From e00cf60b7a2807ac992ae01fdc3ff5ab91fc2405 Mon Sep 17 00:00:00 2001 From: MAEDA Go Date: Wed, 21 Oct 2026 20:09:44 +0900 Subject: [PATCH] Remove leftover development hosts from the OAuth redirect URI HTTPS exemption --- config/initializers/30-redmine.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/initializers/30-redmine.rb b/config/initializers/30-redmine.rb index fba7d511b..3c467ccf8 100644 --- a/config/initializers/30-redmine.rb +++ b/config/initializers/30-redmine.rb @@ -58,7 +58,7 @@ Rails.application.config.to_prepare do allow_token_introspection false # allow http loopback redirect URIs but require https for all others - force_ssl_in_redirect_uri { |uri| !%w[localhost 127.0.0.1 web localohst:8080].include?(uri.host) } + force_ssl_in_redirect_uri { |uri| !%w[localhost 127.0.0.1 ::1].include?(uri.hostname) } # Specify what redirect URI's you want to block during Application creation. forbid_redirect_uri { |uri| %w[data vbscript javascript].include?(uri.scheme.to_s.downcase) } -- 2.55.0