title: Deep links with OAuth2 lost because of redirects
body: <p>We have an application that sends emails which contain deep links, and it uses OAuth2. Deep linking works fine when the user is already 'logged in' (has a valid access token), but breaks when the token is out of date/there is none etc. The reason is because the application receives the request with the specific deep URL, issues a request to the auth server with a redirect URL to itself (and it is the main page, not the deep link in the original request, i.e. the redirect URL we once configured for the application), and when the log in goes well, the auth server performs the redirect and the application shows the main page, and the original deep link request is forgotten. It might be important to mention that all this happens in a single browser window/tab (requirement not to open other tabs nor to use popups).</p>
  
  <p>I had an idea to use (abuse?) the 'state' request param that the auth server is required to use verbatim in the redirect, and it would contain information (like a link within the application) allowing the application to show the desired page. I am not sure whether the 'state' param is supposed to be used like this, it seems to be designed for CSRF prevention, not custom logic like this one.</p>
  
  <p>Another option which does work is based on the fact that the server doesn't match the full redirect URL against the configured one, just checks if it is prefixed with the configured one (as the OAuth2 spec doesn't mandate this, it says full matching SHOULD be done). So, as our redirect URL is the deep link, and the configured URL is its prefix, it does work. However, this behavior will break when the server decides to match full URLs (and it is written in Spring Security and it is pretty easy to change this behavior, just use a different matcher class, already provided with the lib: <a href="https://github.com/spring-projects/spring-security-oauth/blob/ec215f79f4f73f8bb5d4b8a3ff9abe15b3335866/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/endpoint/ExactMatchRedirectResolver.java" rel="nofollow noreferrer">https://github.com/spring-projects/spring-security-oauth/blob/ec215f79f4f73f8bb5d4b8a3ff9abe15b3335866/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/endpoint/ExactMatchRedirectResolver.java</a>). I would like to use something safer, the way that doesn't fight against OAuth2.</p>
  
  <p>Is there a better way to do this?</p>