Auth0 Support Center - Why Does Auth0 Not Allow Wildcards in an Application's Allowed Callback URL List

Why Does Auth0 Not Allow Wildcards in an Application's Allowed Callback URL List

Sep 10, 2025

Overview

When configuring an application in the Auth0 dashboard, it is not possible to add a wildcard at the end of an Allowed Callback URL. For example:

https://www.example.com/*

This article clarifies what is the reasoning, from a security perspective, behind Auth0's decision to not allow this type of URL for redirects.

Applies To

Application Configuration
redirect_uri
Callback URLs

Solution

This restriction comes down to protecting against any sort of open redirect vulnerability and ensuring authentication responses (containing tokens) are returned to trusted locations. The official OWASP site goes into more detail pertaining to specific types of attack vectors that could exploit wildcard redirects, so please see Unvalidated Redirects and Forwards Cheat Sheet.