fix: preserve original host through forward auth

packages/helpers/src/index.ts

@@ -78,7 +78,10 @@ export function getOriginalRequestUrl(
   ctx: RequestContext,
   options: OriginalRequestOptions = {},
 ): URL {
-  const host = forwardedValue(ctx, "x-forwarded-host");
+  // A forward-auth verifier can itself sit behind the same gateway. In that
+  // nested hop X-Forwarded-Host correctly describes the verifier (SSO), while
+  // X-Original-Host keeps the protected application's host (for returnTo).
+  const host = forwardedValue(ctx, "x-original-host") ?? forwardedValue(ctx, "x-forwarded-host");
   const path = getOriginalRequestPath(ctx);
 
   if (!host) return new URL(path, ctx.url.origin);
@@ -86,7 +89,11 @@ export function getOriginalRequestUrl(
     throw new TypeError(`Untrusted forwarded host: ${host}`);
   }
 
-  const protocol = (forwardedValue(ctx, "x-forwarded-proto") ?? ctx.url.protocol).replace(/:$/, "");
+  const protocol = (
+    forwardedValue(ctx, "x-original-proto") ??
+    forwardedValue(ctx, "x-forwarded-proto") ??
+    ctx.url.protocol
+  ).replace(/:$/, "");
   if (protocol !== "http" && protocol !== "https") {
     throw new TypeError(`Unsupported forwarded protocol: ${protocol}`);
   }