your auth flow is hosted • Issuer URL / Discovery URL — for OIDC provider configuration • Supported Claims and Force Authentication options There is no built-in field within the OIDC Federated App configuration to explicitly allowlist specific

redirect_uri

values. ### How Descope Handles Redirect URI Validation Descope validates redirect URIs at the project level using _Approved Domains_: • Navigate to Project Settings → Security → Approved Domains • Configure the domains that are allowed for redirect and verification URLs across all authentication methods • Redirect URIs are validated against this trusted domain list • ⚠️ Leaving Approved Domains empty disables validation and creates security vulnerabilities — so this should always be configured. ### Recommendation To protect against open redirect attacks: 1. Set Approved Domains — Go to

Project Settings → Security → Approved Domains

and configure the domains that are allowed for redirect and verification URLs.

Hi @Oren Pinkas Let me clarify the exact setup and what controls are available Understanding your setup When you use the "default OIDC Federated App," Descope is acting as the Identity Provider — your BFF gateway is the OIDC client connecting to Descope's

/authorize

and

/token

endpoints. This is the standard BFF auth pattern. There is no per-app redirect_uri allowlist for OIDC Federated Apps The OIDC Federated App settings only expose a Flow Hosting URL, Issuer/Discovery URL, and a Client ID/Secret. There's no dedicated

redirect_uri

allowlist field at the app level for this type. How Descope handles redirect URI validation Redirect URI validation is enforced at the project level via Approved Domains: →

Project Settings → Security → Approved Domains

All redirect URIs used across your OIDC flows are validated against this list. A few important things to know: • Enter domains without the protocol (e.g.

<http://yourdomain.com|yourdomain.com>

, not

<https://yourdomain.com>

) • Leaving this empty completely disables validation — which is a real open redirect risk in production, so always keep this populated • For your BFF, just add the domain(s) your callback endpoint lives on BFF-side enforcement As an additional layer, your BFF gateway should also validate the

redirect_uri

against its own registered list before forwarding the OIDC authorization request. This is standard OAuth 2.0 defense-in-depth, independent of what Descope enforces. So basically, Descope's Approved Domains + your BFF's own redirect validation = proper protection against open redirect attacks for this setup. Just let me know if this helps you.

Thank you @Akash Jivane, this helps a lot