set redirect URI matching to strict by default

Author: jricher

CHANGELOG.md

@@ -1,5 +1,7 @@
 Unreleased:
 - Added changelog
+- Set default redirect URI resolver strict matching to true
+- Fixed XSS vulnerability on redirect URI display on approval page
 
 *1.3.1*:
 - Added End Session endpoint

openid-connect-server/src/main/java/org/mitre/oauth2/service/impl/BlacklistAwareRedirectResolver.java

@@ -47,7 +47,7 @@ public class BlacklistAwareRedirectResolver extends DefaultRedirectResolver {
 @Autowired
 private ConfigurationPropertiesBean config;
 
-private boolean strictMatch = false;
+private boolean strictMatch = true;
 
 /* (non-Javadoc)
  * @see org.springframework.security.oauth2.provider.endpoint.RedirectResolver#resolveRedirect(java.lang.String, org.springframework.security.oauth2.provider.ClientDetails)