Email-confirmation URL should be configurable

[minilikmila]

Version: 1.1.39

Describe the bug

The email confirmation (verification) URL is not configurable from the environment variable. when the user tries to verify(confirm) the email It directs to authorizer built-in page, it's ok to redirect to the default authorizer page, but it should be configurable because we need to do our business logic and redirect the URL (email-verification URL) to our page.
It should be flexible as per user needs.

Currently, the email verification URL takes AUTHORIZER_URL env value if it is provided, but we use AUTHORIZER_URL for third-party authentication by this reason we can't change the URL to use in email verification to redirect verification to our site.

Steps To Reproduce

1. signup
2. try to verify user email - email confirmation(verification)

Expected behavior

Authorizer URL that we used for third-party authentication should be configurable differently from the URL we use for email verification, forgot-password, etc. those authentication URLs like email-verification and forgot-password should be configurable from the environment variable.

• OS: ubuntu
• Browser [e.g. chrome, safari]
• Version [e.g. 22]

Additional context

[lakhansamani]

@minilikmila There are 2 ways to configure this

1. [Recommended way] Using redirect_url/redirect_uri params available for signup / magic_link/forgot_password mutations in API
2. Using APP_URL env variable.

Can you please try with above 2 approaches and let me know if that does not work.

[minilikmila]

@lakhansamani
I tried both ways, they are working well, and the issue resolved, but in email-verificatioin and magic-link, when user clicked the link at the first time it worked as intended and redirected to the given redirect_uri. but if clicked the 2nd time it redirected to the default AUTHORIZER_URI.
When click the link for the 2nd time , it not use a given redirect_uri.

[lakhansamani]

True, we need to redirect in case of failure of as well
Seems duplicate of following
#321

Thank you for sharing this.
I will fix this in upcoming releases.

[minilikmila]

@lakhansamani Okay, appreciated, Thank you for your kind and immediate response.

[canpacis]

Are there any updates on this?

[lakhansamani]

Implemented — the email verification link's redirect_uri is caller-supplied and validated against AllowedOrigins (internal/http_handlers/verify_email.go), most recently hardened as part of #686.