The Hydra log shows the following:

time=2024-06-25T12:02:49Z level=info msg=completed handling request http_request=map[headers:map[accept:*/* accept-encoding:gzip, deflate, br, zstd accept-language:en-GB,en-US;q=0.9,en;q=0.8,nl;q=0.7 connection:keep-alive content-length:2513 content-type:application/json cookie:Value is sensitive and has been redacted. To see the value set config key "log.leak_sensitive_values = true" or environment variable "LOG_LEAK_SENSITIVE_VALUES=true". origin:<http://localhost:4200> referer:<http://localhost:4200/> sec-ch-ua:"Brave";v="125", "Chromium";v="125", "Not.A/Brand";v="24" sec-ch-ua-mobile:?0 sec-ch-ua-platform:"macOS" sec-fetch-dest:empty sec-fetch-mode:cors sec-fetch-site:same-site sec-gpc:1 user-agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36] host:localhost:5004 method:POST path:/oauth2/auth query:Value is sensitive and has been redacted. To see the value set config key "log.leak_sensitive_values = true" or environment variable "LOG_LEAK_SENSITIVE_VALUES=true". remote:172.20.0.1:60684 scheme:http] http_response=map[headers:map[access-control-allow-credentials:true access-control-allow-origin:<http://localhost:4200> access-control-expose-headers:Content-Type cache-control:private, no-cache, no-store, must-revalidate location:<http://localhost:4200/api/consent?consent_challenge=sNAWzHvRoJYT0uhyhnaSyaYzZ5ZzVx6f-SzkHDwUVUmA9vqGk4tMTf15y3iUaukR3O3LjcobB2OYQse_3Ek86tmK_UtuT04xTkLNA77NGFdyO08y5cCQtvVfhBm53LOd_d2ywjvMmn-pKwihiYlRPBA0iWcUhFXdJ13Iv3wuP_Y8B9CdC3XAAPKbGJf7s8WvzYp6usgmup1cX-Wvg-n6DqXZd1BwlF9ibUp0hbKglV36k4PYXH0Xwk5_JM8ccIPZO9ulOcaD-bTCKBZuhdu2SDe304pssplqHpLy5xwZr1HjfLMNPXtjS6IyStSA64MNDoMiVhAyoU0IFZ4Ok_hcmm1ckOTeON96f7_Pz4AKZ5edjirGN1DcwF9DlRENpPVtTVXyO0e5mqFQ6vsOuBfK8zO2gsIxu6ALaykbRfoXK8DPrtVJ_EqkXw7krFDoV8Lj1pcxNJfiBkaOJGb9ydlpUFi_sSBOyEy3mm1I38qAoKgkQqQXWAfRbcbFqAH4PeVUfe3Dt2ZKn6KHQ1I8vNUNGA-gA0f6hYTJ-1axKTk0uwcb-1chIqs2h4jTNxRsK34XAZpsoFWQlRTgZmDWkZzWEQiqcH-zB6jz_saxFuRermsTT45HupjSjoprFOuUJGhHwy0DNC22cZQF16FkCdsPvCsUH_Sa45g8U1ojBshsUMTWwUmPtZjd7B-KXp_hx5o7QAuDudWIMepJD9CBSrH0OeOIsjbrokZUVhmfc6RswJUSYTYCbS9MWIIkIQFDiX89okAd97hsYG0G9m_BshfgIu0SnfwzjSfV9zooxCBe0MV-lCRaIVL8umK7DmGXEoYsBpFGmZkMezUK-F7V9cQrN888Ye_6uPHyyk6b0lw_58BlTpBvdx0qLu7ukY392R08collJfpXP2-0aPQ03Kcs9PglPOLlfz6BqingDRIMokV_p6LPSP-KOTAILFww1ViDbIHTMPob0OqiNs59DpdNSaLAFt4vV8zj3pOiMDr83u-SAGASvF6MxyYz6isvSHomIx-ZgMXpbNUjIlkYVAKp0OmwO_2BrMf3SOSAo3p52IjK2qyWmeKC62G-QA1TMfJwlDlWQOvXwHl813pTUlsYeAsKG4rPZgFPxmKTYuYjrKknijJ20cqocjomAw8qo4oU5o5fgePTnsqiY_OrzEXqFDtiRg82yIuCiozyqEcnWjSdf78YF6njGuiva3uDY8a8h7HZbjjlI6HpMeneNR3S0hGm1foWSClcID6Vf8YyLdt9_S9OD8Dz4aJBxOJEKMZrJdm67gjWhV78yLXqT5fdDelKwldIBBDaxFbxUqgEZfc3hneFoOwzzqyLCt5HEenZhOVm2EVMQXfEA28dDeEFcu4BoHqPpzpfibLMKgkgITj2JZJwWMb5BVIMlUXfwNOdJ5NHCBxtF1nMQcKF1SnFRxCb7OhkTkndwr0gjqHol4YelZIyvqX6VmfYKRW63An_Gp_yWv4lu6cSGwrtzNyTbvPDEupQ6D9PMbv2pM567ThcrbGmdAaZRMqGWU7IMJGo4U0_4Dd1I_oYB0rY9z_TEVDlto22Pq_crwzuLUa5dNxAMpbsCpHMAeDwAjUP6z7Mt6l_RES8SXbqKRENUxy24mW31dJB0nKy-c04v5rJxd5dueDO_pRoJwQn2A%3D%3D> set-cookie:Value is sensitive and has been redacted. To see the value set config key "log.leak_sensitive_values = true" or environment variable "LOG_LEAK_SENSITIVE_VALUES=true". vary:Origin] size:0 status:302 text_status:Found took:17.675583ms]

Which to me also seems to indicate the origin is localhost:4200