Wildcard domains does not seem to work. Is specifying the port messing it up?

Get Help
,
1

I’m trying to avoid maintaining per-brand callback URLs in Auth0 for a whitelabel app.

We use domains like {brand}.example.com, {brand}.stage.example.com, and locally {brand}.localhost:3000.

Auth0’s docs say wildcard subdomains are allowed in Allowed Callback URLs, for example https://*.example.com, as long as the wildcard is in the leftmost subdomain. Based on that, http://*.localhost:3000/auth/callback appears like it should allow http://mybrand.localhost:3000/auth/callback.

But in practice Auth0 is rejecting that callback, even though the docs seem to allow it.

Is .localhost or .localhost:3000 treated differently from normal domains for wildcard callback matching, or is there another limitation here that isn’t obvious from the docs?

2

I might add, the wildcard works fine for non-loopback domains. Doing https://*.stage.example.com/auth/callback works fine for different subdomains.