diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index 802f6f0353..cd2f963680 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -62,7 +62,10 @@ use tower_http::{
 };
 use windmill_common::db::UserDB;
 use windmill_common::worker::CLOUD_HOSTED;
-use windmill_common::{utils::{configure_client, GIT_VERSION}, BASE_URL, INSTANCE_NAME};
+use windmill_common::{
+    utils::{configure_client, GIT_VERSION},
+    BASE_URL, INSTANCE_NAME,
+};
 
 use crate::scim_oss::has_scim_token;
 use windmill_common::error::AppError;
@@ -180,6 +183,7 @@ pub mod workspaces_ee;
 mod workspaces_export;
 mod workspaces_extra;
 mod workspaces_oss;
+mod public_app_layer;
 
 #[cfg(feature = "mcp")]
 mod mcp;
@@ -699,6 +703,15 @@ pub async fn run_server(
         )
     };
 
+    let app = if let Some(domain) = public_app_layer::PUBLIC_APP_DOMAIN.as_ref() {
+        tracing::info!("Public app domain filter enabled for domain: {}", domain);
+        app.layer(axum::middleware::from_fn(
+            public_app_layer::public_app_domain_filter,
+        ))
+    } else {
+        app
+    };
+
     let app = app.layer(CatchPanicLayer::custom(|err| {
         tracing::error!("panic in handler, returning 500: {:?}", err);
         Response::builder()
diff --git a/frontend/src/lib/components/Login.svelte b/frontend/src/lib/components/Login.svelte
index b525f73ee5..086ab367b6 100644
--- a/frontend/src/lib/components/Login.svelte
+++ b/frontend/src/lib/components/Login.svelte
@@ -16,7 +16,7 @@
 	import { sendUserToast } from '$lib/toast'
 	import { isCloudHosted } from '$lib/cloud'
 	import { refreshSuperadmin } from '$lib/refreshUser'
-	import { createEventDispatcher, onDestroy, onMount } from 'svelte'
+	import { onDestroy, onMount } from 'svelte'
 	import Skeleton from './common/skeleton/Skeleton.svelte'
 	import Button from './common/button/Button.svelte'
 
@@ -27,6 +27,7 @@
 		error?: string | undefined
 		popup?: boolean
 		firstTime?: boolean
+		onLoginSuccess?: () => void
 	}
 
 	let {
@@ -35,7 +36,8 @@
 		password = $bindable(undefined),
 		error = undefined,
 		popup = false,
-		firstTime = false
+		firstTime = false,
+		onLoginSuccess = undefined
 	}: Props = $props()
 
 	const providers = [
@@ -200,8 +202,6 @@
 		}
 	}
 
-	const dispatch = createEventDispatcher()
-
 	onMount(() => {
 		try {
 			localStorage.removeItem('closeUponLogin')
@@ -212,19 +212,23 @@
 
 	function popupListener(event) {
 		let data = event.data
+		console.log('popupListener', data, event.origin, window.location.origin)
 		if (event.origin !== window.location.origin) {
 			return
 		}
 
 		processPopupData(data)
-		window.removeEventListener('message', popupListener)
+		if (data.type === 'success' || data.type === 'error') {
+			console.log('Removing popup listener')
+			window.removeEventListener('message', popupListener)
+		}
 	}
 
 	function processPopupData(data) {
 		if (data.type === 'error') {
 			sendUserToast(data.error, true)
 		} else if (data.type === 'success') {
-			dispatch('login')
+			onLoginSuccess?.()
 		}
 	}
 
diff --git a/frontend/src/routes/a/[...path]/+page.svelte b/frontend/src/routes/a/[...path]/+page.svelte
index 3fec55ce0a..6aa05e6110 100644
--- a/frontend/src/routes/a/[...path]/+page.svelte
+++ b/frontend/src/routes/a/[...path]/+page.svelte
@@ -139,7 +139,8 @@
 	<div class="px-2 mx-auto mt-20 max-w-xl w-full">
 		{#if !jwtError}
 			<Login
-				on:login={() => {
+				onLoginSuccess={() => {
+					
 					// window.location.reload()
 					loadApp()
 					app = app
diff --git a/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte b/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte
index 7b7541b386..fadae2baf9 100644
--- a/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte
+++ b/frontend/src/routes/public/[workspace]/[...secret]/+page.svelte
@@ -125,7 +125,8 @@
 	<div class="px-2 mx-auto mt-20 max-w-xl w-full">
 		{#if !jwtError}
 			<Login
-				on:login={() => {
+				onLoginSuccess={() => {
+					console.log('login')
 					// window.location.reload()
 					loadUser().then(() => {
 						loadApp()
diff --git a/frontend/vite.config.js b/frontend/vite.config.js
index 0ac847c255..9fc6660220 100644
--- a/frontend/vite.config.js
+++ b/frontend/vite.config.js
@@ -11,7 +11,7 @@ const version = JSON.parse(json)
 const config = {
 	server: {
 		https: process.env.HTTPS === 'true',
-		allowedHosts: ['localhost', '127.0.0.1', '0.0.0.0', 'rubendev.wimill.xyz'],
+		allowedHosts: ['localhost', '127.0.0.1', '0.0.0.0', 'rubendev.wimill.xyz', 'windmill.xyz'],
 		port: 3000,
 		proxy: {
 			'^/api/w/[^/]+/s3_proxy/.*': {