DefaultClientConfigurationValidator CORS validation failure with explicit use of port 80 and 443

[scottbrady91]

Issue

The string comparison approach for path detection in the ValidateAllowedCorsOriginsAsync method on DefaultClientConfigurationValidator does not account for origins explicitly stating port 80 (with http) and 443 (when using https). This is because the Uri parser normalises the URL.

https://github.com/IdentityServer/IdentityServer4/blob/master/src/IdentityServer4/src/Validation/Default/DefaultClientConfigurationValidator.cs#L151

Normalization is good but is there a reason for paths being detected by string length comparison? Can I PR a different approach?

Relevant parts of the log file

AllowedCorsOrigins contains invalid origin: https://ids:443

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.