Hello I’m currently integrating Kratos (and the ory network) as an Oauth provider into our webapp (using authorisation_code grant and PKCE). For local development I’d like to support being able to have an allowed redirect back to localhost (via http - I know definitely not secure and shouldn’t be used for actual user data) This seems to be supported fine when creating the Oauth client via the CLI

❯ ory create oauth2-client --name "Demo Client" --redirect-uri <http://localhost:3000/oauth> --token-endpoint-auth-method none --scope offline_access,openid,email --grant-type authorization_code,refresh_token --project $project_id
CLIENT ID	d2e25521-50a8-44c7-b690-46560179c152
CLIENT SECRET
GRANT TYPES	authorization_code, refresh_token
RESPONSE TYPES	code
SCOPE		offline_access openid email
AUDIENCE
REDIRECT URIS	<http://localhost:3000/oauth>

However when trying to edit this client using the web UI I’m then blocked from making any updates to other settings, as it looks like the frontend is doing some validation and doesn’t like the redirect_uri that’s already configured. It would be good to have consistent validation and behaviour from the backend and frontend here.

Had the same issue. Using

<http://127.0.0.1>

instead of

<http://localhost>

seems to work.

Yea that is the workaround that I'm using as well, it would be a good inconsistency to resolve though. Do you know the best channel for reporting this?

You could tag someone from the Ory team to bring this to their attention.