fix: use configured redirect URL for external providers

[hf]

With #999 custom domains were introduced, however for OAuth, the redirect URLs should in fact be the ones specified in the config and not ones interpreted from the X-Forwarded-Host header.

[kangmingtay]

Hmm i added this initially because i thought that the config doesn't matter. It can be any custom domain the developer decides to use and it's up to them to set it within the oauth app.

[hf]

Hmm i added this initially because i thought that the config doesn't matter. It can be any custom domain the developer decides to use and it's up to them to set it within the oauth app.

Yes but this setting configures what redirect URL is being sent to the OAuth provider, which is controlled by the GOTRUE_EXTERNAL_<PROVIDER>_REDIRECT_URL config. Had this URL been a relative path, then it would have made sense to use the hostname. But it appears that it's not, at least not on Supabase projects.

[kangmingtay]

ah good point, yeah that will result in breaking behaviour if the user attempts to sign in with oauth from a custom domain

[J0]

Ah okay, so with custom domains the user would still configure GOTRUE_EXTERNAL_<PROVIDER>_REDIRECT_URL except that they would need to adjust the URL as per their custom domain?

Had this URL been a relative path, then it would have made sense to use the hostname

Oh what would be the difference here? By relative path would it mean that the user specifying the suffix (e.g. /<url> ...) ?

[kangmingtay]

@J0 yeah the user would have to be able to update the GOTRUE_EXTERNAL_<PROVIDER>_REDIRECT_URL and those URLs should correspond to the callback URLs used in the oauth app

[kangmingtay]

i initially made the assumption that a developer would add all their associated custom domains to the oauth app but that might not be the case and will result in an error - maybe we should expose the GOTRUE_EXTERNAL_<PROVIDER>_REDIRECT_URL config in the dashboard? I'm also not sure if it makes sense for every oauth provider to have their own GOTRUE_EXTERNAL_<PROVIDER>_REDIRECT_URL config or maybe we can refactor this to be shared across all the providers.

[J0]

Oh okay I'm still slightly lost - could I trouble you for a quick check - would the breaking behaviour result from the following:

1. User configures GOTRUE_EXTERNAL_<PROVIDER>_REDIRECT_URL to https://<ref>.supabase.co/callback hoping to redirect to Supabase Auth
2. User signs in with OAuth on custom domains page http://mysite.com/
3. Supabase Auth calls getExternalHost and redirects to mysite.com/callback when the intended callback was https://<ref>.supabase.co/callback ?

[kangmingtay]

@J0 yup that's right

[github-actions]

🎉 This PR is included in version 2.69.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀