@gauts/auth 0.3.4 → 0.3.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +1 -1
  2. package/dist/adapters/next/index.d.ts +1 -1
  3. package/dist/adapters/next/index.d.ts.map +1 -1
  4. package/dist/adapters/next/index.js +6 -5
  5. package/dist/adapters/next/index.js.map +1 -1
  6. package/package.json +1 -1
package/README.md CHANGED
@@ -407,7 +407,7 @@ Result semantics:
407
407
  | `false` | `401` | Session token is missing or malformed. No API call occurred. |
408
408
  | `true` | HTTP status | `/auth/renew` was called and its `Set-Cookie` headers were copied. |
409
409
 
410
- The adapter forwards only the session cookie and the client/origin headers required for session, host, and CSRF validation. If the browser request has no `Origin` or `X-Forwarded-Host`, it derives them from the public `NextRequest` URL. Other cookies, `Authorization`, and arbitrary request headers are never forwarded. Renewal rejects redirects and times out after five seconds. `renewUrl` must point to the application's trusted private API.
410
+ The adapter forwards only the session cookie and the client/origin headers required for session, host, and CSRF validation. If `Origin` is missing and both `X-Forwarded-Proto` and `X-Forwarded-Host` were received, it reconstructs the public origin from those trusted proxy headers. It never derives public headers from the internal `NextRequest` URL. Other cookies, `Authorization`, and arbitrary request headers are never forwarded. Renewal rejects redirects and times out after five seconds. `renewUrl` must point to the application's trusted private API, and the deployment proxy must overwrite forwarded headers from untrusted clients.
411
411
 
412
412
  Protected API endpoints remain responsible for real authentication. The renewal marker is only a browser scheduling mechanism and never acts as a refresh token.
413
413
 
package/dist/adapters/next/index.d.ts CHANGED
@@ -19,6 +19,6 @@ export type NextRenewResult = {
19
19
  export type NextAuth = {
20
20
  renew(input: NextRenewInput): Promise<NextRenewResult>;
21
21
  };
22
- export declare const FORWARD_HEADERS: readonly ["cf-connecting-ip", "origin", "referer", "sec-ch-ua-platform", "sec-fetch-dest", "sec-fetch-mode", "sec-fetch-site", "sec-fetch-user", "true-client-ip", "user-agent", "x-forwarded-for", "x-forwarded-host", "x-real-ip"];
22
+ export declare const FORWARD_HEADERS: readonly ["cf-connecting-ip", "origin", "referer", "sec-ch-ua-platform", "sec-fetch-dest", "sec-fetch-mode", "sec-fetch-site", "sec-fetch-user", "true-client-ip", "user-agent", "x-forwarded-for", "x-forwarded-host", "x-forwarded-proto", "x-real-ip"];
23
23
  export declare const createNextAuth: ({ cookie, renewUrl }: NextAuthConfig) => NextAuth;
24
24
  //# sourceMappingURL=index.d.ts.map
package/dist/adapters/next/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACnB,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1D,CAAC;AAUF,eAAO,MAAM,eAAe,sOAclB,CAAC;AAqCX,eAAO,MAAM,cAAc,GAAI,sBAAsB,cAAc,KAAG,QA8DrE,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACnB,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1D,CAAC;AAUF,eAAO,MAAM,eAAe,2PAelB,CAAC;AAqCX,eAAO,MAAM,cAAc,GAAI,sBAAsB,cAAc,KAAG,QA8DrE,CAAC"}
package/dist/adapters/next/index.js CHANGED
@@ -14,6 +14,7 @@ export const FORWARD_HEADERS = [
14
14
  "user-agent",
15
15
  "x-forwarded-for",
16
16
  "x-forwarded-host",
17
+ "x-forwarded-proto",
17
18
  "x-real-ip",
18
19
  ];
19
20
  const getSetCookies = (headers) => {
@@ -32,11 +33,11 @@ const getForwardHeaders = ({ name, request, token }) => {
32
33
  headers.set(header, value);
33
34
  }
34
35
  }
35
- if (!headers.has("origin")) {
36
- headers.set("origin", request.nextUrl.origin);
37
- }
38
- if (!headers.get("x-forwarded-host")?.trim()) {
39
- headers.set("x-forwarded-host", request.nextUrl.host);
36
+ const origin = headers.get("origin")?.trim();
37
+ const host = headers.get("x-forwarded-host")?.trim();
38
+ const proto = headers.get("x-forwarded-proto")?.trim();
39
+ if (!origin && host && proto) {
40
+ headers.set("origin", `${proto}://${host}`);
40
41
  }
41
42
  return headers;
42
43
  };
package/dist/adapters/next/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACH,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,GAC5B,MAAM,yBAAyB,CAAC;AAiCjC,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,kBAAkB;IAClB,QAAQ;IACR,SAAS;IACT,oBAAoB;IACpB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,WAAW;CACL,CAAC;AAEX,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAY,EAAE;IACjD,MAAM,aAAa,GAAG,OAErB,CAAC;IAEF,IAAI,OAAO,aAAa,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAuB,EAAW,EAAE;IACjF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;IAE5D,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAkB,EAAY,EAAE;IAC7E,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,WAAW,CAAC;YACd,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,8BAA8B;SAC1C,CAAC,CAAC;IACP,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,0CAA0C;SACtD,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YAExE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO;oBACH,SAAS,EAAE,KAAK;oBAChB,QAAQ;oBACR,MAAM,EAAE,GAAG;iBACd,CAAC;YACN,CAAC;YAED,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;YAE1E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;gBAC9D,OAAO;oBACH,SAAS,EAAE,KAAK;oBAChB,QAAQ;oBACR,MAAM,EAAE,IAAI;iBACf,CAAC;YACN,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBACxC,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAChE,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC;aAC7C,CAAC,CAAC;YAEH,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACjD,CAAC;YAED,OAAO;gBACH,SAAS,EAAE,IAAI;gBACf,QAAQ;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;aACzB,CAAC;QACN,CAAC;KACJ,CAAC;AACN,CAAC,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACH,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,GAC5B,MAAM,yBAAyB,CAAC;AAiCjC,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,kBAAkB;IAClB,QAAQ;IACR,SAAS;IACT,oBAAoB;IACpB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,WAAW;CACL,CAAC;AAEX,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAY,EAAE;IACjD,MAAM,aAAa,GAAG,OAErB,CAAC;IAEF,IAAI,OAAO,aAAa,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAuB,EAAW,EAAE;IACjF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;IAE5D,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAEvD,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAkB,EAAY,EAAE;IAC7E,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,WAAW,CAAC;YACd,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,8BAA8B;SAC1C,CAAC,CAAC;IACP,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,0CAA0C;SACtD,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YAExE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO;oBACH,SAAS,EAAE,KAAK;oBAChB,QAAQ;oBACR,MAAM,EAAE,GAAG;iBACd,CAAC;YACN,CAAC;YAED,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;YAE1E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;gBAC9D,OAAO;oBACH,SAAS,EAAE,KAAK;oBAChB,QAAQ;oBACR,MAAM,EAAE,IAAI;iBACf,CAAC;YACN,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBACxC,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAChE,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC;aAC7C,CAAC,CAAC;YAEH,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACjD,CAAC;YAED,OAAO;gBACH,SAAS,EAAE,IAAI;gBACf,QAAQ;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;aACzB,CAAC;QACN,CAAC;KACJ,CAAC;AACN,CAAC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@gauts/auth",
3
- "version": "0.3.4",
3
+ "version": "0.3.5",
4
4
  "description": "Framework-agnostic password and server-side session authentication for Node.js.",
5
5
  "license": "MIT",
6
6
  "author": "GVALFER",