During OAuth setup for a parks reservation app, a developer changes the authorize redirect to an ad-hoc localhost URL that was never registered with the authorization server. What grant rule does that violate?
Select an answer to reveal the explanation.
Short Explanation
The return address on the ticket has to match the address on file—like a courier who only delivers to the registered desk. Inventing a convenient localhost mid-flight is how a code gets stolen.
Full Explanation
Both the authorization request and the token exchange carry the redirect URI that was registered for the client. A mismatched or open redirect enables authorization-code interception. Consumers must not invent a convenient callback at runtime unless that exact URI was registered with the authorization server.