Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

oidc

Describe the bug

When adding a secure-client-uris policy check, this does not allow a Web Origins setting of + even though those URLs are secure.

Version

main

Regression

• The issue is a regression

Expected behavior

A + should be accepted if the rootUrl and redirectUris are secure.

Actual behavior

A + leads to a validation error in the frontend:

Invalid webOrigins

How to Reproduce?

• Create a client policy that contains secure-client-uris
• Enter + in the WebOrigins

Anything else?

The problematic code is somewhere about here:

The WebOrigins are usually resolved as shown here: