fix(oauth-provider): allow localhost subdomains in isLocalhost function (#8286)

sicarius97 · himself65 · himself65 · commit 4b9741289bf1 · 2026-03-03T18:28:54.000+09:00
Co-authored-by: Alex Yang &lt;himself65@outlook.com&gt;
diff --git a/packages/oauth-provider/src/types/zod.ts b/packages/oauth-provider/src/types/zod.ts
@@ -4,7 +4,10 @@ const DANGEROUS_SCHEMES = ["javascript:", "data:", "vbscript:"];
 
 function isLocalhost(hostname: string): boolean {
 	return (
-		hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]"
+		hostname === "localhost" ||
+		hostname === "127.0.0.1" ||
+		hostname === "[::1]" ||
+		hostname.endsWith(".localhost")
 	);
 }
 
