@absolutejs/auth 0.52.0 → 0.52.1

package/dist/index.js

@@ -6435,6 +6435,17 @@ var jsonResponse = (value, status) => new Response(JSON.stringify(value), {
 });
 var oauthError2 = (status, error) => jsonResponse({ error }, status);
 var tokenResponse = (tokens) => jsonResponse(tokens, HTTP_OK2);
+var canonicalizeRequestUrl = (requestUrl, issuer) => {
+  try {
+    const url = new URL(requestUrl);
+    const base = new URL(issuer);
+    url.protocol = base.protocol;
+    url.host = base.host;
+    return url.toString();
+  } catch {
+    return requestUrl;
+  }
+};
 var redirectTo = (url) => new Response(null, { headers: { location: url }, status: HTTP_FOUND });
 var escapeHtmlAttr = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 var formPostResponse = (redirectUri, params) => {
@@ -6948,7 +6959,7 @@ var oidcProviderRoutes = (config) => {
       if (wantsSilent) {
         return errorRedirect(userSession === undefined ? "login_required" : "interaction_required");
       }
-      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED2) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
+      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED2) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(canonicalizeRequestUrl(request.url, issuer))}`);
     }
     const requested = scope === undefined || scope.length === 0 ? client.scopes : scope.split(" ").filter((entry) => client.scopes.includes(entry));
     if (config.consentUrl !== undefined && await config.needsConsent?.({
@@ -6960,7 +6971,7 @@ var oidcProviderRoutes = (config) => {
       user: userSession.user
     }) === true) {
       const consentTarget = new URL(config.consentUrl, issuer);
-      consentTarget.searchParams.set("return_to", request.url);
+      consentTarget.searchParams.set("return_to", canonicalizeRequestUrl(request.url, issuer));
       consentTarget.searchParams.set("client_id", client.clientId);
       consentTarget.searchParams.set("client_name", client.name);
       consentTarget.searchParams.set("scope", requested.join(" "));
@@ -28043,5 +28054,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=1C44E17EB1F4FC5164756E2164756E21
+//# debugId=9E1C46257073267B64756E2164756E21
 //# sourceMappingURL=index.js.map