From 2706c3b181a08c9c31370cb12f2b06ed9451e094 Mon Sep 17 00:00:00 2001 From: Phil Kuang Date: Wed, 10 Apr 2024 16:06:23 -0400 Subject: [PATCH] fix(cookieAuth): set cookie against request host instead of origin Signed-off-by: Phil Kuang --- .../implementations/httpAuth/httpAuthServiceFactory.ts | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts index d6f5ceefa8..d7de0ae4ea 100644 --- a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts +++ b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts @@ -225,14 +225,12 @@ class DefaultHttpAuthService implements HttpAuthService { priority: 'high'; sameSite: 'none' | 'lax'; }> { - const originHeader = req.headers.origin; - const origin = - !originHeader || originHeader === 'null' ? undefined : originHeader; + const requestBaseUrl = `${req.protocol}://${req.hostname}`; const externalBaseUrlStr = await this.#discovery.getExternalBaseUrl( this.#pluginId, ); - const externalBaseUrl = new URL(externalBaseUrlStr ?? origin); + const externalBaseUrl = new URL(requestBaseUrl ?? externalBaseUrlStr); const secure = externalBaseUrl.protocol === 'https:' ||