@inrupt/solid-client-authn-browser 1.17.1 → 1.17.3

package/src/login/oidc/oidcHandlers/AuthorizationCodeWithPkceOidcHandler.spec.ts

@@ -51,7 +51,7 @@ const expectedSigninRedirectUrl = "https://test";
 
 const mockOidcModule = (
   url: string = expectedSigninRedirectUrl,
-  state = "test state"
+  state = "test state",
 ) => {
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const oidcModule = jest.requireMock("@inrupt/oidc-client-ext") as any;
@@ -78,11 +78,11 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
   };
 
   function getAuthorizationCodeWithPkceOidcHandler(
-    mocks: Partial<typeof defaultMocks> = defaultMocks
+    mocks: Partial<typeof defaultMocks> = defaultMocks,
   ): AuthorizationCodeWithPkceOidcHandler {
     return new AuthorizationCodeWithPkceOidcHandler(
       mocks.storageUtility ?? defaultMocks.storageUtility,
-      mocks.redirector ?? defaultMocks.redirector
+      mocks.redirector ?? defaultMocks.redirector,
     );
   }
 
@@ -94,11 +94,11 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
         // eslint-disable-next-line jest/valid-title
         it(testConfig.message, async () => {
           const value = await authorizationCodeWithPkceOidcHandler.canHandle(
-            testConfig.oidcOptions
+            testConfig.oidcOptions,
           );
           expect(value).toBe(testConfig.shouldPass);
         });
-      }
+      },
     );
   });
 
@@ -110,9 +110,9 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
       mockedRedirector.mockImplementationOnce(
         (redirectUrl: string, redirectOptions: IRedirectorOptions) => {
           throw new Error(
-            `Redirecting to [${redirectUrl}] with options [${redirectOptions}] throws...`
+            `Redirecting to [${redirectUrl}] with options [${redirectOptions}] throws...`,
           );
-        }
+        },
       );
 
       const authorizationCodeWithPkceOidcHandler =
@@ -129,7 +129,7 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
       };
 
       await expect(
-        authorizationCodeWithPkceOidcHandler.handle(oidcOptions)
+        authorizationCodeWithPkceOidcHandler.handle(oidcOptions),
       ).resolves.toBeUndefined();
 
       expect(mockedRedirector).toHaveBeenCalledTimes(1);
@@ -141,7 +141,7 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
       // eslint-disable-next-line no-console
       expect(console.error).toHaveBeenCalledTimes(1);
       expect(
-        (console as jest.Mocked<Console>).error.mock.calls[0][0].toString()
+        (console as jest.Mocked<Console>).error.mock.calls[0][0].toString(),
       ).toMatch(/Error: Redirecting to \[[^\]]+\] with options/);
     });
 
@@ -161,7 +161,7 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
         expectedSigninRedirectUrl,
         {
           handleRedirect: standardOidcOptions.handleRedirect,
-        }
+        },
       );
     });
 
@@ -169,7 +169,7 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
       mockOidcModule();
       const mockedStorage = new StorageUtility(
         mockStorage({}),
-        mockStorage({})
+        mockStorage({}),
       );
       const authorizationCodeWithPkceOidcHandler =
         getAuthorizationCodeWithPkceOidcHandler({
@@ -187,12 +187,12 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
       await expect(
         mockedStorage.getForUser("mySession", "redirectUrl", {
           secure: false,
-        })
+        }),
       ).resolves.toBe("https://app.example.com?someQuery=someValue");
       await expect(
         mockedStorage.getForUser("mySession", "codeVerifier", {
           secure: false,
-        })
+        }),
       ).resolves.not.toBeNull();
     });
 
@@ -212,7 +212,7 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
       expect(oidcModule.OidcClient).toHaveBeenCalledWith(
         expect.objectContaining({
           prompt: "none",
-        })
+        }),
       );
     });
 
@@ -231,7 +231,7 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
       expect(oidcModule.OidcClient).toHaveBeenCalledWith(
         expect.objectContaining({
           prompt: "consent",
-        })
+        }),
       );
     });
 
@@ -250,7 +250,7 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
       expect(oidcModule.OidcClient).toHaveBeenCalledWith(
         expect.objectContaining({
           scope: "openid offline_access webid",
-        })
+        }),
       );
     });
 
@@ -274,7 +274,7 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
         expectedSigninRedirectUrl,
         {
           handleRedirect: standardOidcOptions.handleRedirect,
-        }
+        },
       );
     });
   });

package/src/login/oidc/refresh/TokenRefresher.spec.ts

@@ -125,7 +125,7 @@ const mockOidcModule = async (response?: TokenEndpointResponse) => {
           dpopKey: await mockKeyPair(),
           webId: mockWebId(),
         }
-      : response
+      : response,
   ) as typeof refresh;
   return oidcModule;
 };
@@ -137,12 +137,12 @@ const defaultMocks = {
 };
 
 function getTokenRefresher(
-  mocks: Partial<typeof defaultMocks> = defaultMocks
+  mocks: Partial<typeof defaultMocks> = defaultMocks,
 ): TokenRefresher {
   return new TokenRefresher(
     mocks.storageUtility ?? defaultMocks.storageUtility,
     mocks.issuerConfigFetcher ?? defaultMocks.issuerConfigFetcher,
-    mocks.clientRegistrar ?? defaultMocks.clientRegistrar
+    mocks.clientRegistrar ?? defaultMocks.clientRegistrar,
   );
 }
 
@@ -156,9 +156,9 @@ describe("TokenRefresher", () => {
       });
 
       await expect(
-        refresher.refresh("mySession", "some refresh token")
+        refresher.refresh("mySession", "some refresh token"),
       ).rejects.toThrow(
-        "Failed to retrieve OIDC context from storage associated with session [mySession]"
+        "Failed to retrieve OIDC context from storage associated with session [mySession]",
       );
     });
 
@@ -174,9 +174,9 @@ describe("TokenRefresher", () => {
       });
 
       await expect(
-        refresher.refresh("mySession", "some refresh token")
+        refresher.refresh("mySession", "some refresh token"),
       ).rejects.toThrow(
-        "Failed to retrieve OIDC context from storage associated with session [mySession]"
+        "Failed to retrieve OIDC context from storage associated with session [mySession]",
       );
     });
 
@@ -188,7 +188,7 @@ describe("TokenRefresher", () => {
       });
 
       await expect(refresher.refresh("mySession")).rejects.toThrow(
-        "Session [mySession] has no refresh token to allow it to refresh its access token."
+        "Session [mySession] has no refresh token to allow it to refresh its access token.",
       );
     });
 
@@ -200,9 +200,9 @@ describe("TokenRefresher", () => {
       });
 
       await expect(
-        refresher.refresh("mySession", "some refresh token")
+        refresher.refresh("mySession", "some refresh token"),
       ).rejects.toThrow(
-        "For session [mySession], the key bound to the DPoP access token must be provided to refresh said access token."
+        "For session [mySession], the key bound to the DPoP access token must be provided to refresh said access token.",
       );
     });
 
@@ -217,7 +217,7 @@ describe("TokenRefresher", () => {
       const result = await refresher.refresh(
         "mySession",
         "some refresh token",
-        await mockKeyPair()
+        await mockKeyPair(),
       );
       expect(oidcModule.refresh).toHaveBeenCalled();
       expect(result).toEqual({
@@ -246,11 +246,11 @@ describe("TokenRefresher", () => {
         "mySession",
         "some old refresh token",
         await mockKeyPair(),
-        mockEmitter
+        mockEmitter,
       );
       expect(mockEmit).toHaveBeenCalledWith(
         EVENTS.NEW_REFRESH_TOKEN,
-        "Some rotated refresh token"
+        "Some rotated refresh token",
       );
     });
 
@@ -268,7 +268,7 @@ describe("TokenRefresher", () => {
       const result = await refresher.refresh(
         "mySession",
         "some refresh token",
-        await mockKeyPair()
+        await mockKeyPair(),
       );
       expect(result.refreshToken).toBe("Some rotated refresh token");
     });

package/src/login/oidc/refresh/TokenRefresher.ts

@@ -51,36 +51,40 @@ export default class TokenRefresher implements ITokenRefresher {
   constructor(
     private storageUtility: IStorageUtility,
     private issuerConfigFetcher: IIssuerConfigFetcher,
-    private clientRegistrar: IClientRegistrar
-  ) {}
+    private clientRegistrar: IClientRegistrar,
+  ) {
+    this.storageUtility = storageUtility;
+    this.issuerConfigFetcher = issuerConfigFetcher;
+    this.clientRegistrar = clientRegistrar;
+  }
 
   async refresh(
     sessionId: string,
     refreshToken?: string,
     dpopKey?: KeyPair,
-    eventEmitter?: EventEmitter
+    eventEmitter?: EventEmitter,
   ): Promise<TokenEndpointResponse> {
     const oidcContext = await loadOidcContextFromStorage(
       sessionId,
       this.storageUtility,
-      this.issuerConfigFetcher
+      this.issuerConfigFetcher,
     );
     // This should also retrieve the client from storage
     const clientInfo: IClient = await this.clientRegistrar.getClient(
       { sessionId },
-      oidcContext.issuerConfig
+      oidcContext.issuerConfig,
     );
 
     if (refreshToken === undefined) {
       // TODO: in a next PR, look up storage for a refresh token
       throw new Error(
-        `Session [${sessionId}] has no refresh token to allow it to refresh its access token.`
+        `Session [${sessionId}] has no refresh token to allow it to refresh its access token.`,
       );
     }
 
     if (oidcContext.dpop && dpopKey === undefined) {
       throw new Error(
-        `For session [${sessionId}], the key bound to the DPoP access token must be provided to refresh said access token.`
+        `For session [${sessionId}], the key bound to the DPoP access token must be provided to refresh said access token.`,
       );
     }
 
@@ -88,7 +92,7 @@ export default class TokenRefresher implements ITokenRefresher {
       refreshToken,
       oidcContext.issuerConfig,
       clientInfo,
-      dpopKey
+      dpopKey,
     );
 
     if (tokenSet.refreshToken !== undefined) {

package/src/login/oidc/refresh/__mocks__/TokenRefresher.ts

@@ -29,7 +29,7 @@ import type {
 /* eslint-disable camelcase */
 
 export const mockTokenRefresher = (
-  tokenSet: TokenEndpointResponse
+  tokenSet: TokenEndpointResponse,
 ): ITokenRefresher => {
   return {
     refresh: jest.fn<ITokenRefresher["refresh"]>().mockResolvedValue(tokenSet),

package/src/sessionInfo/SessionInfoManager.spec.ts

@@ -47,10 +47,10 @@ describe("SessionInfoManager", () => {
   };
 
   function getSessionInfoManager(
-    mocks: Partial<typeof defaultMocks> = defaultMocks
+    mocks: Partial<typeof defaultMocks> = defaultMocks,
   ): SessionInfoManager {
     const sessionManager = new SessionInfoManager(
-      mocks.storageUtility ?? defaultMocks.storageUtility
+      mocks.storageUtility ?? defaultMocks.storageUtility,
     );
     return sessionManager;
   }
@@ -59,7 +59,7 @@ describe("SessionInfoManager", () => {
     it("is not implemented yet", async () => {
       const sessionManager = getSessionInfoManager();
       await expect(async () =>
-        sessionManager.update("commanderCool", {})
+        sessionManager.update("commanderCool", {}),
       ).rejects.toThrow("Not Implemented");
     });
   });
@@ -68,7 +68,7 @@ describe("SessionInfoManager", () => {
     it("is not implemented yet", async () => {
       const sessionManager = getSessionInfoManager();
       await expect(async () =>
-        sessionManager.register("commanderCool")
+        sessionManager.register("commanderCool"),
       ).rejects.toThrow("Not implemented");
     });
   });
@@ -77,7 +77,7 @@ describe("SessionInfoManager", () => {
     it("is not implemented yet", async () => {
       const sessionManager = getSessionInfoManager();
       await expect(async () =>
-        sessionManager.getRegisteredSessionIdAll()
+        sessionManager.getRegisteredSessionIdAll(),
       ).rejects.toThrow("Not implemented");
     });
   });
@@ -86,7 +86,7 @@ describe("SessionInfoManager", () => {
     it("is not implemented yet", async () => {
       const sessionManager = getSessionInfoManager();
       await expect(async () => sessionManager.clearAll()).rejects.toThrow(
-        "Not implemented"
+        "Not implemented",
       );
     });
   });
@@ -113,7 +113,7 @@ describe("SessionInfoManager", () => {
             issuer: "https://some.issuer",
             tokenType: "DPoP",
           },
-        })
+        }),
       );
 
       const sessionManager = getSessionInfoManager({
@@ -141,7 +141,7 @@ describe("SessionInfoManager", () => {
             isLoggedIn: "false",
           },
         }),
-        mockStorage({})
+        mockStorage({}),
       );
 
       const sessionManager = getSessionInfoManager({
@@ -161,6 +161,28 @@ describe("SessionInfoManager", () => {
       });
     });
 
+    it("returns undefined and clears storage if the redirect URL is invalid", async () => {
+      const sessionId = "commanderCool";
+      const storageMock = new StorageUtility(
+        mockStorage({}),
+        mockStorage({
+          [`solidClientAuthenticationUser:${sessionId}`]: {
+            // The state query parameter is reserved in OpenID.
+            redirectUrl: "https://client.example.org/callback?state=1234",
+          },
+        }),
+      );
+      const spiedClear = jest.spyOn(storageMock, "deleteAllUserData");
+      const sessionManager = getSessionInfoManager({
+        storageUtility: storageMock,
+      });
+
+      const session = await sessionManager.get(sessionId);
+      expect(session).toBeUndefined();
+      expect(spiedClear).toHaveBeenCalledWith(sessionId, { secure: false });
+      expect(spiedClear).toHaveBeenCalledWith(sessionId, { secure: true });
+    });
+
     it("returns undefined if the specified storage does not contain the user", async () => {
       const sessionManager = getSessionInfoManager({
         storageUtility: mockStorageUtility({}, true),
@@ -186,14 +208,14 @@ describe("SessionInfoManager", () => {
             issuer: "https://my.idp",
             tokenType: "Some arbitrary token type",
           },
-        })
+        }),
       );
 
       const sessionManager = getSessionInfoManager({
         storageUtility: storageMock,
       });
       await expect(sessionManager.get(sessionId)).rejects.toThrow(
-        "Tokens of type [Some arbitrary token type] are not supported."
+        "Tokens of type [Some arbitrary token type] are not supported.",
       );
     });
 
@@ -214,7 +236,7 @@ describe("SessionInfoManager", () => {
           [`solidClientAuthenticationUser:${sessionId}`]: {
             issuer: "https://my.idp",
           },
-        })
+        }),
       );
 
       const sessionManager = getSessionInfoManager({
@@ -247,14 +269,14 @@ describe("SessionInfoManager", () => {
             key: "value",
           },
         },
-        true
+        true,
       );
       const sessionManager = getSessionInfoManager({
         storageUtility: mockedStorage,
       });
       await sessionManager.clear("mySession");
       expect(
-        await mockedStorage.getForUser("mySession", "key", { secure: true })
+        await mockedStorage.getForUser("mySession", "key", { secure: true }),
       ).toBeUndefined();
     });
 
@@ -265,14 +287,14 @@ describe("SessionInfoManager", () => {
             key: "value",
           },
         },
-        false
+        false,
       );
       const sessionManager = getSessionInfoManager({
         storageUtility: mockedStorage,
       });
       await sessionManager.clear("mySession");
       expect(
-        await mockedStorage.getForUser("mySession", "key", { secure: false })
+        await mockedStorage.getForUser("mySession", "key", { secure: false }),
       ).toBeUndefined();
     });
   });

package/src/sessionInfo/SessionInfoManager.ts

@@ -34,6 +34,7 @@ import {
   isSupportedTokenType,
   clear as clearBase,
   SessionInfoManagerBase,
+  isValidRedirectUrl,
 } from "@inrupt/solid-client-authn-core";
 import { clearOidcPersistentStorage } from "@inrupt/oidc-client-ext";
 
@@ -46,7 +47,7 @@ export { getUnauthenticatedSession } from "@inrupt/solid-client-authn-core";
  */
 export async function clear(
   sessionId: string,
-  storage: IStorageUtility
+  storage: IStorageUtility,
 ): Promise<void> {
   await clearBase(sessionId, storage);
   await clearOidcPersistentStorage();
@@ -60,62 +61,56 @@ export class SessionInfoManager
   implements ISessionInfoManager
 {
   async get(
-    sessionId: string
+    sessionId: string,
   ): Promise<(ISessionInfo & ISessionInternalInfo) | undefined> {
-    const isLoggedIn = await this.storageUtility.getForUser(
-      sessionId,
-      "isLoggedIn",
-      {
+    const [
+      isLoggedIn,
+      webId,
+      clientId,
+      clientSecret,
+      redirectUrl,
+      refreshToken,
+      issuer,
+      tokenType,
+    ] = await Promise.all([
+      this.storageUtility.getForUser(sessionId, "isLoggedIn", {
         secure: true,
-      }
-    );
-
-    const webId = await this.storageUtility.getForUser(sessionId, "webId", {
-      secure: true,
-    });
-
-    const clientId = await this.storageUtility.getForUser(
-      sessionId,
-      "clientId",
-      {
+      }),
+      this.storageUtility.getForUser(sessionId, "webId", {
+        secure: true,
+      }),
+      this.storageUtility.getForUser(sessionId, "clientId", {
         secure: false,
-      }
-    );
-
-    const clientSecret = await this.storageUtility.getForUser(
-      sessionId,
-      "clientSecret",
-      {
+      }),
+      this.storageUtility.getForUser(sessionId, "clientSecret", {
         secure: false,
-      }
-    );
-
-    const redirectUrl = await this.storageUtility.getForUser(
-      sessionId,
-      "redirectUrl",
-      {
+      }),
+      this.storageUtility.getForUser(sessionId, "redirectUrl", {
         secure: false,
-      }
-    );
-
-    const refreshToken = await this.storageUtility.getForUser(
-      sessionId,
-      "refreshToken",
-      {
+      }),
+      this.storageUtility.getForUser(sessionId, "refreshToken", {
         secure: true,
-      }
-    );
-
-    const issuer = await this.storageUtility.getForUser(sessionId, "issuer", {
-      secure: false,
-    });
-
-    const tokenType =
-      (await this.storageUtility.getForUser(sessionId, "tokenType", {
+      }),
+      this.storageUtility.getForUser(sessionId, "issuer", {
+        secure: false,
+      }),
+      this.storageUtility.getForUser(sessionId, "tokenType", {
         secure: false,
-      })) ?? "DPoP";
+      }),
+    ]);
+
+    if (typeof redirectUrl === "string" && !isValidRedirectUrl(redirectUrl)) {
+      // This resolves the issue for people experiencing https://github.com/inrupt/solid-client-authn-js/issues/2891.
+      // An invalid redirect URL is present in the storage, and the session should
+      // be cleared to get a fresh start. This will require the user to log back in.
+      await Promise.all([
+        this.storageUtility.deleteAllUserData(sessionId, { secure: false }),
+        this.storageUtility.deleteAllUserData(sessionId, { secure: true }),
+      ]);
+      return undefined;
+    }
 
-    if (!isSupportedTokenType(tokenType)) {
+    if (tokenType !== undefined && !isSupportedTokenType(tokenType)) {
       throw new Error(`Tokens of type [${tokenType}] are not supported.`);
     }
 
@@ -137,7 +132,8 @@ export class SessionInfoManager
       issuer,
       clientAppId: clientId,
       clientAppSecret: clientSecret,
-      tokenType,
+      // Default the token type to DPoP if unspecified.
+      tokenType: tokenType ?? "DPoP",
     };
   }
 

package/src/sessionInfo/__mocks__/SessionInfoManager.ts

@@ -40,10 +40,10 @@ export const SessionCreatorGetSessionResponse: ISessionInfo &
 
 export const SessionInfoManagerMock: jest.Mocked<ISessionInfoManager> = {
   update: jest.fn(
-    async (_sessionId: string, _options: ISessionInfoManagerOptions) => {}
+    async (_sessionId: string, _options: ISessionInfoManagerOptions) => {},
   ),
   get: jest.fn(async (_sessionId: string) =>
-    Promise.resolve(SessionCreatorCreateResponse)
+    Promise.resolve(SessionCreatorCreateResponse),
   ),
   getAll: jest.fn(async () => Promise.resolve([SessionCreatorCreateResponse])),
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -55,7 +55,7 @@ export const SessionInfoManagerMock: jest.Mocked<ISessionInfoManager> = {
 } as any;
 
 export function mockSessionInfoManager(
-  storageUtility: IStorageUtility
+  storageUtility: IStorageUtility,
 ): ISessionInfoManager {
   return new SessionInfoManager(storageUtility);
 }