v4: Allow wildcards in returnTo Allowed Logout URLs again

[larsEichler]

Checklist

• The issue can be reproduced in the nextjs-auth0 sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

In v4 the returnTo param seems to be way more strict than it was in v3. In v3 you were able to configure wildcards http://localhost:3000/*/about, with v4 it seems you need to explicitly set URLs in full.

This is creating an issue for us, as our app has multiple languages, multiple environments (development, staging, production) AND we pass messages with the query parameters of the returnTo-URL.

Is it possible to allow wildcards in the Allowed Logout URLs again with v4? Also, you were not required to pass the full URL with host and protocol before, like href="/auth/logout?returnTo=/en/about?message=forced_logout". Now the full URL is required and has to be exactly like in the Allowed Logout URLs setting. Can't we go back to the old implementation?

Reproduction

It CAN NOT be reproduced with the example app, as the example app is not yet updated to v4. Here is an example-repo: https://github.com/larsEichler/nextjs-auth0-returnto-issue

1. Clone and set up repo
2. In auth0 set up a Regular Web App with NextJS as framework
3. Set Allowed Callback URLs: http://localhost:3000/auth/callback
4. Set Allowed Logout URLs: http://localhost:3000/*/about
5. Run the application
6. Register a new user/Login with the one you already created
7. Click on Logout

Additional context

No response

nextjs-auth0 version

v4.0.0

Next.js version

v15.1.6, v14.2.23

Node.js version

v22.12.0

[DawnMD]

Facing the same issue, as our website is like an e-commerce where user can apply coupon code. While auth is not an absolute mandatory and also coupon code can change drastically, so putting up the exact url with query params will be very much irrelevant.

Other way is to always reset the url and send them back to home page but that will be bad for ux as all the query params will be lost and user have to start again.

This seems not to be an issue with v3