fix(redirect): allow root cookie domain host redirects

Previously IsRedirectSafe rejected redirects to the exact cookie domain
when AppURL had multiple subdomain levels, because it stripped the first
label twice.

Author: scottmckendry

internal/utils/app_utils.go

@@ -100,17 +100,17 @@ func IsRedirectSafe(redirectURL string, domain string) bool {
 		return false
 	}
 
-	cookieDomain, err := GetCookieDomain(redirectURL)
-
-	if err != nil {
-		return false
+	host := parsedURL.Hostname()
+	if host == domain {
+		return true
 	}
 
-	if cookieDomain != domain {
+	cookieDomain, err := GetCookieDomain(redirectURL)
+	if err != nil {
 		return false
 	}
 
-	return true
+	return cookieDomain == domain
 }
 
 func GetLogLevel(level string) zerolog.Level {

internal/utils/app_utils_test.go

@@ -164,7 +164,7 @@ func TestIsRedirectSafe(t *testing.T) {
 	// Case with no subdomain
 	redirectURL := "http://example.com/welcome"
 	result := utils.IsRedirectSafe(redirectURL, domain)
-	assert.Equal(t, false, result)
+	assert.Equal(t, true, result)
 
 	// Case with different domain
 	redirectURL = "http://malicious.com/phishing"