diff --git a/backend/tests/test_config.py b/backend/tests/test_config.py
index 0c24c92f5..a7027b456 100644
--- a/backend/tests/test_config.py
+++ b/backend/tests/test_config.py
@@ -494,3 +494,49 @@ def test_oidc_settings_reject_private_ip_literal_even_when_allowlisted(monkeypat
         match="OIDC_ISSUER_URL IP host must be globally routable",
     ):
         _settings_without_env_file()
+
+
+def test_canonical_origin_http_default_port():
+    from core.config import canonical_origin
+
+    assert canonical_origin("http", "example.com", 80) == "http://example.com"
+    assert canonical_origin("HTTP", "example.com", 80) == "http://example.com"
+    assert canonical_origin("http", "EXAMPLE.COM", 80) == "http://example.com"
+
+
+def test_canonical_origin_https_default_port():
+    from core.config import canonical_origin
+
+    assert canonical_origin("https", "example.com", 443) == "https://example.com"
+
+
+def test_canonical_origin_custom_port():
+    from core.config import canonical_origin
+
+    assert canonical_origin("http", "example.com", 8080) == "http://example.com:8080"
+    assert canonical_origin("https", "example.com", 8443) == "https://example.com:8443"
+
+
+def test_canonical_origin_none_port():
+    from core.config import canonical_origin
+
+    assert canonical_origin("http", "example.com", None) == "http://example.com"
+    assert canonical_origin("https", "example.com", None) == "https://example.com"
+
+
+def test_canonical_origin_ipv6_host():
+    from core.config import canonical_origin
+
+    assert canonical_origin("http", "2001:db8::1", 80) == "http://[2001:db8::1]"
+    assert canonical_origin("http", "[2001:db8::1]", 80) == "http://[2001:db8::1]"
+    assert canonical_origin("https", "2001:db8::1", 443) == "https://[2001:db8::1]"
+    assert canonical_origin("http", "2001:db8::1", 8080) == "http://[2001:db8::1]:8080"
+
+
+def test_canonical_origin_other_schemes():
+    from core.config import canonical_origin
+
+    assert canonical_origin("ws", "example.com", 80) == "ws://example.com:80"
+    assert canonical_origin("wss", "example.com", 443) == "wss://example.com:443"
+    assert canonical_origin("ftp", "example.com", 21) == "ftp://example.com:21"
+    assert canonical_origin("ws", "example.com", None) == "ws://example.com"