Social auth callback URLs are whitelisted

Wildcard redirect URIs registered with OAuth providers allow an attacker to redirect an authorization code to any subdomain they control — including user-generated content subdomains, preview deployments, or abandoned subdomains. CWE-601 (Open Redirect) is the direct failure; CAPEC-194 documents subdomain takeover-based OAuth redirect attacks. OWASP A01 (Broken Access Control) covers the authorization code interception that results. An authorization code delivered to the wrong endpoint is equivalent to handing the attacker a short-lived session credential.

Register exact redirect URIs in your OAuth provider's developer console — no wildcards, no trailing slash ambiguity:

# OAuth provider dashboard — Allowed redirect URIs
https://app.yourdomain.com/api/auth/callback/google
https://staging.yourdomain.com/api/auth/callback/google

If your application constructs the redirect URI dynamically, validate it against an explicit server-side allowlist before passing it to the provider:

const ALLOWED_REDIRECTS = [
  'https://app.yourdomain.com/api/auth/callback/google',
  'https://staging.yourdomain.com/api/auth/callback/google'
]
if (!ALLOWED_REDIRECTS.includes(redirectUri)) {
  return Response.json({ error: 'Invalid redirect URI' }, { status: 400 })
}

Never accept redirect_uri from user-supplied query parameters without explicit allowlist validation.