Presumably you're talking about OIDC since that's an OAuth parameter, but in either case, the validation of response locations is just an intrinstic requirement of both SAML and OIDC and is the point of registering metadata for SPs. -- Scott