public oauth client should always support localhost callback

server/oauth2.go

@@ -620,6 +620,11 @@ func validateRedirectURI(client storage.Client, redirectURI string) bool {
 			return true
 		}
 	}
+
+	if client.Public && isRedirectURILocalhost(redirectURI) {
+		return true
+	}
+
 	// For non-public clients or when RedirectURIs is set, we allow only explicitly named RedirectURIs.
 	// Otherwise, we check below for special URIs used for desktop or mobile apps.
 	if !client.Public || len(client.RedirectURIs) > 0 {
@@ -630,8 +635,12 @@ func validateRedirectURI(client storage.Client, redirectURI string) bool {
 		return true
 	}
 
-	// verify that the host is of form "http://localhost:(port)(path)", "http://localhost(path)" or numeric form like
-	// "http://127.0.0.1:(port)(path)"
+	return isRedirectURILocalhost(redirectURI)
+}
+
+// verify that the host is of form "http://localhost:(port)(path)", "http://localhost(path)" or numeric form like
+// "http://127.0.0.1:(port)(path)"
+func isRedirectURILocalhost(redirectURI string) bool {
 	u, err := url.Parse(redirectURI)
 	if err != nil {
 		return false

server/oauth2_test.go

@@ -413,6 +413,13 @@ func TestValidRedirectURI(t *testing.T) {
 			redirectURI: "http://foo.com/bar/baz",
 			wantValid:   false,
 		},
+		{
+			client: storage.Client{
+				RedirectURIs: []string{"http://foo.com/bar"},
+			},
+			redirectURI: "http://localhost:991/bar",
+			wantValid:   false,
+		},
 		// These special desktop + device + localhost URIs are allowed by default.
 		{
 			client: storage.Client{
@@ -510,23 +517,23 @@ func TestValidRedirectURI(t *testing.T) {
 				RedirectURIs: []string{"http://foo.com/bar"},
 			},
 			redirectURI: "http://localhost:8080/",
-			wantValid:   false,
+			wantValid:   true,
 		},
 		{
 			client: storage.Client{
 				Public:       true,
 				RedirectURIs: []string{"http://foo.com/bar"},
 			},
 			redirectURI: "http://localhost:991/bar",
-			wantValid:   false,
+			wantValid:   true,
 		},
 		{
 			client: storage.Client{
 				Public:       true,
 				RedirectURIs: []string{"http://foo.com/bar"},
 			},
 			redirectURI: "http://localhost",
-			wantValid:   false,
+			wantValid:   true,
 		},
 		// These special desktop + device + localhost URIs can still be specified explicitly.
 		{