@everystack/auth 0.2.4 → 0.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/auth",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "JWT authentication handlers, password hashing, and React auth context",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/cookies.ts

@@ -3,7 +3,11 @@
  *
  * Access token cookie is sent on all requests (Path=/).
  * Refresh token cookie is scoped to the refresh endpoint only (Path=/api/auth/refresh).
- * Both are HttpOnly + Secure + SameSite=Lax.
+ *
+ * Access token is SameSite=Lax — it must ride top-level SSR navigations into the
+ * app. Refresh token is SameSite=Strict — it is only ever hit by XHR at its scoped
+ * path, never a navigation target, so Strict kills its CSRF surface by construction
+ * (a cross-site page can't make the browser attach it at all).
  */
 
 export const COOKIE_NAMES = {
@@ -44,7 +48,7 @@ export function serializeAuthCookies(
 
   return [
     `${COOKIE_NAMES.token}=${token}; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=${basePath}; Max-Age=${tokenMaxAge}${domain}`,
-    `${COOKIE_NAMES.refresh}=${refreshToken}; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=/api/auth/refresh; Max-Age=${refreshMaxAge}${domain}`,
+    `${COOKIE_NAMES.refresh}=${refreshToken}; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Strict; Path=/api/auth/refresh; Max-Age=${refreshMaxAge}${domain}`,
   ];
 }
 
@@ -58,7 +62,7 @@ export function clearAuthCookies(opts?: CookieOptions): string[] {
 
   return [
     `${COOKIE_NAMES.token}=; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=${basePath}; Max-Age=0${domain}`,
-    `${COOKIE_NAMES.refresh}=; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=/api/auth/refresh; Max-Age=0${domain}`,
+    `${COOKIE_NAMES.refresh}=; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Strict; Path=/api/auth/refresh; Max-Age=0${domain}`,
   ];
 }
 

package/src/index.ts

@@ -180,6 +180,32 @@ function csrfCheck(request: Request, cookies?: CookieConfig): Response | null {
   return validateCsrfOrigin(request, cookies.allowedOrigins);
 }
 
+/**
+ * Fail-closed cookie config check, run once at handler construction.
+ *
+ * Cookie-authenticated requests carry a CSRF surface (the cookie is auto-sent).
+ * The Origin allowlist is the defense-in-depth behind SameSite — and it silently
+ * no-ops when `allowedOrigins` is empty, so enabling cookies without it would turn
+ * the CSRF check off without any signal. We refuse to start instead: a misconfig
+ * dies at deploy, not silently-allows until a request happens to hit the check.
+ *
+ * The `cookies: true` shorthand cannot carry an allowlist, so it is rejected —
+ * there is no construction-time same-origin to derive. Pass an explicit allowlist
+ * or omit cookies entirely for Bearer-only (mobile/API) auth.
+ */
+function assertSafeCookieConfig(cookies: CookieConfig | undefined): void {
+  if (!cookies) return; // cookie auth disabled (false/undefined) — Bearer-only, no CSRF surface
+  const allowedOrigins = cookies === true ? undefined : cookies.allowedOrigins;
+  if (!allowedOrigins || allowedOrigins.length === 0) {
+    throw new Error(
+      '[everystack/auth] Cookie authentication is enabled but cookies.allowedOrigins is empty. '
+      + 'Cookie-authenticated requests carry a CSRF surface; an explicit Origin allowlist is '
+      + 'required. Pass cookies: { allowedOrigins: ["https://your-web-origin"] } instead of '
+      + 'cookies: true, or omit cookies for Bearer-only (mobile/API) auth.'
+    );
+  }
+}
+
 /**
  * Add mode-independent email confirmation and password management handlers.
  * Called after base handlers are created (works with both node and postgres modes).
@@ -389,6 +415,8 @@ export function createAuthHandlers(
   jwtSecret: Uint8Array,
   options?: AuthOptions
 ): AuthHandlers {
+  assertSafeCookieConfig(options?.cookies);
+
   if (options?.mode === 'postgres') {
     const handlers = createPostgresAuthHandlers(db, schema, jwtSecret, options);
     addEmailPasswordFlows(handlers, db, schema.users, options);