Use origin from request when calculating cookie config in start

Signed-off-by: Marcus Eide <eide@spotify.com>

plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts

@@ -378,6 +378,7 @@ describe('OAuthAdapter', () => {
       query: {
         scope: 'user',
         env: 'development',
+        origin: 'http://domain.org',
       },
     } as unknown as express.Request;
 
@@ -405,6 +406,50 @@ describe('OAuthAdapter', () => {
     );
   });
 
+  it('sets the correct nonce cookie configuration using origin from request', async () => {
+    const config = {
+      baseUrl: 'http://domain.org/auth',
+      appUrl: 'http://domain.org',
+      isOriginAllowed: () => false,
+    };
+
+    const oauthProvider = OAuthAdapter.fromConfig(config, providerInstance, {
+      ...oAuthProviderOptions,
+      callbackUrl: 'https://domain.org/auth/test-provider/handler/frame',
+    });
+
+    const mockRequest = {
+      query: {
+        scope: 'user',
+        env: 'development',
+        origin: 'http://other.domain',
+      },
+    } as unknown as express.Request;
+
+    const mockResponse = {
+      cookie: jest.fn().mockReturnThis(),
+      end: jest.fn().mockReturnThis(),
+      setHeader: jest.fn().mockReturnThis(),
+      statusCode: jest.fn().mockReturnThis(),
+    } as unknown as express.Response;
+
+    await oauthProvider.start(mockRequest, mockResponse);
+    expect(mockCookieConfigurer).not.toHaveBeenCalled();
+    expect(mockResponse.cookie).toHaveBeenCalledTimes(1);
+    expect(mockResponse.cookie).toHaveBeenCalledWith(
+      `${oAuthProviderOptions.providerId}-nonce`,
+      expect.any(String),
+      expect.objectContaining({
+        httpOnly: true,
+        domain: 'domain.org',
+        maxAge: TEN_MINUTES_MS,
+        path: '/auth/test-provider/handler',
+        secure: true,
+        sameSite: 'none',
+      }),
+    );
+  });
+
   it('sets the correct cookie configuration using an secure callbackUrl', async () => {
     const config = {
       baseUrl: 'https://domain.org/auth',

plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts

@@ -102,7 +102,7 @@ export class OAuthAdapter implements AuthProviderRouteHandlers {
       throw new InputError('No env provided in request query parameters');
     }
 
-    const cookieConfig = this.getCookieConfig();
+    const cookieConfig = this.getCookieConfig(origin);
 
     const nonce = crypto.randomBytes(16).toString('base64');
     // set a nonce cookie before redirecting to oauth provider