# Feature OP-7440 - http redirect_uri from localhost domain

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-7440

## Planning

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Target versions | 11.0.0 |
| Sprint | 11.0.0 |
| Backlog bucket |  |
| Votes |  |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

_No work packages_

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module |  |
| Feature Flag |  |
| Requires doc change | No |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Accessibility | No |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| PD (min) |  |
| PD (max) |  |
| Work |  |
| Labor costs |  |

## Description

Good day!

Please consider changing the `redirect_uri` from https to http for the localhost domain.

Context:

Our company Open.ru bank is developing a client application for OpenProject. We are developing a module for OAUTH2.0 authorization now.

And we have got issue that it is impossible to specify a redirect url [`http://localhost:8080`](http://localhost:8080/). There is an error 

`Error 1 error prohibited this OAuth application from being saved`

`There were problems with the following fields: Redirect URI must be an HTTPS / SSL URI.`

We understand that the transmission of sensitive data without an SSL is a security breach. However, you may do an exception for localhost.

Working over an insecure protocol with a localhost is a common practice in the web industry. For example, this is how Service Worker API work, popular OpenID/OAUTH provider Keylock and many social networks such as VKontakte and Facebook.

If you find it possible to make an exclusion for the localhost, please let us know when you be able to do this. We will be very appreciate this. This will make our development easier because we do not use SSL keys during development.

  

Thanks!