From 2c50516d51a883e46afb70f65658794eb67bd0b6 Mon Sep 17 00:00:00 2001 From: Phil Kuang Date: Tue, 9 Apr 2024 17:48:36 -0400 Subject: [PATCH 1/3] fix(cookieAuth): prefer issuing cookies against target host instead of origin Signed-off-by: Phil Kuang --- .changeset/curly-bottles-complain.md | 5 +++++ .../implementations/httpAuth/httpAuthServiceFactory.ts | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 .changeset/curly-bottles-complain.md diff --git a/.changeset/curly-bottles-complain.md b/.changeset/curly-bottles-complain.md new file mode 100644 index 0000000000..c83a3921e2 --- /dev/null +++ b/.changeset/curly-bottles-complain.md @@ -0,0 +1,5 @@ +--- +'@backstage/backend-app-api': patch +--- + +Fix auth cookie issuance for split backend deployments by preferring to set it against the request target host instead of origin diff --git a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts index fe927eaa5d..d6f5ceefa8 100644 --- a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts +++ b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts @@ -232,7 +232,7 @@ class DefaultHttpAuthService implements HttpAuthService { const externalBaseUrlStr = await this.#discovery.getExternalBaseUrl( this.#pluginId, ); - const externalBaseUrl = new URL(origin ?? externalBaseUrlStr); + const externalBaseUrl = new URL(externalBaseUrlStr ?? origin); const secure = externalBaseUrl.protocol === 'https:' || From 2706c3b181a08c9c31370cb12f2b06ed9451e094 Mon Sep 17 00:00:00 2001 From: Phil Kuang Date: Wed, 10 Apr 2024 16:06:23 -0400 Subject: [PATCH 2/3] fix(cookieAuth): set cookie against request host instead of origin Signed-off-by: Phil Kuang --- .../implementations/httpAuth/httpAuthServiceFactory.ts | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts index d6f5ceefa8..d7de0ae4ea 100644 --- a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts +++ b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts @@ -225,14 +225,12 @@ class DefaultHttpAuthService implements HttpAuthService { priority: 'high'; sameSite: 'none' | 'lax'; }> { - const originHeader = req.headers.origin; - const origin = - !originHeader || originHeader === 'null' ? undefined : originHeader; + const requestBaseUrl = `${req.protocol}://${req.hostname}`; const externalBaseUrlStr = await this.#discovery.getExternalBaseUrl( this.#pluginId, ); - const externalBaseUrl = new URL(externalBaseUrlStr ?? origin); + const externalBaseUrl = new URL(requestBaseUrl ?? externalBaseUrlStr); const secure = externalBaseUrl.protocol === 'https:' || From 438245968b10daa91937ed52417e6e6263c71427 Mon Sep 17 00:00:00 2001 From: Phil Kuang Date: Thu, 11 Apr 2024 09:00:42 -0400 Subject: [PATCH 3/3] refactor(cookieAuth): set cookie domain against discovery base url Signed-off-by: Phil Kuang --- .../implementations/httpAuth/httpAuthServiceFactory.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts index d7de0ae4ea..c85ba6e4b3 100644 --- a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts +++ b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts @@ -218,19 +218,19 @@ class DefaultHttpAuthService implements HttpAuthService { return { expiresAt }; } - async #getCookieOptions(req: Request): Promise<{ + async #getCookieOptions(_req: Request): Promise<{ domain: string; httpOnly: true; secure: boolean; priority: 'high'; sameSite: 'none' | 'lax'; }> { - const requestBaseUrl = `${req.protocol}://${req.hostname}`; - + // TODO: eventually we should read from `${req.protocol}://${req.hostname}` + // once https://github.com/backstage/backstage/issues/24169 has landed const externalBaseUrlStr = await this.#discovery.getExternalBaseUrl( this.#pluginId, ); - const externalBaseUrl = new URL(requestBaseUrl ?? externalBaseUrlStr); + const externalBaseUrl = new URL(externalBaseUrlStr); const secure = externalBaseUrl.protocol === 'https:' ||