Overview#
Loopback Interface Redirection is defined in OAuth 2.0 for Native Apps (RFC 8252) section 7.3Native apps that are able to open a port on the loopback network interface without needing special permissions (typically, those on desktop Operating Systems) can use the loopback interface to receive the OAuth redirect.
Loopback redirect URIs use the "http" scheme and are constructed with the loopback IP literal and whatever port the client is listening on.
That is,
http://127.0.0.1:{port}/{path}
http://[::1]:{port}/{path}
http://127.0.0.1:51004/oauth2redirect/example-provider
An example redirect using the IPv6 loopback interface with a randomly assigned port:
http://[::1]:61023/oauth2redirect/example-provider
Clients SHOULD NOT assume that the device supports a particular version of the Internet Protocol. It is RECOMMENDED that clients attempt to bind to the loopback interface using both IPv4 and IPv6 and use whichever is available.
