Always requiring `redirect_uri` is not compliant to RFC 6749

[westnordost]

Always requiring `redirect_uri` is not compliant to RFC 6749

[westnordost]

Note that in the draft OAuth 2.1 specification, redirect_uri has been removed from the access token request, or, for backward compatibility, made optional. The reason is

In OAuth 2.1, authorization code injection is prevented by the code_challenge and code_verifier parameters, making the inclusion of the redirect_uri parameter serve no purpose in the token request. As such, it has been removed.

(see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-09#section-10.2-2)

[nbulaj]

4.1.1. Authorization Request lists redirect_uri as OPTIONAL

4.1.3. Access Token Request lists redirect_uri only as REQUIRED if it was supplied in the authorization request

3.1.2.3. Dynamic Configuration clarifies that redirect_uri is REQUIRED only in case no redirection URI has been specified during client registration:

What I was thinking about is:

Access Token Request always have to check redirect_uri because grant always have a redirect_uri from authorization request (which in turn allow it to be blank, but in such case grant copies redirect URI from the client - it's from 3.1.2.3 - "i_f no redirection URI has been registered, the client MUST include a redirection URI"_). So at the end redirect uri is always present for Access token request 🤔