diff --git a/broker/config/wildfirechat.conf b/broker/config/wildfirechat.conf
index 9f0a6d9c..fed74cd0 100755
--- a/broker/config/wildfirechat.conf
+++ b/broker/config/wildfirechat.conf
@@ -180,6 +180,9 @@ robot.mention_external_robot true
 ## 比如允许获取name和email就是5(1+4)，允许获取name和mobile和company和type就是531（1+2+16+512），允许全部是1023(1+2+...+512)
 #robot.get_user_info_mask 1023
 
+## 机器人应用authToken允许任意host。当为false时，机器人Web应用的host必须和机器人的callback host一致，这样能够增加安全性。
+#robot.application_allow_any_host true
+
 ## 频道回调信息是否带上用户clientId和平台类型。
 channel.callback_with_client_info false
 
@@ -193,6 +196,9 @@ channel.callback_with_target_info false
 ## 旧的方式是，automatic为0时，订阅者的消息发给owner，不转发消息到callback地址。为1时，把订阅者的消息转发给callback地址，不发给owner。
 channel.new_callback_feature true
 
+## 频道应用authToken允许任意host。当为false时，频道Web应用的host必须和频道的callback host一致，这样能够增加安全性。
+#channel.application_allow_any_host true
+
 ##禁止搜索用户
 friend.disable_search false
 
diff --git a/broker/src/main/java/io/moquette/BrokerConstants.java b/broker/src/main/java/io/moquette/BrokerConstants.java
index 1d7096b0..4a7c6134 100755
--- a/broker/src/main/java/io/moquette/BrokerConstants.java
+++ b/broker/src/main/java/io/moquette/BrokerConstants.java
@@ -186,12 +186,13 @@ public final class BrokerConstants {
     public static final String ROBOT_Callback_With_Target_Info = "robot.callback_with_target_info";
     public static final String ROBOT_Mention_External_Robot = "robot.mention_external_robot";
     public static final String ROBOT_Get_User_Info_Mask = "robot.get_user_info_mask";
+    public static final String ROBOT_App_Allow_Any_Host = "robot.application_allow_any_host";
 
     public static final String CHANNEL_Callback_With_Client_Info = "channel.callback_with_client_info";
     public static final String CHANNEL_Callback_With_Sender_Info = "channel.callback_with_sender_info";
     public static final String CHANNEL_Callback_With_Target_Info = "channel.callback_with_target_info";
     public static final String CHANNEL_New_Callback_Feature = "channel.new_callback_feature";
-
+    public static final String CHANNEL_App_Allow_Any_Host = "channel.application_allow_any_host";
 
     public static final String FRIEND_Disable_Search = "friend.disable_search";
     public static final String FRIEND_Disable_NickName_Search = "friend.disable_nick_name_search";
diff --git a/broker/src/main/java/io/moquette/persistence/MemoryMessagesStore.java b/broker/src/main/java/io/moquette/persistence/MemoryMessagesStore.java
index d1cc6fde..c84b4173 100755
--- a/broker/src/main/java/io/moquette/persistence/MemoryMessagesStore.java
+++ b/broker/src/main/java/io/moquette/persistence/MemoryMessagesStore.java
@@ -224,11 +224,13 @@ public class MemoryMessagesStore implements IMessagesStore {
     private boolean mRobotCallbackWithTargetInfo = false;
     private boolean mRobotMentionExternalRobot = false;
     private int mRobotGetUserInfoMask = 0;
+    private boolean mRobotAppAllowAnyHost = false;
 
     private boolean mChannelCallbackWithClientInfo = false;
     private boolean mChannelCallbackWithSenderInfo = false;
     private boolean mChannelCallbackWithTargetInfo = false;
     private boolean mChannelNewCallbackFeature = true;
+    private boolean mChannelAppAllowAnyHost = false;
 
     private Set<Integer> mUserHideProperties = new HashSet<>();
 
@@ -689,6 +691,9 @@ public class MemoryMessagesStore implements IMessagesStore {
         try {
             mRobotGetUserInfoMask = Integer.parseInt(server.getConfig().getProperty(BrokerConstants.ROBOT_Get_User_Info_Mask, "0"));
         } catch (Exception e) {}
+        try {
+            mRobotAppAllowAnyHost = "true".equalsIgnoreCase(server.getConfig().getProperty(BrokerConstants.ROBOT_App_Allow_Any_Host, "false"));
+        } catch (Exception e) {}
 
         try {
             mChannelCallbackWithClientInfo = Boolean.parseBoolean(server.getConfig().getProperty(BrokerConstants.CHANNEL_Callback_With_Client_Info, "false"));
@@ -699,10 +704,12 @@ public class MemoryMessagesStore implements IMessagesStore {
         try {
             mChannelCallbackWithTargetInfo = Boolean.parseBoolean(server.getConfig().getProperty(BrokerConstants.CHANNEL_Callback_With_Target_Info, "false"));
         } catch (Exception e) {}
-
         try {
             mChannelNewCallbackFeature = Boolean.parseBoolean(server.getConfig().getProperty(BrokerConstants.CHANNEL_New_Callback_Feature, "true"));
         } catch (Exception e) {}
+        try {
+            mChannelAppAllowAnyHost = "true".equalsIgnoreCase(server.getConfig().getProperty(BrokerConstants.CHANNEL_App_Allow_Any_Host, "false"));
+        } catch (Exception e) {}
 
         try {
             mRecallForwardUrl = server.getConfig().getProperty(BrokerConstants.MESSAGE_RecallMsg_Forward_Url);
@@ -4216,12 +4223,12 @@ public class MemoryMessagesStore implements IMessagesStore {
         String secret = null;
         if(type == ProtoConstants.ApplicationType.ApplicationType_Robot) {
             WFCMessage.Robot robotData = getRobot(applicationId);
-            if(robotData != null && !StringUtil.isNullOrEmpty(robotData.getCallback()) && !StringUtil.isNullOrEmpty(robotData.getSecret())) {
+            if(robotData != null && (mRobotAppAllowAnyHost || !StringUtil.isNullOrEmpty(robotData.getCallback())) && !StringUtil.isNullOrEmpty(robotData.getSecret())) {
                 try {
                     URL url = new URL(robotData.getCallback());
                     if(url.getHost() == null) {
                         LOG.error("get application auth code error, application callback is invalid url");
-                    } else if(url.getHost().equals(host)) {
+                    } else if(mRobotAppAllowAnyHost || url.getHost().equals(host)) {
                         secret = robotData.getSecret();
                     } else {
                         LOG.error("get application auth code error, request host is not the same host with callback host");
@@ -4242,12 +4249,12 @@ public class MemoryMessagesStore implements IMessagesStore {
             }
         } else if(type == ProtoConstants.ApplicationType.ApplicationType_Channel) {
             WFCMessage.ChannelInfo channelData = getChannelInfo(applicationId);
-            if(channelData != null && !StringUtil.isNullOrEmpty(channelData.getCallback()) && !StringUtil.isNullOrEmpty(channelData.getSecret())) {
+            if(channelData != null && (mChannelAppAllowAnyHost || !StringUtil.isNullOrEmpty(channelData.getCallback())) && !StringUtil.isNullOrEmpty(channelData.getSecret())) {
                 try {
                     URL url = new URL(channelData.getCallback());
                     if(url.getHost() == null) {
                         LOG.error("get application auth code error, application callback is invalid url");
-                    } else if(url.getHost().equals(host)) {
+                    } else if(mChannelAppAllowAnyHost || url.getHost().equals(host)) {
                         secret = channelData.getSecret();
                     } else {
                         LOG.error("get application auth code error, request host is not the same host with callback host");
@@ -4285,12 +4292,12 @@ public class MemoryMessagesStore implements IMessagesStore {
         String secret = null;
         if(type == ProtoConstants.ApplicationType.ApplicationType_Robot) {
             WFCMessage.Robot robotData = getRobot(applicationId);
-            if(robotData != null && !StringUtil.isNullOrEmpty(robotData.getCallback()) && !StringUtil.isNullOrEmpty(robotData.getSecret())) {
+            if(robotData != null && (mRobotAppAllowAnyHost || !StringUtil.isNullOrEmpty(robotData.getCallback())) && !StringUtil.isNullOrEmpty(robotData.getSecret())) {
                 secret = robotData.getSecret();
             }
         } else if(type == ProtoConstants.ApplicationType.ApplicationType_Channel) {
             WFCMessage.ChannelInfo channelData = getChannelInfo(applicationId);
-            if(channelData != null && !StringUtil.isNullOrEmpty(channelData.getCallback()) && !StringUtil.isNullOrEmpty(channelData.getSecret())) {
+            if(channelData != null && (mChannelAppAllowAnyHost || !StringUtil.isNullOrEmpty(channelData.getCallback())) && !StringUtil.isNullOrEmpty(channelData.getSecret())) {
                 secret = channelData.getSecret();
             }
         } else if(type == ProtoConstants.ApplicationType.ApplicationType_Admin) {
diff --git a/distribution/src/main/resources/wildfirechat.conf b/distribution/src/main/resources/wildfirechat.conf
index ee32f43b..6f5567f7 100755
--- a/distribution/src/main/resources/wildfirechat.conf
+++ b/distribution/src/main/resources/wildfirechat.conf
@@ -177,6 +177,9 @@ robot.mention_external_robot true
 ## 比如允许获取name和email就是5(1+4)，允许获取name和mobile和company和type就是531（1+2+16+512），允许全部是1023(1+2+...+512)
 #robot.get_user_info_mask 1023
 
+## 机器人应用authToken允许任意host。当为false时，机器人Web应用的host必须和机器人的callback host一致，这样能够增加安全性。
+#robot.application_allow_any_host true
+
 ## 频道回调信息是否带上用户clientId和平台类型。
 channel.callback_with_client_info false
 
@@ -190,6 +193,9 @@ channel.callback_with_target_info false
 ## 旧的方式是，automatic为0时，订阅者的消息发给owner，不转发消息到callback地址。为1时，把订阅者的消息转发给callback地址，不发给owner。
 channel.new_callback_feature true
 
+## 频道应用authToken允许任意host。当为false时，频道Web应用的host必须和频道的callback host一致，这样能够增加安全性。
+#channel.application_allow_any_host true
+
 ##禁止搜索用户
 friend.disable_search false