MAS forbids them.
2025-05-07T17:16:17.356010Z INFO http.server.request{otel.kind="server" otel.name="POST /oauth2/registration" network.protocol.name="http" network.protocol.version="1.1" http.request.method="POST" url.path="/oauth2/registration" url.scheme="http" http.route="/oauth2/registration" user_agent.original="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.7103.25 Safari/537.36"}:handlers.oauth2.registration.post: mas_handlers::oauth2::registration: crates/handlers/src/oauth2/registration.rs:204: Client registration body=ClientMetadata { redirect_uris: Some([Url { scheme: "http", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("localhost")), port: Some(8080), path: "/", query: Some("no_universal_links=true"), fragment: None }]), response_types: Some([ResponseType({Code})]), grant_types: Some([AuthorizationCode, RefreshToken]), application_type: Some(Web), contacts: None, client_name: Some(Localized { non_localized: "Element", localized: {} }), logo_uri: Some(Localized { non_localized: Url { scheme: "http", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("localhost")), port: Some(8080), path: "/vector-icons/1024.png", query: None, fragment: None }, localized: {} }), client_uri: Some(Localized { non_localized: Url { scheme: "http", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("localhost")), port: Some(8080), path: "/", query: None, fragment: None }, localized: {} }), policy_uri: None, tos_uri: None, jwks_uri: None, jwks: None, software_id: None, software_version: None, sector_identifier_uri: None, subject_type: None, token_endpoint_auth_method: Some(None), token_endpoint_auth_signing_alg: None, id_token_signed_response_alg: Some(Rs256), id_token_encrypted_response_alg: None, id_token_encrypted_response_enc: None, userinfo_signed_response_alg: None, userinfo_encrypted_response_alg: None, userinfo_encrypted_response_enc: None, request_object_signing_alg: None, request_object_encryption_alg: None, request_object_encryption_enc: None, default_max_age: None, require_auth_time: None, default_acr_values: None, initiate_login_uri: None, request_uris: None, require_signed_request_object: None, require_pushed_authorization_requests: None, introspection_signed_response_alg: None, introspection_encrypted_response_alg: None, introspection_encrypted_response_enc: None, post_logout_redirect_uris: None }
2025-05-07T17:16:17.356840Z ERROR http.server.request{otel.kind="server" otel.name="POST /oauth2/registration" network.protocol.name="http" network.protocol.version="1.1" http.request.method="POST" url.path="/oauth2/registration" url.scheme="http" http.route="/oauth2/registration" user_agent.original="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.7103.25 Safari/537.36"}:handlers.oauth2.registration.post: mas_handlers::oauth2::registration: crates/handlers/src/oauth2/registration.rs:192: error=denied by the policy: [Violation { msg: "invalid redirect_uri", redirect_uri: Some("http://localhost:8080/?no_universal_links=true"), field: None, code: None }]
2025-05-07T17:17:10.334830Z INFO worker.run_loop:worker.tick{worker.id=01JTNVYSS2CR0M8G4Y4C04A0MQ}: mas_tasks::new_queue: crates/tasks/src/new_queue.rs:503: Sending heartbeat
Describe the bug
MSC2966 explicitly says that query params in redirect_uri are valid
MAS forbids them.
To Reproduce
Steps to reproduce the behavior:
/?no_universal_links=trueExpected behavior
Get a success response
Screenshots
If applicable, add screenshots to help explain your problem.
Additional context
element-hq/element-web#29439
https://e2e-29439--matrix-react-sdk.netlify.app/trace/index.html?trace=https://e2e-29439--matrix-react-sdk.netlify.app/data/7d5f947613357f96aa12bfe0416693996f269db1.zip