Allow cookies from all subdomains

[RubenVerborgh]

A side-effect of #793 is that the security mechanism of #526 is not just applied to the cookie-based login method, but to all login methods (WebID-TLS, WebID-OIDC). #526 rejected cookies as authentication mechanism from third-party hosts, requiring other hosts to always send a Bearer header.

However, its definition of "other hosts" did not include subdomains. For example:

• https://alice.solid.community would not be trusted by https://solid.community to send requests for https://my.self/#me

This pull request changes things such that

• https://*.solid.community is trusted by https://solid.community to send requests for https://my.self/#me
• https://my.self is trusted by https://solid.community to send requests for https://my.self/#me

This addresses breakage in 4.1.4 and 4.1.5 caused by #793 as noted by @kidehen in #793 (comment)

[kjetilk]

Doesn't using origin confuse that there may be other URIs that the hostname is extracted from than the Origin? Or am I confused for other reasons?

[RubenVerborgh]

You are right, I will change the parameter name.

[kjetilk]

OK, I think I understand what it does, and it appears sensible, but I don't understand why it does it, so I think I'll leave the approval to others.

[kidehen]

Authorization now works, as per "it just works!" interop page.
I was able to add data to @RubenVerborgh's pod in line with RWWCrew ACLs.

See confirmation tweet .

[RubenVerborgh]

I works, but I found some corner cases we are going to hit. Explanation tomorrow, I will now PR @kidehen's workaround to it (which doesn't have the corner cases).