Problem with wildcard subdomains

[mathiasconradt]

As I see it, wildcards are only allowed for Allowed Logout Urls and Allowed Web Origin, but not for subdomains in Allowed Callback URLs. The wildcard hint also isn’t below the Allowed Callback URLs input field.

Also see

How come "Allowed Web Origins" does not allow wildcards?

Hi everyone. I just wanted to clarify the reasoning behind the decision of not supporting wildcards: as Matias says we are following recommendations on IETF’s OAuth 2.0 Threat Model and Security Considerations. There are many examples of security exploits that took advantage of wildcards usage in domain listing. We understand the added friction that this causes but decided to opt for the more secure option of being explicit on the domains allowed. As some pointed out, older fields still suppor…

and related thread

Allowed Callback URLs field limitations?

There is no hard limit on that field it’s a recommendation. There’s just no guarantee that it will be unrestricted forever. Enterprise doesn’t help here.