diff --git a/api/components/OAuth2/Grants/AuthCodeGrant.php b/api/components/OAuth2/Grants/AuthCodeGrant.php
index 52fd1a4..5683def 100644
--- a/api/components/OAuth2/Grants/AuthCodeGrant.php
+++ b/api/components/OAuth2/Grants/AuthCodeGrant.php
@@ -9,7 +9,11 @@ use api\components\OAuth2\Repositories\PublicScopeRepository;
 use DateInterval;
 use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
 use League\OAuth2\Server\Entities\ClientEntityInterface;
+use League\OAuth2\Server\Exception\OAuthServerException;
 use League\OAuth2\Server\Grant\AuthCodeGrant as BaseAuthCodeGrant;
+use League\OAuth2\Server\RequestEvent;
+use Psr\Http\Message\ServerRequestInterface;
+use yii\helpers\StringHelper;
 
 class AuthCodeGrant extends BaseAuthCodeGrant {
     use CryptTrait;
@@ -40,4 +44,20 @@ class AuthCodeGrant extends BaseAuthCodeGrant {
         return parent::issueAccessToken($accessTokenTTL, $client, $userIdentifier, $scopes);
     }
 
+    protected function validateRedirectUri(
+        string $redirectUri,
+        ClientEntityInterface $client,
+        ServerRequestInterface $request
+    ): void {
+        $allowedRedirectUris = (array)$client->getRedirectUri();
+        foreach ($allowedRedirectUris as $allowedRedirectUri) {
+            if (StringHelper::startsWith($redirectUri, $allowedRedirectUri)) {
+                return;
+            }
+        }
+
+        $this->getEmitter()->emit(new RequestEvent(RequestEvent::CLIENT_AUTHENTICATION_FAILED, $request));
+        throw OAuthServerException::invalidClient($request);
+    }
+
 }