diff --git a/who-am-i/src/server.rs b/who-am-i/src/server.rs
index 9e24733..f6a2008 100644
--- a/who-am-i/src/server.rs
+++ b/who-am-i/src/server.rs
@@ -268,6 +268,11 @@ async fn prompt(
             Some(parent_host),
         );
     }
+    if let Some(ref app) = params.app {
+        if !allowed_hosts.contains(app) {
+            return err("Login is not allowed for this app", false, Some(app));
+        }
+    }
     let parent_origin = url.origin().ascii_serialization();
     if parent_origin == "null" {
         return err("Origin or referrer header value is opaque", true, None);