fix(backend): Derive origin from request URL (#6393)

Author: brkalow

.changeset/tidy-windows-travel.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Fixes an issue where the Clerk SDK was improperly detecting the request's origin.

packages/backend/src/tokens/__tests__/request.test.ts

@@ -1411,7 +1411,6 @@ describe('tokens.authenticateRequest(options)', () => {
         {
           referer: 'https://satellite.com/signin',
           'sec-fetch-dest': 'document',
-          origin: 'https://primary.com',
         },
         {
           __session: mockJwt,
@@ -1441,7 +1440,6 @@ describe('tokens.authenticateRequest(options)', () => {
           referer: 'https://satellite.com/signin',
           'sec-fetch-dest': 'document',
           'sec-fetch-site': 'cross-site',
-          origin: 'https://primary.com',
         },
         {
           __session: mockJwt,
@@ -1468,9 +1466,9 @@ describe('tokens.authenticateRequest(options)', () => {
     test('does not trigger handshake when referer is same origin', async () => {
       const request = mockRequestWithCookies(
         {
+          host: 'primary.com',
           referer: 'https://primary.com/signin',
           'sec-fetch-dest': 'document',
-          origin: 'https://primary.com',
         },
         {
           __session: mockJwt,

packages/backend/src/tokens/authenticateContext.ts

@@ -174,7 +174,7 @@ class AuthenticateContext implements AuthenticateContext {
    * @returns {boolean} True if referrer exists and is from a different origin, false otherwise.
    */
   public isCrossOriginReferrer(): boolean {
-    if (!this.referrer || !this.origin) {
+    if (!this.referrer || !this.clerkUrl.origin) {
       return false;
     }
 
@@ -184,7 +184,7 @@ class AuthenticateContext implements AuthenticateContext {
       }
 
       const referrerOrigin = new URL(this.referrer).origin;
-      return referrerOrigin !== this.origin;
+      return referrerOrigin !== this.clerkUrl.origin;
     } catch {
       // Invalid referrer URL format
       return false;