Support dynamic port matching for localhost redirect URIs (RFC 8252 §7.3 extension)

[roncodingenthusiast]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe your problem

Fosite's dynamic port matching for loopback redirect URIs (per RFC 8252 §7.3) works for 127.0.0.1 and [::1] but not localhost. A client that registers http://localhost/callback cannot use http://localhost:54321/callback at authorization time.

The root cause is isLoopbackAddress, which uses net.ParseIP(hostname).IsLoopback(). Since net.ParseIP("localhost") returns nil, localhost is never recognized as loopback for port matching.

Fosite does handle localhost elsewhere: IsLocalhost explicitly checks hn == "localhost" to allow plain HTTP redirects. But that function is only used for transport security checks, not port matching.

Function	Purpose	Handles localhost?
IsLocalhost	Transport security (allow HTTP?)	Yes
isLoopbackAddress	Dynamic port matching	No

RFC 8252 §7.3 strictly specifies IP literals for loopback URIs, and §8.3 says localhost is NOT RECOMMENDED. However, since Fosite already accepts localhost for security purposes, and real-world clients (e.g. MCP/OAuth flows) register http://localhost/callback by convention, extending port matching to cover localhost would make the two code paths consistent.

Describe your ideal solution

Add localhost handling to isLoopbackAddress:

func isLoopbackAddress(hostname string) bool {
    if hostname == "localhost" {
        return true
    }
    return net.ParseIP(hostname).IsLoopback()
}

The existing hostname equality check in isMatchingAsLoopback (registered.Hostname() == requested.Hostname()) already prevents cross-matching between localhost and IP literals.

Workarounds or alternatives

1. Register IP literals instead of localhost: Use http://127.0.0.1/callback as the RFC recommends. Requires updating existing clients that use localhost by convention.
2. Patch downstream: Override redirect URI matching in each Fosite consumer.
3. Register the exact port: Use http://localhost:54321/callback. Defeats dynamic port allocation.

Version

v0.49.0

Additional Context

• RFC 8252 §7.3: Loopback Interface Redirection (IP literals only)
• RFC 8252 §8.3: localhost NOT RECOMMENDED
• PR #400: Original loopback support
• CVE-2020-15233: Related redirect URI security advisory
• isLoopbackAddress: Root cause
• IsLocalhost: Existing localhost handling
• isMatchingAsLoopback: Port-flexible matching logic