Address code review feedback

- Fix host header injection vulnerability by removing host header check
- Add uses_separate_auth_domain() helper method for clarity
- Validate URLs at startup to fail fast on misconfiguration
- Simplify redirect logic using the new helper method

Security fix: No longer trusts Host header from requests, instead uses
configured URLs to determine redirect behavior.

src/api/auth.rs

···
                 Some(did) => {
                     session.insert("did", did).unwrap();
                     // Redirect back to main app domain after successful auth
-                    let redirect_to = if config.oauth_redirect_base != config.app_url {
+                    let redirect_to = if config.uses_separate_auth_domain() {
                         config.app_url.clone()
                     } else {
                         "/".to_string()
···
 
 /// Takes you to the login page
 #[get("/login")]
-pub async fn login(
-    request: HttpRequest,
-    config: web::Data<config::Config>,
-) -> Result<HttpResponse> {
-    // Check if we're on the main app domain and redirect to auth domain
-    if let Some(host) = request.headers().get("host") {
-        if let Ok(host_str) = host.to_str() {
-            // Extract just the host from the app_url
-            if let Ok(app_url) = url::Url::parse(&config.app_url) {
-                if let Some(app_host) = app_url.host_str() {
-                    if host_str.starts_with(app_host)
-                        && config.oauth_redirect_base != config.app_url
-                    {
-                        let redirect_url = format!("{}/login", config.oauth_redirect_base);
-                        return Ok(HttpResponse::Found()
-                            .append_header(("Location", redirect_url))
-                            .finish());
-                    }
-                }
-            }
-        }
+pub async fn login(config: web::Data<config::Config>) -> Result<HttpResponse> {
+    // If we're using a separate auth domain, redirect to it
+    if config.uses_separate_auth_domain() {
+        let redirect_url = format!("{}/login", config.oauth_redirect_base);
+        return Ok(HttpResponse::Found()
+            .append_header(("Location", redirect_url))
+            .finish());
     }
 
     let html = LoginTemplate {

src/config.rs

···
 }
 
 impl Config {
+    /// Check if we're using a separate auth domain
+    pub fn uses_separate_auth_domain(&self) -> bool {
+        self.oauth_redirect_base != self.app_url
+    }
+
     /// Load configuration from environment variables with sensible defaults
     pub fn from_env() -> Result<Self, env::VarError> {
         // Admin DID is intentionally hardcoded as discussed
         let admin_did = "did:plc:xbtmt2zjwlrfegqvch7fboei".to_string();
 
-        Ok(Config {
+        let config = Config {
             admin_did,
             owner_handle: env::var("OWNER_HANDLE").unwrap_or_else(|_| "zzstoatzz.io".to_string()),
             database_url: env::var("DATABASE_URL")
···
                 .unwrap_or(false),
             // Default to static/emojis for local dev; override in prod to /data/emojis
             emoji_dir: env::var("EMOJI_DIR").unwrap_or_else(|_| "static/emojis".to_string()),
-        })
+        };
+
+        // Validate critical URLs at startup
+        if url::Url::parse(&config.oauth_redirect_base).is_err() {
+            log::error!(
+                "Invalid OAUTH_REDIRECT_BASE URL: {}",
+                config.oauth_redirect_base
+            );
+            panic!("Invalid OAUTH_REDIRECT_BASE URL configuration");
+        }
+        if url::Url::parse(&config.app_url).is_err() {
+            log::error!("Invalid APP_URL: {}", config.app_url);
+            panic!("Invalid APP_URL configuration");
+        }
+
+        Ok(config)
     }
 }