Problem with wildcard subdomains

[wieswerner]

We are creating a portal that will have a subdomain per client eg https://client1.myproductname.com.

In my Auth0 Single Page Application Client I have configured Allowed Callback URLs, Allowed Web Origins, and Allowed Logout URLs to include → https://*.myproductname.com (as is indicated in the text under the textbox)

When I browse to the URL ‘https://client1.myproductname.com’ I can sign in using my user account, but when I get redirected back to my site I just get a blank screen. When I use F12 to inspect network, the authorize API call fails with the error message: invalid_request: The specified redirect_uri ‘https://client1.myproductname.com’ does not have a registered origin.

Has anyone else encountered this problem or know how to fix it?

[mathiasconradt]

As I see it, wildcards are only allowed for Allowed Logout Urls and Allowed Web Origin, but not for subdomains in Allowed Callback URLs. The wildcard hint also isn’t below the Allowed Callback URLs input field.

Also see

How come "Allowed Web Origins" does not allow wildcards?

Hi everyone. I just wanted to clarify the reasoning behind the decision of not supporting wildcards: as Matias says we are following recommendations on IETF’s OAuth 2.0 Threat Model and Security Considerations. There are many examples of security exploits that took advantage of wildcards usage in domain listing. We understand the added friction that this causes but decided to opt for the more secure option of being explicit on the domains allowed. As some pointed out, older fields still suppor…

and related thread

Allowed Callback URLs field limitations?

There is no hard limit on that field it’s a recommendation. There’s just no guarantee that it will be unrestricted forever. Enterprise doesn’t help here.