fix(webapp): build magic links from LOGIN_ORIGIN

Magic-link sign-in emails now always link to `LOGIN_ORIGIN`, whatever
host the sign-in request came in on.

Mono-RevId: 7977b5e15f67095f5bba4912121c4d92d906e9b2

Author: ericallam

.server-changes/magic-link-login-origin.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Magic-link sign-in emails now always link to `LOGIN_ORIGIN`, whatever host the request came in on.

apps/webapp/app/services/emailAuth.server.tsx

@@ -5,6 +5,7 @@ import { findOrCreateUser } from "~/models/user.server";
 import { sendMagicLinkEmail } from "~/services/email.server";
 import type { AuthUser } from "./authUser";
 import { logger } from "./logger.server";
+import { pinMagicLinkOrigin } from "./magicLinkOrigin.server";
 
 import { postAuthentication } from "./postAuth.server";
 import { SsoRequiredError, ssoRedirectForEmail } from "./ssoAutoDiscovery.server";
@@ -74,6 +75,7 @@ const emailStrategy = new EmailLinkStrategy(
   },
   verifyMagicLink
 );
+pinMagicLinkOrigin(emailStrategy, env.LOGIN_ORIGIN);
 
 export function addEmailLinkStrategy(authenticator: Authenticator<AuthUser>) {
   authenticator.use(emailStrategy);

apps/webapp/app/services/magicLinkOrigin.server.test.ts

@@ -0,0 +1,92 @@
+import { createCookieSessionStorage } from "@remix-run/node";
+import { EmailLinkStrategy } from "remix-auth-email-link";
+import { describe, expect, it } from "vitest";
+import { pinMagicLinkOrigin } from "./magicLinkOrigin.server";
+
+const LOGIN_ORIGIN = "https://cloud.example";
+
+function createStrategy() {
+  const sentLinks: string[] = [];
+  const strategy = new EmailLinkStrategy<{ id: string }>(
+    {
+      secret: "test-magic-link-secret",
+      callbackURL: "/magic",
+      sendEmail: async ({ magicLink }) => {
+        sentLinks.push(magicLink);
+      },
+    },
+    async () => ({ id: "user" })
+  );
+  return { strategy, sentLinks };
+}
+
+async function requestLink(strategy: EmailLinkStrategy<{ id: string }>, headers: HeadersInit) {
+  const sessionStorage = createCookieSessionStorage({
+    cookie: { name: "__session", secrets: ["test-session-secret"] },
+  });
+  const request = new Request("https://cloud.example/login/magic", {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", ...headers },
+    body: new URLSearchParams({ email: "someone@example.com" }),
+  });
+
+  const thrown = await strategy
+    .authenticate(request, sessionStorage, {
+      name: "email-link",
+      sessionKey: "user",
+      sessionErrorKey: "auth:error",
+      sessionStrategyKey: "strategy",
+      successRedirect: "/login/magic",
+      failureRedirect: "/login",
+    })
+    .catch((error: unknown) => error);
+
+  expect(thrown).toBeInstanceOf(Response);
+  expect((thrown as Response).headers.get("Location")).toBe("/login/magic");
+}
+
+describe("pinMagicLinkOrigin", () => {
+  it("builds the link from the request's forwarded host without it", async () => {
+    const { strategy, sentLinks } = createStrategy();
+
+    await requestLink(strategy, { Host: "cloud.example", "X-Forwarded-Host": "attacker.example" });
+
+    expect(new URL(sentLinks[0]).host).toBe("attacker.example");
+  });
+
+  it("ignores a forged X-Forwarded-Host", async () => {
+    const { strategy, sentLinks } = createStrategy();
+    pinMagicLinkOrigin(strategy, LOGIN_ORIGIN);
+
+    await requestLink(strategy, {
+      Host: "cloud.example",
+      "X-Forwarded-Host": "attacker.example",
+      "X-Forwarded-Proto": "http",
+    });
+
+    expect(sentLinks).toHaveLength(1);
+    expect(sentLinks[0].startsWith(`${LOGIN_ORIGIN}/magic?token=`)).toBe(true);
+  });
+
+  it("ignores a forged Host", async () => {
+    const { strategy, sentLinks } = createStrategy();
+    pinMagicLinkOrigin(strategy, LOGIN_ORIGIN);
+
+    await requestLink(strategy, { Host: "attacker.example" });
+
+    expect(sentLinks[0].startsWith(`${LOGIN_ORIGIN}/magic?token=`)).toBe(true);
+  });
+
+  it("normalizes an origin given with a trailing slash or path", async () => {
+    const { strategy, sentLinks } = createStrategy();
+    pinMagicLinkOrigin(strategy, "https://cloud.example/some/path/");
+
+    await requestLink(strategy, { Host: "cloud.example" });
+
+    expect(sentLinks[0].startsWith("https://cloud.example/magic?token=")).toBe(true);
+  });
+
+  it("throws when the strategy no longer has getDomainURL", () => {
+    expect(() => pinMagicLinkOrigin({}, LOGIN_ORIGIN)).toThrow(/getDomainURL/);
+  });
+});

apps/webapp/app/services/magicLinkOrigin.server.ts

@@ -0,0 +1,27 @@
+/**
+ * Makes an email-link strategy build every magic link on `origin`.
+ *
+ * `remix-auth-email-link` builds the link from the request's `X-Forwarded-Host`
+ * (falling back to `Host`). Both are client-controlled, so a request for someone
+ * else's address could make us email them a genuine link pointing at another
+ * host, which would then receive the token. Links must only ever point at our
+ * login origin.
+ *
+ * The library keeps `getDomainURL` private, so this replaces it on the instance.
+ * It throws if the method is gone, so a library upgrade that renames it fails at
+ * boot instead of silently reverting to header-derived links.
+ */
+export function pinMagicLinkOrigin(strategy: object, origin: string): void {
+  if (typeof (strategy as { getDomainURL?: unknown }).getDomainURL !== "function") {
+    throw new Error(
+      "remix-auth-email-link no longer builds magic links with getDomainURL; update pinMagicLinkOrigin"
+    );
+  }
+
+  const pinnedOrigin = new URL(origin).origin;
+  Object.defineProperty(strategy, "getDomainURL", {
+    value: () => pinnedOrigin,
+    configurable: true,
+    writable: true,
+  });
+}

apps/webapp/test/emailAuthVerify.test.ts

@@ -7,7 +7,9 @@ const mocks = vi.hoisted(() => ({
   })),
 }));
 
-vi.mock("~/env.server", () => ({ env: { MAGIC_LINK_SECRET: "test-magic-link-secret" } }));
+vi.mock("~/env.server", () => ({
+  env: { MAGIC_LINK_SECRET: "test-magic-link-secret", LOGIN_ORIGIN: "https://cloud.example" },
+}));
 vi.mock("~/models/user.server", () => ({ findOrCreateUser: mocks.findOrCreateUser }));
 vi.mock("~/services/email.server", () => ({ sendMagicLinkEmail: async () => {} }));
 vi.mock("~/services/postAuth.server", () => ({ postAuthentication: async () => {} }));

apps/webapp/vitest.config.ts

@@ -22,6 +22,7 @@ export default defineConfig({
       "app/services/sessionAuthorizationTelemetry.server.test.ts",
       "app/services/previewAutoArchive.server.test.ts",
       "app/services/provisionBillingCustomer.server.test.ts",
+      "app/services/magicLinkOrigin.server.test.ts",
       "app/services/turnstile.server.test.ts",
       "app/services/clickhouse/**/*.test.ts",
       "app/utils/**/*.test.ts",