Wildcard Url's not matching in callback

[reissjarvis]

we are currently using a local server setup which is failing to login because it isn’t matching the wildcard callback url’s

• we use http://app.server
• we have http://.server and http://.server.local in the callback urls
• we receive http://app.server is not in the list of allowed callbacks
• we add http://app.server to callback url’s and it works

is this an issue with the string being sent to auth0 or is it an error message that could be masking another issue?

[jmangelo]

The note available below the Allowed Callback URLs field in the client application configuration mentions that:

You can use the star symbol as a wildcard for subdomains (‘*.google.com’).

This seems to indicate that an URL such as http://*.server.local would be a supported case for the use of the wildcard which would then allow to use either http://a.server.local or http://b.server.local. However, http://*.server does not seem a valid usage of the wildcard so it would not whitelist everything under .server.

[fraserlowndes]

To clarify the usage of this, our internal network has a top level domain of company.local so a full URL would be http://app.server.company.local. To save everyone the bother of typing company.local after every internal URL, our DNS redirects requests to server to server.company.local.

So when somebody accesses http://app.server, we want a callback URL of http://app.server/callback, but with wildcards only supporting subdomains, we are unable to add http://*.server/callback to the list of allowed callback URLs.