evonove/django-oauth-toolkit — pull request #168 by dmitry-krasilnikov (2014-11-18 10:12:14+00:00)
Title: Allowed RedirectURIs fixed

1. There is a problem with allowed redirect URIs check. Redirect URI must start with one of the allowed URIs, it does not have to be fully equal. It is generally accepted practice, for example Slack uses such approach when authorizes clients with OAuth2 protocol.
2. The second problem is that redirect URIs can contain query strings after '?' symbol, some consumers could use query strings for some sort of reasons. It is better to compare paths without query strings.

I've stumbled on these when I was writing backend for django-social-auth which is used by Sentry.