@nihplod/sso-sdk 1.4.1 → 1.5.0

package/dist/next/index.mjs

@@ -156,8 +156,7 @@ function createSsoMiddleware(config) {
     scopes = "openid profile",
     publicPaths = [],
     callbackPath = "/api/auth/callback",
-    ssoCookieName = "__Host-user_token",
-    validateSsoCookie = true,
+    failClosedOnIntrospectionError = false,
     insecureLocalDev: insecureLocalDevOpt = false
   } = config;
   const insecureLocalDev = resolveInsecureLocalDev(insecureLocalDevOpt, ssoBaseUrl);
@@ -169,9 +168,9 @@ function createSsoMiddleware(config) {
   const verifierCookieName = insecureLocalDev ? toInsecureCookieName(config.verifierCookieName ?? DEFAULT_VERIFIER_COOKIE_NAME) : config.verifierCookieName ?? DEFAULT_VERIFIER_COOKIE_NAME;
   const normalizedBase = ssoBaseUrl.replace(/\/+$/, "");
   const normalizedServerBase = (config.serverBaseUrl ?? ssoBaseUrl).replace(/\/+$/, "");
-  if (!validateSsoCookie) {
+  if (config.validateSsoCookie !== void 0 || config.ssoCookieName !== void 0) {
     console.warn(
-      "[SSO SDK] validateSsoCookie=false\uFF1A\u4E2D\u95F4\u4EF6\u4EC5\u68C0\u67E5 Cookie \u5B58\u5728\u6027\uFF0C\u53EF\u80FD\u653E\u884C\u5DF2\u5931\u6548\u7684\u4F1A\u8BDD\u3002\u4E2D\u95F4\u4EF6\u53EA\u662F UX \u5C42\uFF0C\u654F\u611F\u6570\u636E\u7684\u9274\u6743\u5FC5\u987B\u5728 Route Handler / Server Component \u4E2D\u5B8C\u6210\u3002"
+      '[SSO SDK] validateSsoCookie / ssoCookieName \u5DF2\u5E9F\u5F03\uFF1A\u4E3B\u7AD9\u4F1A\u8BDD Cookie\uFF08__Host-user_token\uFF09\u662F\u4E3B\u7AD9\u5185\u90E8 token\uFF08type="user"\uFF09\uFF0Cintrospect \u7AEF\u70B9\u53EA\u63A5\u53D7 access_token\uFF0C\u6821\u9A8C\u5FC5\u7136\u5931\u8D25\uFF1B\u4E14 __Host- Cookie \u4E0D\u4F1A\u4E0B\u53D1\u5230\u5B50\u57DF\u3002\u8BE5\u5FEB\u901F\u901A\u9053\u4ECE\u672A\u751F\u6548\uFF0C\u5DF2\u79FB\u9664\u3002\u8BF7\u5220\u9664\u8FD9\u4E24\u4E2A\u914D\u7F6E\u9879\uFF1B\u4F1A\u8BDD\u68C0\u6D4B\u4EE5\u672C\u7AD9 access_token Cookie \u4E3A\u51C6\u3002'
     );
   }
   if (!clientSecret) {
@@ -191,22 +190,6 @@ function createSsoMiddleware(config) {
     if (matchesPath(pathname, allPublicPaths)) {
       return NextResponse.next();
     }
-    const ssoSession = request.cookies.get(ssoCookieName);
-    if (ssoSession?.value) {
-      if (validateSsoCookie) {
-        const introspectResult = await introspectAccessToken(
-          ssoSession.value,
-          normalizedServerBase,
-          clientId,
-          clientSecret
-        );
-        if (introspectResult === "active") {
-          return NextResponse.next();
-        }
-      } else {
-        return NextResponse.next();
-      }
-    }
     const accessTokenCookie = request.cookies.get(accessTokenCookieName);
     if (accessTokenCookie?.value) {
       const introspectResult = await introspectAccessToken(
@@ -219,6 +202,15 @@ function createSsoMiddleware(config) {
         return NextResponse.next();
       }
       if (introspectResult === "unreachable") {
+        if (failClosedOnIntrospectionError) {
+          console.warn(
+            "[SSO SDK] introspection \u4E0D\u53EF\u8FBE\uFF08\u7F51\u7EDC\u5F02\u5E38/\u8D85\u65F6/5xx\uFF09\uFF0CfailClosedOnIntrospectionError=true\uFF0C\u5BF9\u6301\u6709 SSO access token Cookie \u7684\u8BF7\u6C42 fail-closed \u8FD4\u56DE 502\u3002"
+          );
+          return new NextResponse(
+            "SSO \u8BA4\u8BC1\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528\uFF08introspection unreachable\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+            { status: 502 }
+          );
+        }
         console.warn(
           "[SSO SDK] introspection \u4E0D\u53EF\u8FBE\uFF08\u7F51\u7EDC\u5F02\u5E38/\u8D85\u65F6/5xx\uFF09\uFF0C\u5BF9\u6301\u6709 SSO access token Cookie \u7684\u8BF7\u6C42 fail-open \u653E\u884C\uFF1B\u654F\u611F\u6570\u636E\u7684\u9274\u6743\u7531 Route Handler \u515C\u5E95\u3002"
         );
@@ -241,11 +233,28 @@ function createSsoMiddleware(config) {
     const loginUrl = new URL("/api/oauth/authorize", normalizedBase);
     loginUrl.search = authorizeParams.toString();
     const response = NextResponse.redirect(loginUrl);
-    response.cookies.set(stateCookieName, state, getHostCookieOptions(600, secureCookies));
-    response.cookies.set(nonceCookieName, nonce, getHostCookieOptions(600, secureCookies));
-    response.cookies.set(verifierCookieName, verifier, getSecureCookieOptions(600, callbackPath, secureCookies));
+    const attemptSuffix = `_${state}`;
+    response.cookies.set(
+      `${stateCookieName}${attemptSuffix}`,
+      state,
+      getHostCookieOptions(600, secureCookies)
+    );
+    response.cookies.set(
+      `${nonceCookieName}${attemptSuffix}`,
+      nonce,
+      getHostCookieOptions(600, secureCookies)
+    );
+    response.cookies.set(
+      `${verifierCookieName}${attemptSuffix}`,
+      verifier,
+      getSecureCookieOptions(600, callbackPath, secureCookies)
+    );
     const safeReturnUrl = (request.nextUrl.pathname + request.nextUrl.search).slice(0, 2048);
-    response.cookies.set(returnUrlCookieName, safeReturnUrl, getHostCookieOptions(600, secureCookies));
+    response.cookies.set(
+      `${returnUrlCookieName}${attemptSuffix}`,
+      safeReturnUrl,
+      getHostCookieOptions(600, secureCookies)
+    );
     if (accessTokenCookie?.value) {
       response.cookies.set(accessTokenCookieName, "", getHostCookieOptions(0, secureCookies));
     }
@@ -268,12 +277,17 @@ var SsoError = class extends Error {
 };
 
 // src/core/security.ts
+var UNSAFE_URL_CHAR_PATTERN = /[\\\u0000-\u001F\u007F]/;
 function isTrustedReturnUrl(url, currentOrigin) {
   if (!url) return false;
-  if (url.includes("\\")) return false;
-  if (url.startsWith("/") && !url.startsWith("//")) return true;
+  if (UNSAFE_URL_CHAR_PATTERN.test(url)) return false;
+  if (url.startsWith("//")) return false;
+  if (url.startsWith("/")) return true;
   try {
-    return new URL(url).origin === currentOrigin;
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+    if (parsed.username || parsed.password) return false;
+    return parsed.origin === currentOrigin;
   } catch {
     return false;
   }
@@ -507,6 +521,92 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
 }
 
 // src/next/callback.ts
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (ch) => {
+    switch (ch) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      default:
+        return "&#39;";
+    }
+  });
+}
+function buildErrorPage(status, error, errorDescription) {
+  const safeDescription = escapeHtml(errorDescription);
+  const safeError = escapeHtml(error);
+  return `<!doctype html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<meta name="robots" content="noindex" />
+<title>\u767B\u5F55\u5931\u8D25</title>
+<style>
+  :root { color-scheme: light; }
+  body { margin: 0; font-family: system-ui, -apple-system, "PingFang SC", "Microsoft YaHei", sans-serif; background: #fafafa; color: #2c2c2c; }
+  main { min-height: 100vh; display: flex; flex-direction: column; align-items: center; justify-content: center; padding: 2rem; text-align: center; }
+  h1 { font-size: 1.25rem; font-weight: 500; letter-spacing: 0.08em; margin: 0 0 0.75rem; }
+  p { margin: 0 0 1.5rem; color: #6b7280; font-size: 0.875rem; line-height: 1.6; max-width: 28rem; }
+  .actions { display: flex; gap: 0.75rem; }
+  a { display: inline-block; padding: 0.6rem 1.4rem; font-size: 0.8125rem; letter-spacing: 0.08em; text-decoration: none; }
+  a.primary { background: #2c2c2c; color: #fff; }
+  a.secondary { border: 1px solid rgba(44, 44, 44, 0.25); color: #2c2c2c; }
+  .code { margin-top: 2rem; font-size: 0.6875rem; color: #9ca3af; }
+</style>
+</head>
+<body>
+<main>
+  <h1>\u767B\u5F55\u5931\u8D25</h1>
+  <p>${safeDescription}</p>
+  <div class="actions">
+    <a class="primary" href="/">\u91CD\u65B0\u767B\u5F55</a>
+    <a class="secondary" href="/">\u8FD4\u56DE\u9996\u9875</a>
+  </div>
+  <p class="code">\u9519\u8BEF\u7801\uFF1A${safeError}\uFF08\u53CD\u9988\u95EE\u9898\u65F6\u8BF7\u9644\u4E0A\uFF09</p>
+</main>
+</body>
+</html>`;
+}
+function buildErrorResponse(request, status, error, errorDescription, custom) {
+  if (custom) {
+    const handled = custom({ error, errorDescription, status, request });
+    if (handled instanceof Promise) {
+      return handled.then(
+        (res) => res ? toNextResponse(res) : defaultErrorResponse(request, status, error, errorDescription)
+      );
+    }
+    if (handled) return toNextResponse(handled);
+  }
+  return defaultErrorResponse(request, status, error, errorDescription);
+}
+function toNextResponse(res) {
+  if (res instanceof NextResponse2) return res;
+  return new NextResponse2(res.body, {
+    status: res.status,
+    statusText: res.statusText,
+    headers: res.headers
+  });
+}
+function defaultErrorResponse(request, status, error, errorDescription) {
+  const accept = request.headers.get("accept") ?? "";
+  const wantsHtml = accept.includes("text/html") && request.nextUrl.searchParams.get("format") !== "json";
+  if (wantsHtml) {
+    return new NextResponse2(buildErrorPage(status, error, errorDescription), {
+      status,
+      headers: {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store"
+      }
+    });
+  }
+  return NextResponse2.json({ error, error_description: errorDescription }, { status });
+}
 function createCallbackRouteHandler(config) {
   const {
     clientId,
@@ -514,6 +614,7 @@ function createCallbackRouteHandler(config) {
     redirectUri,
     clientSecret,
     defaultReturnPath = "/",
+    scopes,
     insecureLocalDev: insecureLocalDevOpt = false
   } = config;
   const insecureLocalDev = resolveInsecureLocalDev(insecureLocalDevOpt, ssoBaseUrl);
@@ -531,7 +632,21 @@ function createCallbackRouteHandler(config) {
   return async function GET(request) {
     const response = await handleCallback(request);
     if (response.status >= 400) {
+      if (config.debug) {
+        console.warn(
+          `[SSO SDK] \u56DE\u8C03\u5931\u8D25 status=${response.status}`,
+          request.nextUrl.searchParams.get("error") ?? ""
+        );
+      }
       response.cookies.set(nonceCookieName, "", getHostCookieOptions(0, secureCookies));
+      const returnedState = request.nextUrl.searchParams.get("state");
+      if (returnedState && /^[A-Za-z0-9\-._~]{8,512}$/.test(returnedState)) {
+        response.cookies.set(
+          `${nonceCookieName}_${returnedState}`,
+          "",
+          getHostCookieOptions(0, secureCookies)
+        );
+      }
     }
     return response;
   };
@@ -540,50 +655,75 @@ function createCallbackRouteHandler(config) {
     const error = searchParams.get("error");
     if (error) {
       const desc = searchParams.get("error_description") || error;
-      return NextResponse2.json(
-        { error: "authorization_failed", error_description: desc },
-        { status: 400 }
+      return buildErrorResponse(
+        request,
+        400,
+        "authorization_failed",
+        desc,
+        config.renderErrorPage
       );
     }
     const code = searchParams.get("code");
     const returnedState = searchParams.get("state");
     if (!code) {
-      return NextResponse2.json(
-        {
-          error: "invalid_request",
-          error_description: "\u7F3A\u5C11 authorization code"
-        },
-        { status: 400 }
+      return buildErrorResponse(
+        request,
+        400,
+        "invalid_request",
+        "\u767B\u5F55\u4FE1\u606F\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u767B\u5F55",
+        config.renderErrorPage
       );
     }
-    const savedState = request.cookies.get(stateCookieName)?.value;
+    if (!returnedState || !/^[A-Za-z0-9\-._~]{8,512}$/.test(returnedState)) {
+      return buildErrorResponse(
+        request,
+        400,
+        "invalid_request",
+        "State \u53C2\u6570\u7F3A\u5931\u6216\u683C\u5F0F\u975E\u6CD5\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u8BF7\u6C42",
+        config.renderErrorPage
+      );
+    }
+    const attemptSuffix = `_${returnedState}`;
+    const readTransientCookie = (name) => request.cookies.get(`${name}${attemptSuffix}`)?.value ?? request.cookies.get(name)?.value;
+    const savedState = readTransientCookie(stateCookieName);
     if (!savedState) {
-      return NextResponse2.json(
-        {
-          error: "invalid_request",
-          error_description: "State \u53C2\u6570\u7F3A\u5931\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u8BF7\u6C42"
-        },
-        { status: 400 }
+      const alternateName = secureCookies ? toInsecureCookieName(stateCookieName) : DEFAULT_STATE_COOKIE_NAME;
+      const alternateValue = request.cookies.get(`${alternateName}${attemptSuffix}`)?.value ?? request.cookies.get(alternateName)?.value;
+      if (alternateValue) {
+        return buildErrorResponse(
+          request,
+          500,
+          "invalid_config",
+          "\u68C0\u6D4B\u5230 SSO SDK \u914D\u7F6E\u4E0D\u4E00\u81F4\uFF1Amiddleware \u4E0E callback \u7684 insecureLocalDev \u6216 Cookie \u540D\u79F0\u4E0D\u5339\u914D\uFF0C\u8BF7\u7EDF\u4E00\u914D\u7F6E",
+          config.renderErrorPage
+        );
+      }
+      return buildErrorResponse(
+        request,
+        400,
+        "invalid_request",
+        "\u767B\u5F55\u4F1A\u8BDD\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u8BF7\u6C42",
+        config.renderErrorPage
       );
     }
-    if (!timingSafeEqualString(returnedState ?? "", savedState)) {
-      return NextResponse2.json(
-        {
-          error: "invalid_request",
-          error_description: "State \u53C2\u6570\u4E0D\u5339\u914D\uFF0C\u53EF\u80FD\u5B58\u5728 CSRF \u653B\u51FB"
-        },
-        { status: 400 }
+    if (!timingSafeEqualString(returnedState, savedState)) {
+      return buildErrorResponse(
+        request,
+        400,
+        "invalid_request",
+        "\u767B\u5F55\u4F1A\u8BDD\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u8BF7\u6C42",
+        config.renderErrorPage
       );
     }
-    const expectedNonce = request.cookies.get(nonceCookieName)?.value;
-    const verifier = request.cookies.get(verifierCookieName)?.value;
+    const expectedNonce = readTransientCookie(nonceCookieName);
+    const verifier = readTransientCookie(verifierCookieName);
     if (!verifier) {
-      return NextResponse2.json(
-        {
-          error: "invalid_request",
-          error_description: "PKCE verifier \u7F3A\u5931\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u8BF7\u6C42"
-        },
-        { status: 400 }
+      return buildErrorResponse(
+        request,
+        400,
+        "invalid_request",
+        "\u767B\u5F55\u4F1A\u8BDD\u5DF2\u8FC7\u671F\uFF08\u53EF\u80FD\u5207\u6362\u4E86\u6807\u7B7E\u9875\uFF09\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u767B\u5F55",
+        config.renderErrorPage
       );
     }
     const tokenEndpoint = `${normalizedServerBase}/api/oauth/token`;
@@ -614,17 +754,23 @@ function createCallbackRouteHandler(config) {
       } catch (err) {
         lastError = err;
         if (attempt >= maxRetries) {
-          return NextResponse2.json(
-            { error: "server_error", error_description: "Token \u8BF7\u6C42\u5931\u8D25\uFF0C\u5DF2\u91CD\u8BD5\u4ECD\u4E0D\u53EF\u8FBE" },
-            { status: 502 }
+          return buildErrorResponse(
+            request,
+            502,
+            "server_error",
+            "\u767B\u5F55\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528\uFF08Token \u8BF7\u6C42\u5931\u8D25\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+            config.renderErrorPage
           );
         }
       }
     }
     if (lastError || !res) {
-      return NextResponse2.json(
-        { error: "server_error", error_description: "Token \u8BF7\u6C42\u5931\u8D25" },
-        { status: 502 }
+      return buildErrorResponse(
+        request,
+        502,
+        "server_error",
+        "\u767B\u5F55\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528\uFF08Token \u8BF7\u6C42\u5931\u8D25\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+        config.renderErrorPage
       );
     }
     if (!res.ok) {
@@ -633,22 +779,32 @@ function createCallbackRouteHandler(config) {
         errData = await res.json();
       } catch {
       }
-      return NextResponse2.json(
-        {
-          error: "token_request_failed",
-          error_description: errData.error_description || `Token \u8BF7\u6C42\u5931\u8D25: HTTP ${res.status}`
-        },
-        { status: 502 }
+      return buildErrorResponse(
+        request,
+        502,
+        "token_request_failed",
+        errData.error_description || `\u767B\u5F55\u5931\u8D25\uFF08Token \u8BF7\u6C42\u5931\u8D25: HTTP ${res.status}\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5`,
+        config.renderErrorPage
       );
     }
     const tokenData = await res.json();
-    if (!tokenData.access_token || !tokenData.refresh_token) {
-      return NextResponse2.json(
-        {
-          error: "server_error",
-          error_description: "Token \u54CD\u5E94\u7F3A\u5C11 access_token \u6216 refresh_token"
-        },
-        { status: 502 }
+    if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number" || !Number.isFinite(tokenData.expires_in) || tokenData.expires_in <= 0) {
+      return buildErrorResponse(
+        request,
+        502,
+        "server_error",
+        "\u767B\u5F55\u670D\u52A1\u8FD4\u56DE\u5F02\u5E38\uFF08Token \u54CD\u5E94\u4E0D\u5B8C\u6574\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+        config.renderErrorPage
+      );
+    }
+    const requiresIdToken = scopes !== void 0 && scopes.split(" ").filter(Boolean).includes("openid");
+    if (requiresIdToken && !tokenData.id_token) {
+      return buildErrorResponse(
+        request,
+        400,
+        "id_token_invalid",
+        "\u767B\u5F55\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u767B\u5F55",
+        config.renderErrorPage
       );
     }
     if (tokenData.id_token) {
@@ -661,17 +817,17 @@ function createCallbackRouteHandler(config) {
           { expectedNonce }
         );
       } catch (err) {
-        return NextResponse2.json(
-          {
-            error: "id_token_invalid",
-            error_description: err instanceof Error ? err.message : "ID Token \u9A8C\u8BC1\u5931\u8D25"
-          },
-          { status: 400 }
+        return buildErrorResponse(
+          request,
+          400,
+          "id_token_invalid",
+          err instanceof Error && /[\u4e00-\u9fff]/.test(err.message) ? err.message : "\u767B\u5F55\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u767B\u5F55",
+          config.renderErrorPage
         );
       }
     }
     const callbackOrigin = new URL(redirectUri).origin;
-    const rawReturnUrl = request.cookies.get(returnUrlCookieName)?.value || defaultReturnPath;
+    const rawReturnUrl = readTransientCookie(returnUrlCookieName) || defaultReturnPath;
     const returnUrl = isTrustedReturnUrl(rawReturnUrl, callbackOrigin) ? rawReturnUrl : "/";
     const response = NextResponse2.redirect(new URL(returnUrl, callbackOrigin));
     response.cookies.set(accessTokenCookieName, tokenData.access_token, {
@@ -701,11 +857,18 @@ function createCallbackRouteHandler(config) {
         });
       }
     }
-    response.cookies.set(stateCookieName, "", getHostCookieOptions(0, secureCookies));
-    response.cookies.set(nonceCookieName, "", getHostCookieOptions(0, secureCookies));
-    response.cookies.set(returnUrlCookieName, "", getHostCookieOptions(0, secureCookies));
-    response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, "/", secureCookies));
-    response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, request.nextUrl.pathname, secureCookies));
+    for (const name of [stateCookieName, nonceCookieName, returnUrlCookieName]) {
+      response.cookies.set(name, "", getHostCookieOptions(0, secureCookies));
+      response.cookies.set(`${name}${attemptSuffix}`, "", getHostCookieOptions(0, secureCookies));
+    }
+    for (const path of ["/", request.nextUrl.pathname]) {
+      response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, path, secureCookies));
+      response.cookies.set(
+        `${verifierCookieName}${attemptSuffix}`,
+        "",
+        getSecureCookieOptions(0, path, secureCookies)
+      );
+    }
     return response;
   }
 }
@@ -835,6 +998,20 @@ function createLogoutRouteHandler(config) {
         headers: { "content-type": "text/html; charset=utf-8" }
       });
     }
+    const requestOrigin = request.headers.get("origin");
+    if (requestOrigin && requestOrigin !== callbackOrigin) {
+      return NextResponse3.json(
+        { error: "forbidden", error_description: "\u8DE8\u7AD9\u8BF7\u6C42\u88AB\u62D2\u7EDD" },
+        { status: 403 }
+      );
+    }
+    const secFetchSite = request.headers.get("sec-fetch-site");
+    if (!requestOrigin && secFetchSite && secFetchSite !== "same-origin" && secFetchSite !== "none") {
+      return NextResponse3.json(
+        { error: "forbidden", error_description: "\u8DE8\u7AD9\u8BF7\u6C42\u88AB\u62D2\u7EDD" },
+        { status: 403 }
+      );
+    }
     let formGlobal = null;
     try {
       formGlobal = new URLSearchParams(await request.text()).get("global");
@@ -873,6 +1050,21 @@ function createLogoutRouteHandler(config) {
       res.cookies.set(returnUrlCookieName, "", getHostCookieOptions(0, secureCookies));
       res.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, "/", secureCookies));
       res.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, callbackPath, secureCookies));
+      const suffixedPrefixes = [
+        `${stateCookieName}_`,
+        `${nonceCookieName}_`,
+        `${returnUrlCookieName}_`,
+        `${verifierCookieName}_`
+      ];
+      for (const cookie of request.cookies.getAll()) {
+        if (!suffixedPrefixes.some((prefix) => cookie.name.startsWith(prefix))) continue;
+        if (cookie.name.startsWith(`${verifierCookieName}_`)) {
+          res.cookies.set(cookie.name, "", getSecureCookieOptions(0, "/", secureCookies));
+          res.cookies.set(cookie.name, "", getSecureCookieOptions(0, callbackPath, secureCookies));
+        } else {
+          res.cookies.set(cookie.name, "", getHostCookieOptions(0, secureCookies));
+        }
+      }
       return res;
     };
     if (effectiveScope === "global") {
@@ -906,6 +1098,9 @@ import { NextResponse as NextResponse4 } from "next/server";
 var BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
 var JTI_CACHE_CAPACITY = 1e3;
 var seenJti = /* @__PURE__ */ new Map();
+function releaseLogoutTokenJti(jti) {
+  seenJti.delete(jti);
+}
 function recordJti(jti, expiresAtMs) {
   const now = Date.now();
   const existing = seenJti.get(jti);
@@ -921,7 +1116,7 @@ function recordJti(jti, expiresAtMs) {
   seenJti.set(jti, expiresAtMs);
   return true;
 }
-async function verifyLogoutToken(logoutToken, ssoBaseUrl, clientId) {
+async function verifyLogoutTokenDetailed(logoutToken, ssoBaseUrl, clientId) {
   const baseUrl = ssoBaseUrl.replace(/\/+$/, "");
   const header = decodeJwtHeader(logoutToken);
   if (!header) {
@@ -998,8 +1193,21 @@ async function verifyLogoutToken(logoutToken, ssoBaseUrl, clientId) {
   if (Date.now() >= payload.exp * 1e3 + 6e4) {
     throw new SsoError("logout_token_expired", "Logout Token \u5DF2\u8FC7\u671F");
   }
+  if (payload.type !== "logout_token") {
+    throw new SsoError(
+      "logout_token_invalid",
+      "Logout Token type \u5FC5\u987B\u4E3A logout_token"
+    );
+  }
   const events = payload.events;
-  if (!events || typeof events !== "object" || !(BACKCHANNEL_LOGOUT_EVENT in events)) {
+  if (!events || typeof events !== "object" || Array.isArray(events)) {
+    throw new SsoError(
+      "logout_token_invalid",
+      "Logout Token \u7F3A\u5C11 backchannel-logout events \u58F0\u660E"
+    );
+  }
+  const logoutEvent = events[BACKCHANNEL_LOGOUT_EVENT];
+  if (!logoutEvent || typeof logoutEvent !== "object" || Array.isArray(logoutEvent)) {
     throw new SsoError(
       "logout_token_invalid",
       "Logout Token \u7F3A\u5C11 backchannel-logout events \u58F0\u660E"
@@ -1020,7 +1228,7 @@ async function verifyLogoutToken(logoutToken, ssoBaseUrl, clientId) {
   if (!recordJti(jti, payload.exp * 1e3 + 6e4)) {
     throw new SsoError("logout_token_replay", "Logout Token jti \u91CD\u653E");
   }
-  return { sub, sid };
+  return { payload: { sub, sid }, jti };
 }
 
 // src/next/backchannel-logout.ts
@@ -1060,9 +1268,9 @@ function createBackchannelLogoutRouteHandler(config) {
         { status: 400 }
       );
     }
-    let payload;
+    let verified;
     try {
-      payload = await verifyLogoutToken(logoutToken, ssoBaseUrl, clientId);
+      verified = await verifyLogoutTokenDetailed(logoutToken, ssoBaseUrl, clientId);
     } catch (err) {
       const code = err instanceof SsoError ? err.code : "logout_token_invalid";
       const description = err instanceof SsoError ? err.description : "Logout Token \u9A8C\u8BC1\u5931\u8D25";
@@ -1072,8 +1280,9 @@ function createBackchannelLogoutRouteHandler(config) {
       );
     }
     try {
-      await onLogout?.(payload, request);
+      await onLogout?.(verified.payload, request);
     } catch (err) {
+      releaseLogoutTokenJti(verified.jti);
       console.error(
         "[SSO SDK] backchannel logout onLogout \u94A9\u5B50\u6267\u884C\u5931\u8D25:",
         err