Really enjoyed this. In general, horrible idea to accept anything other than a fixed list of redirect_uris in production.

OAuth 2.1 actually codifies that as a best practice: https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-07.htm...