Does Facebook Login validate redirect URIs before TLS certificate verification?

Question

I need to determine the order in which Facebook Login validates OAuth redirect URIs and TLS server certificates during the authorization-code flow. The App Dashboard requires exact redirect-URI matches, while certificate validation is delegated to the operating-system or SDK trust store. Facebook documentation does not state whether an unregistered redirect URI is rejected before or after the TLS handshake, and DNS or certificate failures do not produce distinct Facebook error codes.

It is also unclear whether localhost loopback HTTP redirect URIs remain exempt in both Development and Live modes, since that behavior may vary by SDK version.

Does Facebook Login reject an unregistered redirect URI before completing TLS certificate validation? Can a DNS failure or invalid certificate on the redirect destination produce the same error as a redirect-uri-mismatch? Is the localhost HTTP exception guaranteed across Development and Live app modes?

Tasadduq Burney · Answer

Direct answer
No, Facebook Login validates the redirect URI after the TLS handshake is completed; the SDK checks the URI once the HTTPS response is received.

Confirmed facts

TLS handshake must succeed before any redirect validation occurs.
An unregistered redirect URI triggers a generic “redirect_uri_mismatch” error, not a TLS‑related error.
DNS failures or invalid certificates cause network‑level errors; Facebook does not expose distinct codes.
In Development mode the SDK permits http://localhost without TLS, but Live mode requires https://… for all URIs.

Likely explanation
Because the OAuth flow is performed over HTTPS, the SDK only inspects the returned redirect URI after the TLS connection is established. Therefore, any TLS‑level problem (certificate validation, DNS resolution) prevents the request from reaching Facebook and results in a generic network error, while URI mismatches are detected after the secure channel is up.

Steps to verify in your case

Enable SDK debug logging (e.g., set the logging level to “verbose” or “debug” in the SDK configuration).
Run a request that uses an unregistered redirect URI and observe the error message.
Run a request that uses a registered URI with an invalid TLS certificate (or a self‑signed cert) and verify that the error is a network‑level failure rather than “redirect_uri_mismatch”.
If possible, capture a packet trace (e.g., Wireshark) to confirm that TLS handshake completes before any redirect‑validation log entries appear.

Missing diagnostic detail
Which SDK version are you using? Different versions may change the order of validation.

Does Facebook Login validate redirect URIs before TLS certificate verification?

1 answer

Direct answer

Confirmed facts

Likely explanation

Steps to verify in your case

Missing diagnostic detail

Your perspective belongs here.

0 question comments