From db974d72d5b38d8223f65db932acc4a2abcdc2c8 Mon Sep 17 00:00:00 2001
From: Girish Ramakrishnan <girish@cloudron.io>
Date: Mon, 16 Mar 2026 07:21:55 +0530
Subject: [PATCH] oidcserver: permit origin "*" from localhost testing

---
 src/oidcserver.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/oidcserver.js b/src/oidcserver.js
index b6f249a7a..0c8f64955 100644
--- a/src/oidcserver.js
+++ b/src/oidcserver.js
@@ -724,7 +724,7 @@ async function start() {
         },
         clientBasedCORS(ctx, origin, client) {
             // allow CORS for clients where at least the origin matches where we redirect back to
-            if (client.redirectUris.find((u) => u.indexOf(origin) === 0)) return true;
+            if (client.redirectUris.find((u) => origin === '*' || u.indexOf(origin) === 0)) return true;
 
             return false;
         },