fix(cookieAuth): prefer issuing cookies against target host instead of origin

Signed-off-by: Phil Kuang <pkuang@factset.com>

.changeset/curly-bottles-complain.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-app-api': patch
+---
+
+Fix auth cookie issuance for split backend deployments by preferring to set it against the request target host instead of origin

packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts

@@ -232,7 +232,7 @@ class DefaultHttpAuthService implements HttpAuthService {
     const externalBaseUrlStr = await this.#discovery.getExternalBaseUrl(
       this.#pluginId,
     );
-    const externalBaseUrl = new URL(origin ?? externalBaseUrlStr);
+    const externalBaseUrl = new URL(externalBaseUrlStr ?? origin);
 
     const secure =
       externalBaseUrl.protocol === 'https:' ||