3749299 - Post-Login Redirect Uses Internal Domain Instead of CDN Domain in OAuth2 Authorization Code Flow

After the Framework Update, you noticed that during the OAuth2 Authorization Code flow, the Location header returned by POST /authorizationserver/login contains the internal SAP Commerce Cloud domain instead of the public CDN storefront domain passed via the X-Forwarded-Host request header.

All other steps in the flow including GET /authorize redirects and Access-Control-Allow-Origin CORS headers correctly reflect the public domain. Only the post-login redirect is affected.

SAP Commerce Cloud JDK21

OAuth2 Authorization Code Flow, CDN, Internal Domain , KBA , CEC-SCC-PLA-PL , Platform , Problem