diff --git a/.changeset/quiet-rivers-wave.md b/.changeset/quiet-rivers-wave.md index 26b0b462d6..3ac6ec37fd 100644 --- a/.changeset/quiet-rivers-wave.md +++ b/.changeset/quiet-rivers-wave.md @@ -2,12 +2,4 @@ '@backstage/plugin-auth-backend': patch --- -Supports callbackUrls when setting cookie configuration. -Cookie paths will no longer be scoped to include the handler of the provider: - -```diff -cookie = { -- path=`${pathname}/${provider}/handler` -+ path=`${pathname}/${provider}` -} -``` +Running the `auth-backend` on multiple domains, perhaps different domains depending on the `auth.environment`, was previously not possible as the `domain` name of the cookie was taken from `backend.baseUrl`. This prevented any cookies to be set in the start of the auth flow as the domain of the cookie would not match the domain of the callbackUrl configured in the OAuth app. This change checks if a provider supports custom `callbackUrl`'s to be configured in the application configuration and uses the domain from that, allowing the `domain`'s to match and the cookie to be set. diff --git a/plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts b/plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts index 5d5d7e3a87..a85dd49fba 100644 --- a/plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts +++ b/plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts @@ -383,7 +383,7 @@ describe('OAuthAdapter', () => { expect.any(String), expect.objectContaining({ domain: 'domain.org', - path: '/auth/test-provider', + path: '/auth/test-provider/handler', secure: false, }), ); @@ -423,7 +423,7 @@ describe('OAuthAdapter', () => { expect.any(String), expect.objectContaining({ domain: 'authdomain.org', - path: '/auth/test-provider', + path: '/auth/test-provider/handler', secure: true, }), ); diff --git a/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts b/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts index ad1b6a316f..564d5c20de 100644 --- a/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts +++ b/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts @@ -270,7 +270,7 @@ export class OAuthAdapter implements AuthProviderRouteHandlers { secure: this.options.secure, sameSite: 'lax', domain: this.options.cookieDomain, - path: this.options.cookiePath, + path: `${this.options.cookiePath}/handler`, httpOnly: true, }); }; @@ -281,7 +281,7 @@ export class OAuthAdapter implements AuthProviderRouteHandlers { secure: this.options.secure, sameSite: 'lax', domain: this.options.cookieDomain, - path: this.options.cookiePath, + path: `${this.options.cookiePath}/handler`, httpOnly: true, }); };