Callback and Signin URL not set to https when using Bun runtime

[thomasmol]

Environment

• Hosted on Railway.app
• Bun 1.0.2
• Node 18
• @sveltejs/kit 1.20.4
• svelte 4.0.5
• svelte-adapter-bun 0.5.0
• @auth/core 0.16.1
• @auth/sveltekit 0.3.9
• @auth/drizzle-adapter 0.3.3

Reproduction URL

https://github.com/thomasmol/todos-bun

Describe the issue

I am trying to configure Authjs with sveltekit and the new Bun runtime. All works as expected locally.
However on a live/hosted website I get the following errors:

• On the auth/signin page this is in the console in safari: "The page at https://todos-bun-production.up.railway.app/auth/signin contains a form which targets an insecure URL http://todos-bun-production.up.railway.app/auth/signin/email."
• I also noticed the callbackurl cookie is set with http instead of http
• When trying to login/signup you get a cors error since the form is trying to make a request to a different url (where the only difference is http vs https)
• I have set the ORIGIN env var to an https url

I cannot figure out if this is a bug in the svelte-adapter-bun package or if it is a bug when using authjs + bun (I was thinking maybe authjs does not get the ORIGIN var properly somewhere).

I tried the exact same setup (same code) but with the node adapter for sveltekit and then it did work. When I change the ORIGIN env var in the node setup to an http url instead of https I get the same warnings and errors as with the Bun setup. That's why I think it has to do something with the ORIGIN env var.

Any ideas?
Or ideas how I can further debug this? Any help/guidance is appreciated!

How to reproduce

Setup authjs + sveltekit and run it on Bun runtime instead of node.
Check live version here: https://todos-bun-production.up.railway.app/auth/signin/email and repo here: https://github.com/thomasmol/todos-bun

Expected behavior

Callback/signin url and cookie to be set to https when on a https website

[thomasmol]

Okay I did some further testing and it looks like Authjs is not the issue, its probably the adapter. Authjs gets the origin/url from svelte's handle event and i just noticed the event.url is http where it should be https.