more auth bugfixes

packages/client/src/render/getAppId.js

@@ -3,6 +3,8 @@ export const parseAppIdFromCookie = docCookie => {
     docCookie.split(";").find(c => c.trim().startsWith("budibase:token")) ||
     docCookie.split(";").find(c => c.trim().startsWith("builder:token"))
 
+  if (!cookie) return location.pathname.replace("/")
+
   const base64Token = cookie.substring(lengthOfKey)
 
   const user = JSON.parse(atob(base64Token.split(".")[1]))

packages/server/src/middleware/authenticated.js

@@ -34,12 +34,14 @@ module.exports = async (ctx, next) => {
 
     let appId = process.env.CLOUD ? ctx.subdomains[1] : ctx.params.appId
 
-    if (!appId) {
-      appId = ctx.referer && ctx.referer.split("/").pop()
+    // if appId can't be determined from path param or subdomain
+    if (!appId && ctx.request.headers.referer) {
+      const url = new URL(ctx.request.headers.referer)
+      // remove leading and trailing slashes from appId
+      appId = url.pathname.replace(/\//g, "")
     }
 
     ctx.user = {
-      // if appId can't be determined from path param or subdomain
       appId,
     }
     await next()