v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.oauth.wildcard-redirect

OAuth redirect_uri allow-list contains a wildcard, an http:// URL, or localhost.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Wildcards (and HTTP) let an attacker register their own callback URL and harvest authorization codes; localhost whitelisting is acceptable for dev tooling but disastrous in production.

Pin redirect URIs to exact, HTTPS URLs of subdomains you control. RFC 6749 §10.6 explicitly requires "exact match" or restricted matching.

VULNERABLE
vulnerable.ts
// ruleid: auth.oauth.wildcard-redirect
export const oauthConfigBad = {
  client_id: 'abc',
  redirect_uris: ['https://*.example.com/callback'],
};

// ruleid: auth.oauth.wildcard-redirect
export const oauthConfigBad2 = {
  client_id: 'abc',
  redirect_uris: ['http://app.example.com/callback'],
};

// ruleid: auth.oauth.wildcard-redirect
export const oauthConfigBad3 = {
  client_id: 'abc',
  redirect_uri: 'https://app.example.com/*',
};

// ruleid: auth.oauth.wildcard-redirect -- scalar http:// redirect_uri
export const oauthConfigBad4 = {
  client_id: 'abc',
  redirect_uri: 'http://app.example.com/callback',
};
SAFE
safe.ts
// ok: auth.oauth.wildcard-redirect
export const oauthConfigGood = {
  client_id: 'abc',
  redirect_uris: ['https://app.example.com/callback'],
};

// ok: auth.oauth.wildcard-redirect
export const oauthConfigGoodDev = {
  client_id: 'dev',
  redirect_uris: ['http://localhost:3000/callback'],
};

// ok: auth.oauth.wildcard-redirect -- loopback IP dev URL (RFC 8252)
export const oauthConfigGoodLoopback = {
  client_id: 'dev',
  redirect_uri: 'http://127.0.0.1:8080/callback',
};

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.oauth.wildcard-redirect -- <reason>

References

https://datatracker.ietf.org/doc/html/rfc6749#section-10.6 ↗https://datatracker.ietf.org/doc/html/rfc8252#section-7.3 ↗