feature request: Support wildcards in redirect URIs

What problem did you meet?

I am developing my application using gitpod.io and the application’s url changes with every new workspace. Hence I do not know the exact redirect URI. I do not want to change it every time.

I’ve already tried using wildcards like https://*.gitpod.io, though I always got redirect_uri did not match any of the client's registered redirect_uris error message

Describe what you’d like Logto to have

It would be great if logto supported wildcards in redirect URIs. Like: https://*.gitpod.io

[simeng-li]

Hi, Monika thanks for using Logto.

First of all, redirect URIs are used not only just for post-sign-in or post-sign-out redirection purposes but also play an important security role in OAuth2.0 to prevent phishing attacks. Wildcard redirect URIs are a violation of the OAuth2 spec. .

The redirection endpoint URI MUST be an absolute URI

Back to your cases, there are a couple of things that cross my mind:

1. Our admin console does allow you to provide multiple redirect URIs for your application. Whenever your workspace address changes you just need to add a new one or replace the old one using the Admin Console.
2. As for the SDK, maybe you could set a global env variable that will pick up the workspace host address URL dynamically. Then pass it to the Logto SDK configs.

[github-actions[bot]]

This issue is stale because it has been open for 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.