fix(api): only use homeLocation as a fallback (#40517)

api-server/server/middlewares/request-authorization.js

@@ -6,10 +6,10 @@ import {
   errorTypes,
   authHeaderNS
 } from '../utils/getSetAccessToken';
-import { homeLocation } from '../../../config/env';
 import { jwtSecret as _jwtSecret } from '../../../config/secrets';
 
 import { wrapHandledError } from '../utils/create-handled-error';
+import { getRedirectParams } from '../utils/redirection';
 
 const authRE = /^\/auth\//;
 const confirmEmailRE = /^\/confirm-email$/;
@@ -50,6 +50,7 @@ export function isAllowedPath(path, pathsAllowedREs = _pathsAllowedREs) {
 
 export default ({ jwtSecret = _jwtSecret, getUserById = _getUserById } = {}) =>
   function requestAuthorisation(req, res, next) {
+    const { origin } = getRedirectParams(req);
     const { path } = req;
     if (!isAllowedPath(path)) {
       const { accessToken, error, jwt } = getAccessTokenFromRequest(
@@ -61,7 +62,7 @@ export default ({ jwtSecret = _jwtSecret, getUserById = _getUserById } = {}) =>
           new Error('Access token is required for this request'),
           {
             type: 'info',
-            redirect: `${homeLocation}/signin`,
+            redirect: `${origin}/signin`,
             message: 'Access token is required for this request',
             status: 403
           }
@@ -70,7 +71,7 @@ export default ({ jwtSecret = _jwtSecret, getUserById = _getUserById } = {}) =>
       if (!accessToken && error === errorTypes.invalidToken) {
         throw wrapHandledError(new Error('Access token is invalid'), {
           type: 'info',
-          redirect: `${homeLocation}/signin`,
+          redirect: `${origin}/signin`,
           message: 'Your access token is invalid',
           status: 403
         });
@@ -78,7 +79,7 @@ export default ({ jwtSecret = _jwtSecret, getUserById = _getUserById } = {}) =>
       if (!accessToken && error === errorTypes.expiredToken) {
         throw wrapHandledError(new Error('Access token is no longer valid'), {
           type: 'info',
-          redirect: `${homeLocation}/signin`,
+          redirect: `${origin}/signin`,
           message: 'Access token is no longer valid',
           status: 403
         });