fix: filter out wildcard origins from allowed domains

api/src/extensions/channels/web/base-web-channel.ts

@@ -337,6 +337,7 @@ export default abstract class BaseWebChannelHandler<
     // Get the allowed origins
     const origins: string[] = settings.allowed_domains.split(',');
     const foundOrigin = origins
+      .filter((origin) => origin.trim() !== '*') // Skip "*"
       .map((origin) => {
         try {
           return new URL(origin.trim()).origin;