NadaAldahleh/devise_oauth2_providable — comment on commit 2f6091d425c3ac98b71cf91870b1d9fd6bd712b5
File: lib/devise/oauth2_providable/strategies/oauth2_authorization_code_grant_type_strategy.rb line 13
By wireframe:

according to the spec, the redirect_uri in this request must match the parameter passed during the start of the authorization flow which may differ from the client redirect uri. I believe it is acceptable for the redirect_uri during authorization to differ from the redirect_uri set on the client if it is a subpath of the original.

ex:
client.redirect_uri = http://localhost
authorization_code redirect_uri = http://localhost/my/callback

http://tools.ietf.org/html/draft-ietf-oauth-v2-23#section-4.1.3
"ensure that the "redirect_uri" parameter is present if the "redirect_uri" parameter was included in the initial authorization request as described in Section 4.1.1, and if included ensure their values are identical."

I think the only way to solve this issue is to store the initial redirect uri on the authorization code database record and then compare it to the request param.