diff --git a/src/Bifrost.Web/Features/Shared/StartupConfigurationValidator.cs b/src/Bifrost.Web/Features/Shared/StartupConfigurationValidator.cs
index 4d7cab9..c511413 100644
--- a/src/Bifrost.Web/Features/Shared/StartupConfigurationValidator.cs
+++ b/src/Bifrost.Web/Features/Shared/StartupConfigurationValidator.cs
@@ -103,10 +103,11 @@ public sealed class StartupConfigurationValidator(
         }
     }
 
-    // The authority form is the canonical spelling, so a wildcard, path, query, user info, upper-case host or
-    // default port differs from it and is refused.
+    // The authority form is the canonical spelling, so a wildcard, path, query, upper-case host or default port
+    // differs from it and is refused; user info is part of the authority, so it is refused on its own.
     private static bool IsExactHttpsOrigin(string? origin) =>
         Uri.TryCreate(origin, UriKind.Absolute, out var uri) &&
         uri.Scheme == Uri.UriSchemeHttps &&
+        uri.UserInfo.Length == 0 &&
         string.Equals(uri.GetLeftPart(UriPartial.Authority), origin, StringComparison.Ordinal);
 }