@cloudflare/workers-oauth-provider 0.10.3 → 0.10.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/oauth-provider.js +3 -1
- package/package.json +1 -1
package/dist/oauth-provider.js
CHANGED
|
@@ -581,6 +581,8 @@ const EMA_DEFAULT_MAX_ASSERTION_LIFETIME_SECONDS = 300;
|
|
|
581
581
|
* values to amplify load on the IdP's JWKS endpoint.
|
|
582
582
|
*/
|
|
583
583
|
const EMA_JWKS_FORCE_REFRESH_COOLDOWN_SECONDS = 30;
|
|
584
|
+
/** Floor for the `jti` replay marker's KV TTL; KV rejects a sub-60s expiration. */
|
|
585
|
+
const EMA_JTI_MIN_TTL_SECONDS = 60;
|
|
584
586
|
/** Default JWT signing algorithm assumed for a trusted issuer. */
|
|
585
587
|
const EMA_DEFAULT_JWT_ALGORITHM = "RS256";
|
|
586
588
|
/** JWT signing algorithms supported by the built-in WebCrypto verifier. */
|
|
@@ -698,7 +700,7 @@ const EMA_JTI_KV_PREFIX = "enterprise-jti:";
|
|
|
698
700
|
/** Create the default KV-backed JTI store. KV TTL handles cleanup. */
|
|
699
701
|
function createKvJtiStore() {
|
|
700
702
|
return { async markUsed({ issuer, jti, exp, now, env }) {
|
|
701
|
-
const ttl = Math.max(
|
|
703
|
+
const ttl = Math.max(EMA_JTI_MIN_TTL_SECONDS, exp - now);
|
|
702
704
|
const key = `${EMA_JTI_KV_PREFIX}${await sha256Hex(`${issuer}\n${jti}`)}`;
|
|
703
705
|
if (await env.OAUTH_KV.get(key)) return err({
|
|
704
706
|
reason: "replayed",
|