This Terraform resource registers an OAuth redirect/callback URL that is either plaintext http:// (not on localhost) or uses a wildcard host.

Why this matters

A non-TLS callback exposes the authorization code or token to network interception, and a wildcard-host redirect lets an attacker who controls any matching subdomain steal the code (open redirect, CWE-601). Register exact https:// callback URLs with fixed hosts. Keep http:// only for localhost/127.0.0.1 during local development, and never register a redirect target with a * in the host.

# ruleid: auth.iac.tf-oauth-insecure-callback
resource "auth0_client" "http_cb" {
  name      = "plaintext callback"
  callbacks = ["https://app.example.com/cb", "http://app.example.com/cb"]
}

# ruleid: auth.iac.tf-oauth-insecure-callback
resource "auth0_client" "wildcard_cb" {
  name          = "wildcard callback"
  callback_urls = ["https://*.example.com/cb"]
}

resource "auth0_client" "ok" {
  name          = "https callbacks only"
  callbacks     = ["https://app.example.com/callback", "http://localhost:3000"]
  callback_urls = ["https://app.example.com/cb"]
  redirect_uris = ["https://app.example.com/oauth/callback"]
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.iac.tf-oauth-insecure-callback -- <reason>

References