Facebook login without Valid OAuth redirect URIs -

this not wildcard domains. it's need add different domains valid oauth redirect uris on facebook login.

we have web app our clientes can setup own custom domain (example.com, xyz.net, etc). don't know domains used.

on facebook have single app takes care of facebook login. seems need whitelist every domain uses fb login.

adding domains manually not option. options have?

thanks.

the simplest solution can think of use intermediate identity service lax redirect uri validation. there good discussion of approach , of security concerns in relation identityserver4.

i have used custom redirect uri validation identity service before restrictive cases 1 of exploited vulnerabilities in oauth flow. flexibility need weaken security considerably.

to implement in identityserver4 set facebook authentication on identity server , register identity server's address facebook. create clients represent new domains. single client (making things more insecure still) or add way clients register identity server (for instance dynamic client registration).

when client wants connect facebook use open id connect connect identity server communicate facebook. in identityserver4 client add middleware useopenidconnectauthentication (see here example).

long story should can resolve issue using intermediate identity service. identity service url needs registered facebook , clients register identity service have control over.

with great power comes great responsibility though. taking path of least effort lead solution lowers security considerably. enforcing secure dynamic registration identity service such dynamic client registration protocol allow use single strict redirect uri per client , make system secure can reasonably it.