Allow Wildcard Callback URIs in Customer Account API

[dparrelli]

Hey 👋

We're using both Hydrogen/Oxygen and Cloudflare Workers for a couple of our Hydrogen stores. The issue we have currently is related to preview deployments. For each preview deployment, we need to manually add the preview URL to the Customer Account API Callback URI section in Hydrogen/Headless to whitelist them.

Is it possible to use wildcard URLs instead, so it whitelists all preview deployment URLs? (e.g. https://preview-1.example.com is whitelisted with https://*.example.com). If not, are there any other suggestions on how to automate this?

This limitation is starting to be a little cumbersome since we need to a) manually add each preview deployment URL and b) it's adding a lot of data to the hydrogen session and causing it to exceed the browser's maximum cookie length.

[wizardlyhel]

Thanks for the feedback

Please update to the latest Hydrogen. We had a bug fix in version 2024.7.8 so that customer account query won't return an access token that grows as more preview urls you add.

With regards to wild card callback URI, we cannot allow this for security reasons. However, we are looking into automatically accepting any preview oxygen urls. We don't have an ETA for this feature.