[4.x] Fix cross-domain URL detection in multi-domain apps

[People-Sea]

Description

Fixes: #19117

Compare URL host with request()->getHost() instead of using config('app.url') prefix matching.

Visual changes

Functional changes

• Code style has been fixed by running the composer cs command.
• Changes have been tested to not break existing functionality.
• Documentation is up-to-date.

[danharrin]

Would you mind elaborating on the difference between request()->root() and request()->getHost(), and if the issue in #19024 will return?

Maybe @eslam-reda-div wants to have a look and see if this still fixes their problem

[eslam-reda-div]

Would you mind elaborating on the difference between request()->root() and request()->getHost(), and if the issue in #19024 will return?

Maybe @eslam-reda-div wants to have a look and see if this still fixes their problem

I plan to test this change across multiple runtime environments (Octane + FrankenPHP + Docker + Nginx) to make sure everything works properly.

From my initial review, this solution is better than the previous approach, as it handles multi-tenant setups, proxies, and subdomains more accurately and reliably.

I’ll share the test results once done. If any issues come up during testing, I’ll report them immediately or provide adjustments as needed.

The only important requirement is ensuring that trusted proxies are configured correctly so that request()->getHost() returns the correct host behind reverse proxies.

[People-Sea]

@danharrin
request()->root() returns full URL (https://example.com), request()->getHost() returns just the host (example.com). This fix compares hosts directly via parse_url() instead of prefix matching.
The scenario in #19024 is actually a configuration issue — reverse proxies need to forward the correct Host header, or TrustProxies needs to be configured. Most standard setups already handle this correctly.

[eslam-reda-div]

@danharrin
request()->root() returns full URL (https://example.com), request()->getHost() returns just the host (example.com). This fix compares hosts directly via parse_url() instead of prefix matching.
The scenario in #19024 is actually a configuration issue — reverse proxies need to forward the correct Host header, or TrustProxies needs to be configured. Most standard setups already handle this correctly.

I had already configured everything related to trusted proxies, but the issue would still fail in some runtime environments when multiple instances were behind a load balancer. The workaround I had implemented previously compared URLs to APP_URL, because in certain internal requests, Laravel Octane would send a different internal host than the main domain.

I’ll re-test this new fix to confirm that it correctly resolves the host internally within the runtime and that it won’t conflict with Octane. This should ensure that the host is consistently identified, even behind load balancers or in multi-instance setups.