refactor(cookieAuth): set cookie domain against discovery base url

Signed-off-by: Phil Kuang <pkuang@factset.com>

packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts

@@ -218,19 +218,19 @@ class DefaultHttpAuthService implements HttpAuthService {
     return { expiresAt };
   }
 
-  async #getCookieOptions(req: Request): Promise<{
+  async #getCookieOptions(_req: Request): Promise<{
     domain: string;
     httpOnly: true;
     secure: boolean;
     priority: 'high';
     sameSite: 'none' | 'lax';
   }> {
-    const requestBaseUrl = `${req.protocol}://${req.hostname}`;
-
+    // TODO: eventually we should read from `${req.protocol}://${req.hostname}`
+    // once https://github.com/backstage/backstage/issues/24169 has landed
     const externalBaseUrlStr = await this.#discovery.getExternalBaseUrl(
       this.#pluginId,
     );
-    const externalBaseUrl = new URL(requestBaseUrl ?? externalBaseUrlStr);
+    const externalBaseUrl = new URL(externalBaseUrlStr);
 
     const secure =
       externalBaseUrl.protocol === 'https:' ||