Skip to main content
Drupal is a registered trademark of Dries Buytaert
Release: OpenID Connect / OAuth client 3.0.0-alpha9 New alpha version released for module openid_connect (3.0.0-alpha9). Usage Milestone: Google Analytics Module google_analytics crossed 1,000 active installs. Release: Timelinr 1.0.1 Minor update available for module timelinr (1.0.1). Release: GraphQL Compose Codegen 1.1.2 Minor update available for module graphql_compose_codegen (1.1.2). Release: Mapy.com 1.1.3 Minor update available for module mapycom (1.1.3). Release: Ckeditor5 entity browser 3.0.3 Minor update available for module ckeditor5_entity_browser (3.0.3). Release: Ckeditor5 entity browser 3.0.1 Minor update available for module ckeditor5_entity_browser (3.0.1). Release: Ckeditor5 entity browser 3.0.2 Minor update available for module ckeditor5_entity_browser (3.0.2). Release: Teamleader Integration 4.0.2 Minor update available for module teamleader (4.0.2). Module Revived: Entityqueue Buttons 1.1.2 Module entityqueue_buttons updated after 8 months of inactivity (1.1.2).

Simple OAuth Redirect URI Wildcard

4 sites Security covered Drupal 10–11
View on drupal.org

This module extends Simple OAuth to support subdomain wildcards in redirect URIs, which can be useful for platforms that generate dynamic subdomains. It allows for more flexible redirect configurations, but developers should be aware of the security implications and use it responsibly.

Extends the Simple OAuth module to allow for subdomain wildcards in redirect URIs.

WARNING: Use of this module violates Section 3.1.2 of RFC-6749 (OAuth 2.0 Specification) which requires the use of absolute redirect URIs!

However there are valid practical reasons to use a wildcard in a subdomain (e.g. Vercel and other hosting platforms are generating unique subdomains for each git commit).
Additionally big auth providers, such as Auth0 and Okta also provide this functionality.

Ultimately it comes down to your responsibility as the developer to carefully govern the use of wildcards in redirect URIs to not introduce security risks!

Depends on

Dependencies of the latest stable release

Required by

Tracked projects that depend on this one

No tracked projects depend on this one yet.

Activity

Tracked releases
2
Tracked since
Jan 2025
Latest release
1 year ago
Releases (12 mo)
0 ▼ from 2
Maintenance
Dormant

Releases

Version Type Core Release date
1.0.0 Stable 10–11 Jan 10, 2025
1.x-dev Dev 10–11 Jan 10, 2025