diff --git a/config/initializers/30-redmine.rb b/config/initializers/30-redmine.rb
index 3c467ccf8..31e2fed77 100644
--- a/config/initializers/30-redmine.rb
+++ b/config/initializers/30-redmine.rb
@@ -58,7 +58,10 @@ Rails.application.config.to_prepare do
     allow_token_introspection false
 
     # allow http loopback redirect URIs but require https for all others
-    force_ssl_in_redirect_uri { |uri| !%w[localhost 127.0.0.1 ::1].include?(uri.hostname) }
+    force_ssl_in_redirect_uri do |uri|
+      hostname = uri.hostname.to_s
+      !(%w[localhost 127.0.0.1 ::1].include?(hostname) || hostname.end_with?('.localhost'))
+    end
 
     # Specify what redirect URI's you want to block during Application creation.
     forbid_redirect_uri { |uri| %w[data vbscript javascript].include?(uri.scheme.to_s.downcase) }
diff --git a/test/unit/oauth_redirect_uri_test.rb b/test/unit/oauth_redirect_uri_test.rb
new file mode 100644
index 000000000..a42803748
--- /dev/null
+++ b/test/unit/oauth_redirect_uri_test.rb
@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+# Redmine - project management software
+# Copyright (C) 2006-  Jean-Philippe Lang
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+require_relative '../test_helper'
+
+class OauthRedirectUriTest < ActiveSupport::TestCase
+  def test_http_redirect_uri_should_be_allowed_for_loopback_hosts
+    %w[
+      http://localhost:3000/callback
+      http://127.0.0.1:3000/callback
+      http://[::1]:3000/callback
+      http://app.localhost:3000/callback
+    ].each do |uri|
+      assert_empty redirect_uri_errors(uri), uri
+    end
+  end
+
+  def test_http_redirect_uri_should_be_rejected_for_other_hosts
+    %w[
+      http://example.com/callback
+      http://localhost.example.com/callback
+      http://notlocalhost/callback
+    ].each do |uri|
+      assert_not_empty redirect_uri_errors(uri), uri
+    end
+  end
+
+  private
+
+  def redirect_uri_errors(redirect_uri)
+    application = Doorkeeper::Application.new(name: 'test', redirect_uri: redirect_uri)
+    application.valid?
+    application.errors[:redirect_uri]
+  end
+end