@nihplod/sso-sdk 1.1.0 → 1.2.1

package/dist/next/index.d.mts

@@ -61,6 +61,18 @@ interface SsoMiddlewareConfig {
     returnUrlCookieName?: string;
     /** PKCE Verifier Cookie 名称，默认 __Secure-nihplod_sso_verifier */
     verifierCookieName?: string;
+    /**
+     * 本地 HTTP 开发模式（默认 false）。
+     *
+     * ⚠️ 仅限 http://localhost 开发：关闭 Cookie 的 Secure 属性并去除
+     * __Host-/__Secure- 前缀（浏览器拒绝在 HTTP 下写入带这两个前缀的 Cookie，
+     * 否则会出现「登录后 cookie 写不进去 → middleware 永远判定未登录 →
+     * 反复跳 SSO」的无限重定向）。开启时启动告警；生产环境严禁启用——
+     * 生产环境（NODE_ENV=production 且 ssoBaseUrl 为 https）下该开关会被
+     * 强制忽略并告警，仍走 secure cookie。
+     * middleware / callback / logout 三处配置需保持一致。
+     */
+    insecureLocalDev?: boolean;
 }
 declare function createSsoMiddleware(config: SsoMiddlewareConfig): (request: NextRequest) => Promise<NextResponse<unknown>>;
 
@@ -115,6 +127,14 @@ interface CallbackRouteConfig {
     returnUrlCookieName?: string;
     /** PKCE Verifier Cookie 名称，默认 __Secure-nihplod_sso_verifier */
     verifierCookieName?: string;
+    /**
+     * 本地 HTTP 开发模式（默认 false）。关闭 Cookie 的 Secure 属性并去除
+     * __Host-/__Secure- 前缀；必须与 createSsoMiddleware 的配置保持一致，
+     * 否则读不到 middleware 写入的 state/verifier Cookie。生产严禁启用——
+     * 生产环境（NODE_ENV=production 且 ssoBaseUrl 为 https）下该开关会被
+     * 强制忽略并告警。
+     */
+    insecureLocalDev?: boolean;
 }
 declare function createCallbackRouteHandler(config: CallbackRouteConfig): (request: NextRequest) => Promise<NextResponse<unknown>>;
 
@@ -176,6 +196,13 @@ interface LogoutRouteConfig {
     callbackPath?: string;
     /** Logout State Cookie 名称（RP-Initiated Logout CSRF 防护），默认 __Host-nihplod_sso_logout_state */
     logoutStateCookieName?: string;
+    /**
+     * 本地 HTTP 开发模式（默认 false）。关闭 Cookie 的 Secure 属性并去除
+     * __Host-/__Secure- 前缀；必须与 middleware / callback 的配置保持一致，
+     * 否则无法清除它们写入的 Cookie。生产严禁启用——生产环境
+     * （NODE_ENV=production 且 ssoBaseUrl 为 https）下该开关会被强制忽略并告警。
+     */
+    insecureLocalDev?: boolean;
 }
 declare function createLogoutRouteHandler(config: LogoutRouteConfig): (request: NextRequest) => Promise<NextResponse<unknown>>;
 
@@ -196,21 +223,27 @@ declare const DEFAULT_STATE_COOKIE_NAME = "__Host-nihplod_sso_state";
 declare const DEFAULT_RETURN_COOKIE_NAME = "__Host-nihplod_sso_return";
 declare const DEFAULT_VERIFIER_COOKIE_NAME = "__Secure-nihplod_sso_verifier";
 declare const DEFAULT_LOGOUT_STATE_COOKIE_NAME = "__Host-nihplod_sso_logout_state";
+/**
+ * insecureLocalDev 场景：去除 __Host-/__Secure- 前缀。
+ * 浏览器强制要求带这两个前缀的 Cookie 必须设置 Secure，
+ * HTTP 本地开发时若保留前缀，即使 secure=false 也会被拒绝写入。
+ */
+declare function toInsecureCookieName(name: string): string;
 /** __Host- 前缀 Cookie 的安全选项（Path 必须为 /） */
-declare function getHostCookieOptions(maxAge?: number): {
+declare function getHostCookieOptions(maxAge?: number, secure?: boolean): {
     httpOnly: true;
-    secure: true;
+    secure: boolean;
     sameSite: "lax";
     path: "/";
     maxAge?: number;
 };
 /** __Secure- 前缀 Cookie 的安全选项（允许自定义 Path） */
-declare function getSecureCookieOptions(maxAge?: number, path?: string): {
+declare function getSecureCookieOptions(maxAge?: number, path?: string, secure?: boolean): {
     httpOnly: true;
-    secure: true;
+    secure: boolean;
     sameSite: "lax";
     path: string;
     maxAge?: number;
 };
 
-export { type CallbackRouteConfig, DEFAULT_ACCESS_TOKEN_COOKIE_NAME, DEFAULT_ID_TOKEN_COOKIE_NAME, DEFAULT_LOGOUT_STATE_COOKIE_NAME, DEFAULT_REFRESH_TOKEN_COOKIE_NAME, DEFAULT_RETURN_COOKIE_NAME, DEFAULT_STATE_COOKIE_NAME, DEFAULT_VERIFIER_COOKIE_NAME, type LogoutRouteConfig, type SsoMiddlewareConfig, createCallbackRouteHandler, createLogoutRouteHandler, createSsoMiddleware, getHostCookieOptions, getSecureCookieOptions };
+export { type CallbackRouteConfig, DEFAULT_ACCESS_TOKEN_COOKIE_NAME, DEFAULT_ID_TOKEN_COOKIE_NAME, DEFAULT_LOGOUT_STATE_COOKIE_NAME, DEFAULT_REFRESH_TOKEN_COOKIE_NAME, DEFAULT_RETURN_COOKIE_NAME, DEFAULT_STATE_COOKIE_NAME, DEFAULT_VERIFIER_COOKIE_NAME, type LogoutRouteConfig, type SsoMiddlewareConfig, createCallbackRouteHandler, createLogoutRouteHandler, createSsoMiddleware, getHostCookieOptions, getSecureCookieOptions, toInsecureCookieName };

package/dist/next/index.d.ts

@@ -61,6 +61,18 @@ interface SsoMiddlewareConfig {
     returnUrlCookieName?: string;
     /** PKCE Verifier Cookie 名称，默认 __Secure-nihplod_sso_verifier */
     verifierCookieName?: string;
+    /**
+     * 本地 HTTP 开发模式（默认 false）。
+     *
+     * ⚠️ 仅限 http://localhost 开发：关闭 Cookie 的 Secure 属性并去除
+     * __Host-/__Secure- 前缀（浏览器拒绝在 HTTP 下写入带这两个前缀的 Cookie，
+     * 否则会出现「登录后 cookie 写不进去 → middleware 永远判定未登录 →
+     * 反复跳 SSO」的无限重定向）。开启时启动告警；生产环境严禁启用——
+     * 生产环境（NODE_ENV=production 且 ssoBaseUrl 为 https）下该开关会被
+     * 强制忽略并告警，仍走 secure cookie。
+     * middleware / callback / logout 三处配置需保持一致。
+     */
+    insecureLocalDev?: boolean;
 }
 declare function createSsoMiddleware(config: SsoMiddlewareConfig): (request: NextRequest) => Promise<NextResponse<unknown>>;
 
@@ -115,6 +127,14 @@ interface CallbackRouteConfig {
     returnUrlCookieName?: string;
     /** PKCE Verifier Cookie 名称，默认 __Secure-nihplod_sso_verifier */
     verifierCookieName?: string;
+    /**
+     * 本地 HTTP 开发模式（默认 false）。关闭 Cookie 的 Secure 属性并去除
+     * __Host-/__Secure- 前缀；必须与 createSsoMiddleware 的配置保持一致，
+     * 否则读不到 middleware 写入的 state/verifier Cookie。生产严禁启用——
+     * 生产环境（NODE_ENV=production 且 ssoBaseUrl 为 https）下该开关会被
+     * 强制忽略并告警。
+     */
+    insecureLocalDev?: boolean;
 }
 declare function createCallbackRouteHandler(config: CallbackRouteConfig): (request: NextRequest) => Promise<NextResponse<unknown>>;
 
@@ -176,6 +196,13 @@ interface LogoutRouteConfig {
     callbackPath?: string;
     /** Logout State Cookie 名称（RP-Initiated Logout CSRF 防护），默认 __Host-nihplod_sso_logout_state */
     logoutStateCookieName?: string;
+    /**
+     * 本地 HTTP 开发模式（默认 false）。关闭 Cookie 的 Secure 属性并去除
+     * __Host-/__Secure- 前缀；必须与 middleware / callback 的配置保持一致，
+     * 否则无法清除它们写入的 Cookie。生产严禁启用——生产环境
+     * （NODE_ENV=production 且 ssoBaseUrl 为 https）下该开关会被强制忽略并告警。
+     */
+    insecureLocalDev?: boolean;
 }
 declare function createLogoutRouteHandler(config: LogoutRouteConfig): (request: NextRequest) => Promise<NextResponse<unknown>>;
 
@@ -196,21 +223,27 @@ declare const DEFAULT_STATE_COOKIE_NAME = "__Host-nihplod_sso_state";
 declare const DEFAULT_RETURN_COOKIE_NAME = "__Host-nihplod_sso_return";
 declare const DEFAULT_VERIFIER_COOKIE_NAME = "__Secure-nihplod_sso_verifier";
 declare const DEFAULT_LOGOUT_STATE_COOKIE_NAME = "__Host-nihplod_sso_logout_state";
+/**
+ * insecureLocalDev 场景：去除 __Host-/__Secure- 前缀。
+ * 浏览器强制要求带这两个前缀的 Cookie 必须设置 Secure，
+ * HTTP 本地开发时若保留前缀，即使 secure=false 也会被拒绝写入。
+ */
+declare function toInsecureCookieName(name: string): string;
 /** __Host- 前缀 Cookie 的安全选项（Path 必须为 /） */
-declare function getHostCookieOptions(maxAge?: number): {
+declare function getHostCookieOptions(maxAge?: number, secure?: boolean): {
     httpOnly: true;
-    secure: true;
+    secure: boolean;
     sameSite: "lax";
     path: "/";
     maxAge?: number;
 };
 /** __Secure- 前缀 Cookie 的安全选项（允许自定义 Path） */
-declare function getSecureCookieOptions(maxAge?: number, path?: string): {
+declare function getSecureCookieOptions(maxAge?: number, path?: string, secure?: boolean): {
     httpOnly: true;
-    secure: true;
+    secure: boolean;
     sameSite: "lax";
     path: string;
     maxAge?: number;
 };
 
-export { type CallbackRouteConfig, DEFAULT_ACCESS_TOKEN_COOKIE_NAME, DEFAULT_ID_TOKEN_COOKIE_NAME, DEFAULT_LOGOUT_STATE_COOKIE_NAME, DEFAULT_REFRESH_TOKEN_COOKIE_NAME, DEFAULT_RETURN_COOKIE_NAME, DEFAULT_STATE_COOKIE_NAME, DEFAULT_VERIFIER_COOKIE_NAME, type LogoutRouteConfig, type SsoMiddlewareConfig, createCallbackRouteHandler, createLogoutRouteHandler, createSsoMiddleware, getHostCookieOptions, getSecureCookieOptions };
+export { type CallbackRouteConfig, DEFAULT_ACCESS_TOKEN_COOKIE_NAME, DEFAULT_ID_TOKEN_COOKIE_NAME, DEFAULT_LOGOUT_STATE_COOKIE_NAME, DEFAULT_REFRESH_TOKEN_COOKIE_NAME, DEFAULT_RETURN_COOKIE_NAME, DEFAULT_STATE_COOKIE_NAME, DEFAULT_VERIFIER_COOKIE_NAME, type LogoutRouteConfig, type SsoMiddlewareConfig, createCallbackRouteHandler, createLogoutRouteHandler, createSsoMiddleware, getHostCookieOptions, getSecureCookieOptions, toInsecureCookieName };

package/dist/next/index.js

@@ -31,7 +31,8 @@ __export(next_exports, {
   createLogoutRouteHandler: () => createLogoutRouteHandler,
   createSsoMiddleware: () => createSsoMiddleware,
   getHostCookieOptions: () => getHostCookieOptions,
-  getSecureCookieOptions: () => getSecureCookieOptions
+  getSecureCookieOptions: () => getSecureCookieOptions,
+  toInsecureCookieName: () => toInsecureCookieName
 });
 module.exports = __toCommonJS(next_exports);
 
@@ -46,19 +47,35 @@ var DEFAULT_STATE_COOKIE_NAME = "__Host-nihplod_sso_state";
 var DEFAULT_RETURN_COOKIE_NAME = "__Host-nihplod_sso_return";
 var DEFAULT_VERIFIER_COOKIE_NAME = "__Secure-nihplod_sso_verifier";
 var DEFAULT_LOGOUT_STATE_COOKIE_NAME = "__Host-nihplod_sso_logout_state";
-function getHostCookieOptions(maxAge) {
+function toInsecureCookieName(name) {
+  return name.replace(/^__(Host|Secure)-/, "");
+}
+function resolveInsecureLocalDev(enabled, ssoBaseUrl) {
+  if (!enabled) return false;
+  if (process.env.NODE_ENV === "production" && /^https:\/\//i.test(ssoBaseUrl)) {
+    console.warn(
+      "[SSO SDK] insecureLocalDev=true \u5DF2\u88AB\u5FFD\u7565\uFF1A\u5F53\u524D\u4E3A\u751F\u4EA7\u73AF\u5883\uFF08NODE_ENV=production\uFF09\u4E14 ssoBaseUrl \u4F7F\u7528 HTTPS\uFF0CCookie \u4ECD\u4FDD\u6301 Secure \u5C5E\u6027\u4E0E __Host-/__Secure- \u524D\u7F00\u3002\u8BF7\u4ECE\u751F\u4EA7\u914D\u7F6E\u4E2D\u79FB\u9664\u8BE5\u5F00\u5173\u3002"
+    );
+    return false;
+  }
+  console.warn(
+    "[SSO SDK] insecureLocalDev=true\uFF1ACookie \u7684 Secure \u5C5E\u6027\u5DF2\u5173\u95ED\u4E14\u53BB\u9664 __Host-/__Secure- \u524D\u7F00\u3002\u4EC5\u9650 http://localhost \u672C\u5730\u5F00\u53D1\u4F7F\u7528\uFF0C\u751F\u4EA7\u73AF\u5883\u5FC5\u987B\u79FB\u9664\u8BE5\u914D\u7F6E\uFF08\u751F\u4EA7\u5FC5\u987B\u7528 HTTPS\uFF09\u3002"
+  );
+  return true;
+}
+function getHostCookieOptions(maxAge, secure = true) {
   return {
     httpOnly: true,
-    secure: true,
+    secure,
     sameSite: "lax",
     path: "/",
     ...maxAge !== void 0 ? { maxAge } : {}
   };
 }
-function getSecureCookieOptions(maxAge, path = "/") {
+function getSecureCookieOptions(maxAge, path = "/", secure = true) {
   return {
     httpOnly: true,
-    secure: true,
+    secure,
     sameSite: "lax",
     path,
     ...maxAge !== void 0 ? { maxAge } : {}
@@ -176,11 +193,14 @@ function createSsoMiddleware(config) {
     callbackPath = "/api/auth/callback",
     ssoCookieName = "__Host-user_token",
     validateSsoCookie = true,
-    accessTokenCookieName = DEFAULT_ACCESS_TOKEN_COOKIE_NAME,
-    stateCookieName = DEFAULT_STATE_COOKIE_NAME,
-    returnUrlCookieName = DEFAULT_RETURN_COOKIE_NAME,
-    verifierCookieName = DEFAULT_VERIFIER_COOKIE_NAME
+    insecureLocalDev: insecureLocalDevOpt = false
   } = config;
+  const insecureLocalDev = resolveInsecureLocalDev(insecureLocalDevOpt, ssoBaseUrl);
+  const secureCookies = !insecureLocalDev;
+  const accessTokenCookieName = insecureLocalDev ? toInsecureCookieName(config.accessTokenCookieName ?? DEFAULT_ACCESS_TOKEN_COOKIE_NAME) : config.accessTokenCookieName ?? DEFAULT_ACCESS_TOKEN_COOKIE_NAME;
+  const stateCookieName = insecureLocalDev ? toInsecureCookieName(config.stateCookieName ?? DEFAULT_STATE_COOKIE_NAME) : config.stateCookieName ?? DEFAULT_STATE_COOKIE_NAME;
+  const returnUrlCookieName = insecureLocalDev ? toInsecureCookieName(config.returnUrlCookieName ?? DEFAULT_RETURN_COOKIE_NAME) : config.returnUrlCookieName ?? DEFAULT_RETURN_COOKIE_NAME;
+  const verifierCookieName = insecureLocalDev ? toInsecureCookieName(config.verifierCookieName ?? DEFAULT_VERIFIER_COOKIE_NAME) : config.verifierCookieName ?? DEFAULT_VERIFIER_COOKIE_NAME;
   const normalizedBase = ssoBaseUrl.replace(/\/+$/, "");
   if (process.env.NODE_ENV !== "production") {
     if (!validateSsoCookie) {
@@ -248,12 +268,12 @@ function createSsoMiddleware(config) {
     const loginUrl = new URL("/api/oauth/authorize", normalizedBase);
     loginUrl.search = authorizeParams.toString();
     const response = import_server.NextResponse.redirect(loginUrl);
-    response.cookies.set(stateCookieName, state, getHostCookieOptions(600));
-    response.cookies.set(verifierCookieName, verifier, getSecureCookieOptions(600, callbackPath));
+    response.cookies.set(stateCookieName, state, getHostCookieOptions(600, secureCookies));
+    response.cookies.set(verifierCookieName, verifier, getSecureCookieOptions(600, callbackPath, secureCookies));
     const safeReturnUrl = (request.nextUrl.pathname + request.nextUrl.search).slice(0, 2048);
-    response.cookies.set(returnUrlCookieName, safeReturnUrl, getHostCookieOptions(600));
+    response.cookies.set(returnUrlCookieName, safeReturnUrl, getHostCookieOptions(600, secureCookies));
     if (accessTokenCookie?.value) {
-      response.cookies.set(accessTokenCookieName, "", getHostCookieOptions(0));
+      response.cookies.set(accessTokenCookieName, "", getHostCookieOptions(0, secureCookies));
     }
     return response;
   };
@@ -276,6 +296,7 @@ var SsoError = class extends Error {
 // src/core/security.ts
 function isTrustedReturnUrl(url, currentOrigin) {
   if (!url) return false;
+  if (url.includes("\\")) return false;
   if (url.startsWith("/") && !url.startsWith("//")) return true;
   try {
     return new URL(url).origin === currentOrigin;
@@ -481,7 +502,7 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
   if (typeof payload.exp !== "number") {
     throw new SsoError("id_token_invalid", "ID Token \u7F3A\u5C11 exp \u58F0\u660E");
   }
-  if (Date.now() >= payload.exp * 1e3) {
+  if (Date.now() >= payload.exp * 1e3 + 6e4) {
     throw new SsoError("id_token_expired", "ID Token \u5DF2\u8FC7\u671F");
   }
   if (typeof payload.iat === "number" && payload.iat * 1e3 > Date.now() + 6e4) {
@@ -507,13 +528,17 @@ function createCallbackRouteHandler(config) {
     redirectUri,
     clientSecret,
     defaultReturnPath = "/",
-    accessTokenCookieName = DEFAULT_ACCESS_TOKEN_COOKIE_NAME,
-    refreshTokenCookieName = DEFAULT_REFRESH_TOKEN_COOKIE_NAME,
-    idTokenCookieName = DEFAULT_ID_TOKEN_COOKIE_NAME,
-    stateCookieName = DEFAULT_STATE_COOKIE_NAME,
-    returnUrlCookieName = DEFAULT_RETURN_COOKIE_NAME,
-    verifierCookieName = DEFAULT_VERIFIER_COOKIE_NAME
+    insecureLocalDev: insecureLocalDevOpt = false
   } = config;
+  const insecureLocalDev = resolveInsecureLocalDev(insecureLocalDevOpt, ssoBaseUrl);
+  const secureCookies = !insecureLocalDev;
+  const pickName = (explicit, fallback) => insecureLocalDev ? toInsecureCookieName(explicit ?? fallback) : explicit ?? fallback;
+  const accessTokenCookieName = pickName(config.accessTokenCookieName, DEFAULT_ACCESS_TOKEN_COOKIE_NAME);
+  const refreshTokenCookieName = pickName(config.refreshTokenCookieName, DEFAULT_REFRESH_TOKEN_COOKIE_NAME);
+  const idTokenCookieName = pickName(config.idTokenCookieName, DEFAULT_ID_TOKEN_COOKIE_NAME);
+  const stateCookieName = pickName(config.stateCookieName, DEFAULT_STATE_COOKIE_NAME);
+  const returnUrlCookieName = pickName(config.returnUrlCookieName, DEFAULT_RETURN_COOKIE_NAME);
+  const verifierCookieName = pickName(config.verifierCookieName, DEFAULT_VERIFIER_COOKIE_NAME);
   const normalizedBase = ssoBaseUrl.replace(/\/+$/, "");
   return async function GET(request) {
     const { searchParams } = request.nextUrl;
@@ -621,6 +646,15 @@ function createCallbackRouteHandler(config) {
       );
     }
     const tokenData = await res.json();
+    if (!tokenData.access_token || !tokenData.refresh_token) {
+      return import_server2.NextResponse.json(
+        {
+          error: "server_error",
+          error_description: "Token \u54CD\u5E94\u7F3A\u5C11 access_token \u6216 refresh_token"
+        },
+        { status: 502 }
+      );
+    }
     if (tokenData.id_token) {
       try {
         await validateIdToken(
@@ -639,15 +673,16 @@ function createCallbackRouteHandler(config) {
         );
       }
     }
+    const callbackOrigin = new URL(redirectUri).origin;
     const rawReturnUrl = request.cookies.get(returnUrlCookieName)?.value || defaultReturnPath;
-    const returnUrl = isTrustedReturnUrl(rawReturnUrl, request.nextUrl.origin) ? rawReturnUrl : "/";
-    const response = import_server2.NextResponse.redirect(new URL(returnUrl, request.url));
+    const returnUrl = isTrustedReturnUrl(rawReturnUrl, callbackOrigin) ? rawReturnUrl : "/";
+    const response = import_server2.NextResponse.redirect(new URL(returnUrl, callbackOrigin));
     response.cookies.set(accessTokenCookieName, tokenData.access_token, {
-      ...getHostCookieOptions(tokenData.expires_in)
+      ...getHostCookieOptions(tokenData.expires_in, secureCookies)
     });
     const refreshMaxAge = tokenData.refresh_expires_in != null ? tokenData.refresh_expires_in : 30 * 24 * 60 * 60;
     response.cookies.set(refreshTokenCookieName, tokenData.refresh_token, {
-      ...getHostCookieOptions(refreshMaxAge)
+      ...getHostCookieOptions(refreshMaxAge, secureCookies)
     });
     if (tokenData.id_token) {
       let idTokenMaxAge = 3600;
@@ -665,14 +700,14 @@ function createCallbackRouteHandler(config) {
       }
       if (idTokenMaxAge > 0) {
         response.cookies.set(idTokenCookieName, tokenData.id_token, {
-          ...getHostCookieOptions(idTokenMaxAge)
+          ...getHostCookieOptions(idTokenMaxAge, secureCookies)
         });
       }
     }
-    response.cookies.set(stateCookieName, "", getHostCookieOptions(0));
-    response.cookies.set(returnUrlCookieName, "", getHostCookieOptions(0));
-    response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, "/"));
-    response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, request.nextUrl.pathname));
+    response.cookies.set(stateCookieName, "", getHostCookieOptions(0, secureCookies));
+    response.cookies.set(returnUrlCookieName, "", getHostCookieOptions(0, secureCookies));
+    response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, "/", secureCookies));
+    response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, request.nextUrl.pathname, secureCookies));
     return response;
   };
 }
@@ -717,16 +752,21 @@ function createLogoutRouteHandler(config) {
     clientSecret,
     postLogoutRedirectUri = new URL(redirectUri).origin + "/",
     redirectToSso = true,
-    accessTokenCookieName = DEFAULT_ACCESS_TOKEN_COOKIE_NAME,
-    refreshTokenCookieName = DEFAULT_REFRESH_TOKEN_COOKIE_NAME,
-    idTokenCookieName = DEFAULT_ID_TOKEN_COOKIE_NAME,
-    stateCookieName = DEFAULT_STATE_COOKIE_NAME,
-    returnUrlCookieName = DEFAULT_RETURN_COOKIE_NAME,
-    verifierCookieName = DEFAULT_VERIFIER_COOKIE_NAME,
     callbackPath = "/api/auth/callback",
-    logoutStateCookieName = DEFAULT_LOGOUT_STATE_COOKIE_NAME
+    insecureLocalDev: insecureLocalDevOpt = false
   } = config;
+  const insecureLocalDev = resolveInsecureLocalDev(insecureLocalDevOpt, ssoBaseUrl);
+  const secureCookies = !insecureLocalDev;
+  const pickName = (explicit, fallback) => insecureLocalDev ? toInsecureCookieName(explicit ?? fallback) : explicit ?? fallback;
+  const accessTokenCookieName = pickName(config.accessTokenCookieName, DEFAULT_ACCESS_TOKEN_COOKIE_NAME);
+  const refreshTokenCookieName = pickName(config.refreshTokenCookieName, DEFAULT_REFRESH_TOKEN_COOKIE_NAME);
+  const idTokenCookieName = pickName(config.idTokenCookieName, DEFAULT_ID_TOKEN_COOKIE_NAME);
+  const stateCookieName = pickName(config.stateCookieName, DEFAULT_STATE_COOKIE_NAME);
+  const returnUrlCookieName = pickName(config.returnUrlCookieName, DEFAULT_RETURN_COOKIE_NAME);
+  const verifierCookieName = pickName(config.verifierCookieName, DEFAULT_VERIFIER_COOKIE_NAME);
+  const logoutStateCookieName = pickName(config.logoutStateCookieName, DEFAULT_LOGOUT_STATE_COOKIE_NAME);
   const normalizedBase = ssoBaseUrl.replace(/\/+$/, "");
+  const callbackOrigin = new URL(redirectUri).origin;
   return async function handler(request) {
     const returnedState = request.nextUrl.searchParams.get("state");
     if (returnedState) {
@@ -737,8 +777,8 @@ function createLogoutRouteHandler(config) {
           { status: 400 }
         );
       }
-      const res = import_server3.NextResponse.redirect(request.nextUrl.origin + "/");
-      res.cookies.set(logoutStateCookieName, "", getHostCookieOptions(0));
+      const res = import_server3.NextResponse.redirect(callbackOrigin + "/");
+      res.cookies.set(logoutStateCookieName, "", getHostCookieOptions(0, secureCookies));
       return res;
     }
     const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
@@ -764,18 +804,18 @@ function createLogoutRouteHandler(config) {
       }
     }
     const clearCookies = (res) => {
-      res.cookies.set(accessTokenCookieName, "", getHostCookieOptions(0));
-      res.cookies.set(refreshTokenCookieName, "", getHostCookieOptions(0));
-      res.cookies.set(idTokenCookieName, "", getHostCookieOptions(0));
-      res.cookies.set(stateCookieName, "", getHostCookieOptions(0));
-      res.cookies.set(returnUrlCookieName, "", getHostCookieOptions(0));
-      res.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, "/"));
-      res.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, callbackPath));
+      res.cookies.set(accessTokenCookieName, "", getHostCookieOptions(0, secureCookies));
+      res.cookies.set(refreshTokenCookieName, "", getHostCookieOptions(0, secureCookies));
+      res.cookies.set(idTokenCookieName, "", getHostCookieOptions(0, secureCookies));
+      res.cookies.set(stateCookieName, "", getHostCookieOptions(0, secureCookies));
+      res.cookies.set(returnUrlCookieName, "", getHostCookieOptions(0, secureCookies));
+      res.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, "/", secureCookies));
+      res.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, callbackPath, secureCookies));
       return res;
     };
     if (redirectToSso) {
       const discovery = await fetchDiscovery(normalizedBase);
-      const endSessionEndpoint = discovery?.end_session_endpoint || `${normalizedBase}/logout`;
+      const endSessionEndpoint = discovery?.end_session_endpoint || `${normalizedBase}/api/oauth/end-session`;
       const logoutUrl = new URL(endSessionEndpoint);
       logoutUrl.searchParams.set("client_id", clientId);
       logoutUrl.searchParams.set(
@@ -788,11 +828,11 @@ function createLogoutRouteHandler(config) {
       const logoutState = generateRandomString2(32);
       logoutUrl.searchParams.set("state", logoutState);
       const res = clearCookies(import_server3.NextResponse.redirect(logoutUrl.toString()));
-      res.cookies.set(logoutStateCookieName, logoutState, getHostCookieOptions(600));
+      res.cookies.set(logoutStateCookieName, logoutState, getHostCookieOptions(600, secureCookies));
       return res;
     }
     return clearCookies(
-      import_server3.NextResponse.redirect(request.nextUrl.origin + "/")
+      import_server3.NextResponse.redirect(callbackOrigin + "/")
     );
   };
 }
@@ -809,6 +849,7 @@ function createLogoutRouteHandler(config) {
   createLogoutRouteHandler,
   createSsoMiddleware,
   getHostCookieOptions,
-  getSecureCookieOptions
+  getSecureCookieOptions,
+  toInsecureCookieName
 });
 //# sourceMappingURL=index.js.map