Twitch omniauth - Twitch has no control over the content or security of http://localhost:3000

I believe, this is because you are serving over http rather than https and on localhost.

It’s the only time I’ve seen it myself is when returning to a http endpoint or localhost.

I forget my repeat steps, but you should switch to https.

If you need some SSL termination to localhost easily try:

https://ngrok.com/