Gustavo ValverdeandRaeesBhatti 8dffad64a7 feat(auth)!: baseURL is the canonical origin; multi-host via trustedOrigins ...

baseURL conflated two jobs: the stable identity of the auth server and, in its
object form, a per-request host allowlist whose allowedHosts already duplicated
trustedOrigins. Per-request resolution was written three times (HTTP handler,
auth.api path, MCP), so a config shape handled in one was silently unhandled in
the others.

Collapse baseURL to the canonical origin. The hosts a deployment also serves
move to trustedOrigins (static array or per-request function). One boundary
resolver derives the per-request serving origin (the request host when trusted,
else canonical) for every entry point, so cookies and self-referential links
follow the host while identity (OAuth/OIDC issuer, JWT iss/aud, social
redirect_uri, Passkey rpID) stays canonical.

Closes #4151
Closes #8478
Closes #8548

Co-authored-by: RaeesBhatti <10067728+RaeesBhatti@users.noreply.github.com>

2026-06-16 17:42:28 -07:00

..

adapter

fix: make single-use credentials, counters, and replay markers atomic (#9993)

2026-06-11 05:11:26 +00:00

integration

feat(auth)!: baseURL is the canonical origin; multi-host via trustedOrigins

2026-06-16 17:42:28 -07:00

smoke

refactor!: remove deprecated oidc-provider plugin (#10031)

2026-06-12 21:45:19 +00:00