diff --git a/server.js b/server.js
index ca98795f2..c47c4e450 100644
--- a/server.js
+++ b/server.js
@@ -214,7 +214,7 @@ app.get('/api/config', function(req, res){
             // FIXME don't send websocketURL if websocketPath is provided. deprecated.
             websocketURL:'ws' + ((useSecureWebsockets) ? 's' : '') + '://' + host + ':' +
                 websocketPort + '/cryptpad_websocket',
-            httpUnsafeOrigin: config.httpUnsafeOrigin.replace(/^ /, ''),
+            httpUnsafeOrigin: config.httpUnsafeOrigin.replace(/^\s*/, ''),
             adminEmail: config.adminEmail,
             adminKeys: admins,
             inactiveTime: config.inactiveTime,