@inrupt/solid-client-authn-browser 1.17.3 → 1.17.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inrupt/solid-client-authn-browser",
-  "version": "1.17.3",
+  "version": "1.17.5",
   "license": "MIT",
   "types": "dist/index.d.ts",
   "browser": "dist/index.js",
@@ -29,15 +29,15 @@
     "@types/uuid": "^9.0.4"
   },
   "dependencies": {
-    "@inrupt/oidc-client-ext": "^1.17.3",
-    "@inrupt/solid-client-authn-core": "^1.17.3",
+    "@inrupt/oidc-client-ext": "^1.17.5",
+    "@inrupt/solid-client-authn-core": "^1.17.5",
     "@inrupt/universal-fetch": "^1.0.2",
     "events": "^3.3.0",
-    "jose": "^4.14.6",
+    "jose": "^4.15.4",
     "uuid": "^9.0.1"
   },
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "ef10e8366ee8511f726b6cf5918f9e9c6653c6cc"
+  "gitHead": "a34357598cc218be116e38f66a983e391dc1d6b2"
 }

package/src/ClientAuthentication.spec.ts

@@ -493,25 +493,6 @@ describe("ClientAuthentication", () => {
       );
     });
 
-    it("clears the current IRI from OAuth query parameters in the implicit flow", async () => {
-      window.history.replaceState = jest
-        .fn<typeof window.history.replaceState>()
-        .mockImplementationOnce((_data, _unused, url) => {
-          // Pretend the current location is updated
-          window.location.href = url as string;
-        });
-      const clientAuthn = getClientAuthentication();
-      const url =
-        "https://coolapp.com/redirect?state=someState&id_token=idToken&access_token=accessToken";
-      await clientAuthn.handleIncomingRedirect(url, mockEmitter);
-      expect(window.history.replaceState).toHaveBeenCalledWith(
-        null,
-        "",
-        "https://coolapp.com/redirect",
-      );
-      expect(mockEmitter.emit).not.toHaveBeenCalled();
-    });
-
     it("preserves non-OAuth query strings", async () => {
       window.history.replaceState = jest
         .fn<typeof window.history.replaceState>()

package/src/ClientAuthentication.ts

@@ -33,8 +33,9 @@ import {
   EVENTS,
   isValidRedirectUrl,
   ClientAuthentication as ClientAuthenticationBase,
+  removeOpenIdParams,
 } from "@inrupt/solid-client-authn-core";
-import { removeOidcQueryParam } from "@inrupt/oidc-client-ext";
+import { normalizeCallbackUrl } from "@inrupt/oidc-client-ext";
 import type { EventEmitter } from "events";
 
 /**
@@ -62,7 +63,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
     // normalization only applies if we default to the current location (which is
     // a bad practice and should be discouraged).
     const redirectUrl =
-      options.redirectUrl ?? removeOidcQueryParam(window.location.href);
+      options.redirectUrl ?? normalizeCallbackUrl(window.location.href);
     if (!isValidRedirectUrl(redirectUrl)) {
       throw new Error(
         `${redirectUrl} is not a valid redirect URL, it is either a malformed IRI, includes a hash fragment, or reserved query parameters ('code' or 'state').`,
@@ -133,25 +134,15 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
   };
 
   private async cleanUrlAfterRedirect(url: string): Promise<void> {
-    const cleanedUpUrl = new URL(url);
-    cleanedUpUrl.searchParams.delete("state");
-    // For auth code flow
-    cleanedUpUrl.searchParams.delete("code");
-    // For implicit flow
-    cleanedUpUrl.searchParams.delete("id_token");
-    cleanedUpUrl.searchParams.delete("access_token");
-    // For login error
-    cleanedUpUrl.searchParams.delete("error");
-    cleanedUpUrl.searchParams.delete("error_description");
-    cleanedUpUrl.searchParams.delete("iss");
+    const cleanedUpUrl = removeOpenIdParams(url).href;
 
     // Remove OAuth-specific query params (since the login flow finishes with
     // the browser being redirected back with OAuth2 query params (e.g. for
     // 'code' and 'state'), and so if the user simply refreshes this page our
     // authentication library will be called again with what are now invalid
     // query parameters!).
-    window.history.replaceState(null, "", cleanedUpUrl.toString());
-    while (window.location.href !== cleanedUpUrl.href) {
+    window.history.replaceState(null, "", cleanedUpUrl);
+    while (window.location.href !== cleanedUpUrl) {
       // Poll the current URL every ms. Active polling is required because
       // window.history.replaceState is asynchronous, but the associated
       // 'popstate' event which should be listened to is only sent on active