Adding localhost to Hosted UI - callback URLs for testing. Security risks?

Question

Amazon Cognito requires HTTPS over HTTP except for http://localhost for testing purposes only.
In my development environment, which is also used for early user testing to get feedback, I am using http://localhost as well as the development domain. I am using google authentication through cognito.  My question is, is there are security risk in having localhost as a callback URL that could give an attacker some ability to pose any risk to my development environment? if so, what is the best way to address this?

Riku_Kobayashi · Answer

Hello.

Although it's not Cognito, there was something like the URL below that explains the security risks of using localhost as the callback URL.  
https://community.auth0.com/t/security-risks-of-using-localhost-for-callback-url/118781

Adding localhost to Hosted UI -> callback URLs for testing. Security risks?

Füge deine Antwort hinzu

Relevanter Inhalt