diff --git a/src/servers/_middlewares/origin-validation.ts b/src/servers/_middlewares/origin-validation.ts
index 65fcfcb7..9640ef6b 100644
--- a/src/servers/_middlewares/origin-validation.ts
+++ b/src/servers/_middlewares/origin-validation.ts
@@ -16,6 +16,11 @@ const PUBLIC_ORIGIN = (() => {
 
 const WEB_ORIGINS: string[] = PUBLIC_ORIGIN ? [PUBLIC_ORIGIN] : [];
 
+// Host authorities (`example.com`, or `example.com:8080` off the default port) for the same origins.
+// Officer always sits behind an HTTPS reverse proxy, so the proxy's `Host` header is expected to
+// match PUBLIC_URL's authority exactly.
+const WEB_HOSTS: string[] = WEB_ORIGINS.map((o) => new URL(o).host);
+
 const CHROME_EXTENSIONS: string[] = [
   // 'chrome-extension://<id>'
 ];
@@ -41,7 +46,7 @@ export function isOriginAllowed(origin: string | undefined, host?: string): bool
   }
 
   if (host) {
-    return WEB_ORIGINS.some((o) => o.endsWith(host));
+    return WEB_HOSTS.includes(host);
   }
 
   return false;