chore: update todo

Author: lakhansamani

internal/cookie/cookie.go

@@ -26,13 +26,13 @@ func SetSession(gc *gin.Context, sessionID string, appCookieSecure bool) {
 	// For more information check:
 	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
 	// https://github.com/gin-gonic/gin/blob/master/context.go#L86
-	// TODO add ability to sameSite = none / strict from dashboard
+	// TODO add ability to configure sameSite (none / lax / strict) via config
 	if !appCookieSecure {
 		gc.SetSameSite(http.SameSiteLaxMode)
 	} else {
 		gc.SetSameSite(http.SameSiteNoneMode)
 	}
-	// TODO allow configuring from dashboard
+	// TODO allow configuring cookie max-age via config
 	year := 60 * 60 * 24 * 365
 
 	gc.SetCookie(constants.AppCookieName+"_session", sessionID, year, "/", host, secure, httpOnly)

internal/cookie/mfa_session.go

@@ -10,8 +10,6 @@ import (
 	"github.com/authorizerdev/authorizer/internal/parsers"
 )
 
-// TODO set app cookie as per config
-
 // SetMfaSession sets the mfa session cookie in the response
 func SetMfaSession(gc *gin.Context, sessionID string, appCookieSecure bool) {
 	secure := appCookieSecure
@@ -28,13 +26,13 @@ func SetMfaSession(gc *gin.Context, sessionID string, appCookieSecure bool) {
 	// For more information check:
 	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
 	// https://github.com/gin-gonic/gin/blob/master/context.go#L86
-	// TODO add ability to sameSite = none / strict from dashboard
+	// TODO add ability to configure sameSite (none / lax / strict) via config
 	if !appCookieSecure {
 		gc.SetSameSite(http.SameSiteLaxMode)
 	} else {
 		gc.SetSameSite(http.SameSiteNoneMode)
 	}
-	// TODO allow configuring from dashboard
+	// TODO allow configuring cookie max-age via config
 	age := 60
 
 	gc.SetCookie(constants.MfaCookieName+"_session", sessionID, age, "/", host, secure, httpOnly)

internal/parsers/url.go

@@ -7,20 +7,9 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
-// GetHost returns hostname from request context
-// if EnvKeyAuthorizerURL is set it is given highest priority.
-// if X-Authorizer-URL header is set it is given second highest priority
-// if above 2 are not set the requesting host name is used
+// GetHost returns the authorizer host URL from the request context.
+// Priority: X-Authorizer-URL header, then scheme (X-Forwarded-Proto) + host (X-Forwarded-Host or Request.Host).
 func GetHost(c *gin.Context) string {
-	// TODO see how we can do based on config
-	// authorizerURL, err := memorystore.Provider.GetStringStoreEnvVariable(constants.EnvKeyAuthorizerURL)
-	// if err != nil {
-	// 	authorizerURL = ""
-	// }
-	// if authorizerURL != "" {
-	// 	return strings.TrimSuffix(authorizerURL, "/")
-	// }
-
 	authorizerURL := c.Request.Header.Get("X-Authorizer-URL")
 	if authorizerURL != "" {
 		return strings.TrimSuffix(authorizerURL, "/")
@@ -30,7 +19,10 @@ func GetHost(c *gin.Context) string {
 	if scheme != "https" {
 		scheme = "http"
 	}
-	host := c.Request.Host
+	host := c.Request.Header.Get("X-Forwarded-Host")
+	if host == "" {
+		host = c.Request.Host
+	}
 	return strings.TrimSuffix(scheme+"://"+host, "/")
 }