[5.x]: No longer able to log in to control panel when using custom baseCpUrl

[bfopma]

What happened?

Description

We use a separate subdomain for access to the control panel that differs from @web. It looks like changes introduced in this commit have changed the way that actionUrl is generated, and result in a CORS error when the login form is submitted (POSTing to a different URL than the CP uses).

Specifically, setting the $useRequestHostInfo value to true ends up setting the $baseUrl to use @web, whereas it was previously using the value of static:baseCpUrl().

Steps to reproduce

1. Configure a baseCpUrl that differs from the front end site URL.
2. Attempt to log in to the CP

Expected behavior

Successful login

Actual behavior

CORS error since the domain for the actionUrl doesn't match the CP's domain

Craft CMS version

5.0.0-beta.6

PHP version

No response

Operating system and version

No response

Database type and version

No response

Image driver and version

No response

Installed plugins and versions

[roelvanhintum]

Same goes for Craft CMS 4.8.1 (4.8.0 works fine).

[brandonkelly]

We use a separate subdomain for access to the control panel that differs from @web.

@web should always be set to the current URL you are accessing Craft from. It is not meant to represent the front-end site URL. So the issue here is that you are setting @web incorrectly.

[mrog-pbs]

I'm running into this as well.

I guess I can 'fix' it by adjusting @web to match baseCpUrl, and creating another ad-hoc alias for front-end site URLs... but I feel like I'm missing something:

If @web is meant to always reflect the current CP URL, and not the front-end site URL, what's the point of customizing baseCpUrl at all? (i.e. When would divergence between baseCpUrl and action URLs be desirable?)

[brandonkelly]

@mrog-pbs There’s not really any point in setting @web at all, since Craft will infer it automatically.

Setting baseCpUrl is only useful if your control panel should be accessed from a different base URL than your site.

If your site is located at example.com and your control panel is cms.example.com, with no trailing URI segment, then you’d need to set baseCpUrl to 'https://cms.example.com' and cpTrigger to null, so Craft knows to treat cms.example.com requests as control panel requests.