Redirect URI matching

Authometry looks up the client before using a redirect target, then compares redirect_uri with its registered values. It does not normalize hosts, remove ports, add slashes, resolve relative paths, or accept wildcard subdomains.

Registered: https://client.example/callback
Accepted:   https://client.example/callback
Rejected:   https://client.example/callback/
Rejected:   http://client.example/callback
Rejected:   https://www.client.example/callback

• Copy the observed redirect_uri from the denied authorization trace.
• Compare it with the application's registered values, including encoded query text.
• Fix the client when the observed value is unintended; register it only when it is a trusted callback.
• Retry with a fresh state, nonce, verifier, and authorization request.