Can't host an OAuth app and a PDS on the same site

[bmillwood]

Describe the bug

I'm developing an app which uses Bluesky as an OAuth provider. My app's login page allows users to enter their Bluesky handle and click "log in". This then redirects them internally to a separate page on my app /auth/login/bluesky/start?handle=their.handle, which uses their handle to figure out their DID / PDS / authorization server, do the PAR request, and then 303 redirects them to the authorize URI so they can do the login flow.

I then see:

Forbidden sec-fetch-site header "same-site"

from (I think) oauth-provider.ts:1313.

The problem, as I eventually worked out (after some false hypotheses, see issue edit history if you're curious) is I'm self-hosting a PDS under the same domain as the OAuth app, so this is a same-site request for anyone using my PDS (admittedly currently just me).

Now, the impact of this is fairly small, but it doesn't seem so unnatural that sites invested in the Bluesky ecosystem are going to want to host both a PDS and an OAuth app, and with this check in place, they currently (as far as I can tell) can't use their own app.

I don't really understand what the Sec-Fetch-Site check is for, so I don't feel able to suggest it just be removed without learning a bit more about it first. But I'd be interested in hearing more about what it's for, so we can decide whether there's something appropriate to do here.

To Reproduce

Implement an OAuth app on the same site as your authorization server.

Expected behavior

It works (somehow).

Details

My PDS has these details:

• Operating system: Ubuntu 22.04.5
• Node version: v20.11.1

Additional context

I don't expect you to need to read my code, but it's here if you want it: https://github.com/bmillwood/flexiprocity/blob/88c2bf1346fbc1443e71e805078362e40dff0b70/auth-server/src/Bluesky.hs

[bmillwood]

I did some more research and have a different understanding of the cause of my problem now, so I've updated the issue.