diff --git a/policies/client_registration/client_registration.rego b/policies/client_registration/client_registration.rego index 2d3515c41..e3299ed36 100644 --- a/policies/client_registration/client_registration.rego +++ b/policies/client_registration/client_registration.rego @@ -31,9 +31,6 @@ secure_url(x) if { url.host != "127.0.0.1" url.host != "0.0.0.0" url.host != "[::1]" - - # Must be standard port for HTTPS - url.port == "" } host_matches_client_uri(_) if { diff --git a/policies/client_registration/client_registration_test.rego b/policies/client_registration/client_registration_test.rego index 5c500cf8a..f4fdbce93 100644 --- a/policies/client_registration/client_registration_test.rego +++ b/policies/client_registration/client_registration_test.rego @@ -189,6 +189,12 @@ test_redirect_uris if { "redirect_uris": [], } + # HTTPS redirect_uri with non-standard port + client_registration.allow with input.client_metadata as { + "client_uri": "https://example.com/", + "redirect_uris": ["https://example.com:8443/callback"], + } + # Not required for the client_credentials grant client_registration.allow with input.client_metadata as { "grant_types": ["client_credentials"],