From 438245968b10daa91937ed52417e6e6263c71427 Mon Sep 17 00:00:00 2001
From: Phil Kuang <pkuang@factset.com>
Date: Thu, 11 Apr 2024 09:00:42 -0400
Subject: [PATCH] refactor(cookieAuth): set cookie domain against discovery
 base url

Signed-off-by: Phil Kuang <pkuang@factset.com>
---
 .../implementations/httpAuth/httpAuthServiceFactory.ts    | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
index d7de0ae4ea..c85ba6e4b3 100644
--- a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
+++ b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
@@ -218,19 +218,19 @@ class DefaultHttpAuthService implements HttpAuthService {
     return { expiresAt };
   }
 
-  async #getCookieOptions(req: Request): Promise<{
+  async #getCookieOptions(_req: Request): Promise<{
     domain: string;
     httpOnly: true;
     secure: boolean;
     priority: 'high';
     sameSite: 'none' | 'lax';
   }> {
-    const requestBaseUrl = `${req.protocol}://${req.hostname}`;
-
+    // TODO: eventually we should read from `${req.protocol}://${req.hostname}`
+    // once https://github.com/backstage/backstage/issues/24169 has landed
     const externalBaseUrlStr = await this.#discovery.getExternalBaseUrl(
       this.#pluginId,
     );
-    const externalBaseUrl = new URL(requestBaseUrl ?? externalBaseUrlStr);
+    const externalBaseUrl = new URL(externalBaseUrlStr);
 
     const secure =
       externalBaseUrl.protocol === 'https:' ||