@nifrajs/auth 3.5.0 → 4.0.2

package/dist/csrf.d.ts

@@ -4,12 +4,12 @@
  * a cross-origin or same-origin *unsafe* request; it must match an allowed origin, else `403`. Safe
  * methods (GET/HEAD/OPTIONS) pass. Apply with `app.use(csrf({ origins: ["https://example.com"] }))`.
  */
-import type { Middleware } from "@nifrajs/core/server";
+import { type Middleware } from "@nifrajs/core/server";
 export interface CsrfOptions {
     /**
-     * Allowed origins (e.g. `["https://example.com"]`). **Set this in production behind a proxy** - when
-     * omitted, the check derives same-origin from the request URL, which is correct in dev / when the
-     * proxy preserves `Host` but not when the public origin differs from the worker's.
+     * Allowed origins (e.g. `["https://example.com"]`). When omitted, the request must be same-origin by
+     * host (an `https:` page reaching an `http:` request URL is accepted, so a TLS-terminating proxy
+     * works). Set it when the proxy rewrites `Host`, so the public origin differs from the worker's.
      */
     readonly origins?: readonly string[];
 }

package/dist/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAItD,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAKD,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,UAAU,CA2B1D"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAQ3E,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAKD,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,UAAU,CA+B1D"}

package/dist/csrf.js

@@ -1,16 +1,29 @@
+/**
+ * CSRF protection via an **Origin / Referer check** on state-changing requests - OWASP's recommended
+ * defense for cookie-authenticated apps. A browser always attaches `Origin` (or at least `Referer`) to
+ * a cross-origin or same-origin *unsafe* request; it must match an allowed origin, else `403`. Safe
+ * methods (GET/HEAD/OPTIONS) pass. Apply with `app.use(csrf({ origins: ["https://example.com"] }))`.
+ */
+import { isSameOriginRequest } from "@nifrajs/core/server";
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+// A name per instance: `use()` skips a name it already applied, which would drop a second, stricter
+// `csrf()` inside a `group()`.
+let instances = 0;
 const forbidden = () => Response.json({ ok: false, error: "csrf_failed" }, { status: 403 });
 export function csrf(options = {}) {
     const configured = options.origins !== undefined ? new Set(options.origins) : undefined;
+    instances += 1;
     return {
-        name: "csrf",
+        name: `csrf#${instances}`,
         onRequest(req) {
             if (SAFE_METHODS.has(req.method))
                 return undefined;
-            const allowed = configured ?? new Set([new URL(req.url).origin]);
+            // The same-origin default uses core's check, which accepts an `https:` page reaching an `http:`
+            // request URL on the same host - what every TLS-terminating proxy looks like from here.
+            const allowed = (candidate) => configured !== undefined ? configured.has(candidate) : isSameOriginRequest(candidate, req);
             const origin = req.headers.get("origin");
             if (origin !== null)
-                return allowed.has(origin) ? undefined : forbidden();
+                return allowed(origin) ? undefined : forbidden();
             // Some same-origin requests omit `Origin` - fall back to the `Referer`'s origin.
             const referer = req.headers.get("referer");
             if (referer !== null) {
@@ -21,7 +34,7 @@ export function csrf(options = {}) {
                 catch {
                     return forbidden(); // malformed Referer
                 }
-                return allowed.has(refererOrigin) ? undefined : forbidden();
+                return allowed(refererOrigin) ? undefined : forbidden();
             }
             // A state-changing request with neither header → reject (fail closed; a browser always sends one).
             return forbidden();

package/dist/csrf.js.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAQA,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAWxD,MAAM,SAAS,GAAG,GAAa,EAAE,CAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AAErE,MAAM,UAAU,IAAI,CAAC,UAAuB,EAAE;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACvF,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,CAAC,GAAG;YACX,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAA;YAClD,MAAM,OAAO,GAAG,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAEhE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACxC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;YAEzE,iFAAiF;YACjF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAC1C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,IAAI,aAAqB,CAAA;gBACzB,IAAI,CAAC;oBACH,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;gBACzC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,SAAS,EAAE,CAAA,CAAC,oBAAoB;gBACzC,CAAC;gBACD,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;YAC7D,CAAC;YAED,mGAAmG;YACnG,OAAO,SAAS,EAAE,CAAA;QACpB,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,mBAAmB,EAAmB,MAAM,sBAAsB,CAAA;AAE3E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAExD,oGAAoG;AACpG,+BAA+B;AAC/B,IAAI,SAAS,GAAG,CAAC,CAAA;AAWjB,MAAM,SAAS,GAAG,GAAa,EAAE,CAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AAErE,MAAM,UAAU,IAAI,CAAC,UAAuB,EAAE;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACvF,SAAS,IAAI,CAAC,CAAA;IACd,OAAO;QACL,IAAI,EAAE,QAAQ,SAAS,EAAE;QACzB,SAAS,CAAC,GAAG;YACX,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAA;YAClD,gGAAgG;YAChG,wFAAwF;YACxF,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAW,EAAE,CAC7C,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;YAE5F,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACxC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;YAErE,iFAAiF;YACjF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAC1C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,IAAI,aAAqB,CAAA;gBACzB,IAAI,CAAC;oBACH,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;gBACzC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,SAAS,EAAE,CAAA,CAAC,oBAAoB;gBACzC,CAAC;gBACD,OAAO,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;YACzD,CAAC;YAED,mGAAmG;YACnG,OAAO,SAAS,EAAE,CAAA;QACpB,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/auth",
-  "version": "3.5.0",
+  "version": "4.0.2",
   "description": "Session primitives for nifra - signed-cookie + server-store sessions, CSRF, and route guards. Bring your own identity (Better Auth / Lucia / OAuth); nifra owns the session.",
   "keywords": [
     "bun",
@@ -14,6 +14,9 @@
     "route-guards"
   ],
   "type": "module",
+  "nifra": {
+    "environment": "library"
+  },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -37,7 +40,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@nifrajs/core": "^3.5.0"
+    "@nifrajs/core": "^4.0.2"
   },
   "devDependencies": {
     "@nifrajs/core": "workspace:*"

package/src/csrf.ts

@@ -4,15 +4,19 @@
  * a cross-origin or same-origin *unsafe* request; it must match an allowed origin, else `403`. Safe
  * methods (GET/HEAD/OPTIONS) pass. Apply with `app.use(csrf({ origins: ["https://example.com"] }))`.
  */
-import type { Middleware } from "@nifrajs/core/server"
+import { isSameOriginRequest, type Middleware } from "@nifrajs/core/server"
 
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"])
 
+// A name per instance: `use()` skips a name it already applied, which would drop a second, stricter
+// `csrf()` inside a `group()`.
+let instances = 0
+
 export interface CsrfOptions {
   /**
-   * Allowed origins (e.g. `["https://example.com"]`). **Set this in production behind a proxy** - when
-   * omitted, the check derives same-origin from the request URL, which is correct in dev / when the
-   * proxy preserves `Host` but not when the public origin differs from the worker's.
+   * Allowed origins (e.g. `["https://example.com"]`). When omitted, the request must be same-origin by
+   * host (an `https:` page reaching an `http:` request URL is accepted, so a TLS-terminating proxy
+   * works). Set it when the proxy rewrites `Host`, so the public origin differs from the worker's.
    */
   readonly origins?: readonly string[]
 }
@@ -22,14 +26,18 @@ const forbidden = (): Response =>
 
 export function csrf(options: CsrfOptions = {}): Middleware {
   const configured = options.origins !== undefined ? new Set(options.origins) : undefined
+  instances += 1
   return {
-    name: "csrf",
+    name: `csrf#${instances}`,
     onRequest(req) {
       if (SAFE_METHODS.has(req.method)) return undefined
-      const allowed = configured ?? new Set([new URL(req.url).origin])
+      // The same-origin default uses core's check, which accepts an `https:` page reaching an `http:`
+      // request URL on the same host - what every TLS-terminating proxy looks like from here.
+      const allowed = (candidate: string): boolean =>
+        configured !== undefined ? configured.has(candidate) : isSameOriginRequest(candidate, req)
 
       const origin = req.headers.get("origin")
-      if (origin !== null) return allowed.has(origin) ? undefined : forbidden()
+      if (origin !== null) return allowed(origin) ? undefined : forbidden()
 
       // Some same-origin requests omit `Origin` - fall back to the `Referer`'s origin.
       const referer = req.headers.get("referer")
@@ -40,7 +48,7 @@ export function csrf(options: CsrfOptions = {}): Middleware {
         } catch {
           return forbidden() // malformed Referer
         }
-        return allowed.has(refererOrigin) ? undefined : forbidden()
+        return allowed(refererOrigin) ? undefined : forbidden()
       }
 
       // A state-changing request with neither header → reject (fail closed; a browser always sends one).