Hash verification fails when CDN is used

Problem

hash verification uses the server-host variable instead of the drupal-base url

Steps to reproduce

see

  public function verifyHash(string $providedHash, int $timestamp, ?string $productionHost = NULL): bool {
...
    // Use $_SERVER['HTTP_HOST'] if production host not provided.
    $host = $productionHost ?? $_SERVER['HTTP_HOST'];
    $expectedHash = $this->generateVerificationHash($host, $timestamp);
    return hash_equals($expectedHash, $providedHash);
  }

Proposed resolution

use the same production host as used in the UI when determining whether the current environment is prod - that works!