@nihplod/sso-sdk 1.4.1 → 1.6.0

package/dist/next/index.mjs

@@ -74,15 +74,18 @@ async function computeCodeChallenge(verifier) {
 function matchesPath(pathname, paths) {
   return paths.some((path) => {
     if (pathname === path) return true;
-    if (path.endsWith("/:path*") && pathname.startsWith(path.replace("/:path*", ""))) return true;
-    if (pathname.startsWith(path + "/")) return true;
-    return false;
+    if (path.endsWith("/:path*")) {
+      const base = path.slice(0, -"/:path*".length);
+      return pathname === base || pathname.startsWith(base + "/");
+    }
+    return pathname.startsWith(path + "/");
   });
 }
 var introspectionCache = /* @__PURE__ */ new Map();
 var INTROSPECT_CACHE_TTL_MS = 3e4;
 var INTROSPECT_CACHE_MAX_ENTRIES = 500;
 var INTROSPECT_TIMEOUT_MS = 5e3;
+var warnedIntrospectClientAuthFailure = false;
 async function introspectCacheKey(token, clientId) {
   const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
   const hex = Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
@@ -136,8 +139,13 @@ async function introspectAccessToken(token, ssoBaseUrl, clientId, clientSecret)
       if (res.status !== 401 && res.status !== 403) {
         return "unreachable";
       }
-      introspectCacheSet(cacheKey, false);
-      return "inactive";
+      if (!warnedIntrospectClientAuthFailure) {
+        warnedIntrospectClientAuthFailure = true;
+        console.warn(
+          `[SSO SDK] introspection \u5BA2\u6237\u7AEF\u8BA4\u8BC1\u5931\u8D25\uFF08HTTP ${res.status}\uFF09\uFF1A\u8BF7\u68C0\u67E5 clientId/clientSecret \u4E0E\u4E3B\u7AD9\u6CE8\u518C\u4FE1\u606F\u662F\u5426\u4E00\u81F4\u3002\u8BE5\u6545\u969C\u4E0D\u4F1A\u88AB\u7F13\u5B58\u4E3A token \u5931\u6548\uFF0C\u4E5F\u4E0D\u4F1A\u89E6\u53D1\u9759\u9ED8\u91CD\u767B\u5F55\u5FAA\u73AF\u3002`
+        );
+      }
+      return "unreachable";
     }
     const data = await res.json();
     const active = data.active === true;
@@ -156,8 +164,7 @@ function createSsoMiddleware(config) {
     scopes = "openid profile",
     publicPaths = [],
     callbackPath = "/api/auth/callback",
-    ssoCookieName = "__Host-user_token",
-    validateSsoCookie = true,
+    failClosedOnIntrospectionError = false,
     insecureLocalDev: insecureLocalDevOpt = false
   } = config;
   const insecureLocalDev = resolveInsecureLocalDev(insecureLocalDevOpt, ssoBaseUrl);
@@ -169,9 +176,9 @@ function createSsoMiddleware(config) {
   const verifierCookieName = insecureLocalDev ? toInsecureCookieName(config.verifierCookieName ?? DEFAULT_VERIFIER_COOKIE_NAME) : config.verifierCookieName ?? DEFAULT_VERIFIER_COOKIE_NAME;
   const normalizedBase = ssoBaseUrl.replace(/\/+$/, "");
   const normalizedServerBase = (config.serverBaseUrl ?? ssoBaseUrl).replace(/\/+$/, "");
-  if (!validateSsoCookie) {
+  if (config.validateSsoCookie !== void 0 || config.ssoCookieName !== void 0) {
     console.warn(
-      "[SSO SDK] validateSsoCookie=false\uFF1A\u4E2D\u95F4\u4EF6\u4EC5\u68C0\u67E5 Cookie \u5B58\u5728\u6027\uFF0C\u53EF\u80FD\u653E\u884C\u5DF2\u5931\u6548\u7684\u4F1A\u8BDD\u3002\u4E2D\u95F4\u4EF6\u53EA\u662F UX \u5C42\uFF0C\u654F\u611F\u6570\u636E\u7684\u9274\u6743\u5FC5\u987B\u5728 Route Handler / Server Component \u4E2D\u5B8C\u6210\u3002"
+      '[SSO SDK] validateSsoCookie / ssoCookieName \u5DF2\u5E9F\u5F03\uFF1A\u4E3B\u7AD9\u4F1A\u8BDD Cookie\uFF08__Host-user_token\uFF09\u662F\u4E3B\u7AD9\u5185\u90E8 token\uFF08type="user"\uFF09\uFF0Cintrospect \u7AEF\u70B9\u53EA\u63A5\u53D7 access_token\uFF0C\u6821\u9A8C\u5FC5\u7136\u5931\u8D25\uFF1B\u4E14 __Host- Cookie \u4E0D\u4F1A\u4E0B\u53D1\u5230\u5B50\u57DF\u3002\u8BE5\u5FEB\u901F\u901A\u9053\u4ECE\u672A\u751F\u6548\uFF0C\u5DF2\u79FB\u9664\u3002\u8BF7\u5220\u9664\u8FD9\u4E24\u4E2A\u914D\u7F6E\u9879\uFF1B\u4F1A\u8BDD\u68C0\u6D4B\u4EE5\u672C\u7AD9 access_token Cookie \u4E3A\u51C6\u3002'
     );
   }
   if (!clientSecret) {
@@ -181,7 +188,7 @@ function createSsoMiddleware(config) {
   }
   return async function ssoMiddleware(request) {
     const { pathname } = request.nextUrl;
-    if (pathname.startsWith("/_next/") || pathname.startsWith("/favicon.ico") || pathname.match(/\.(ico|png|jpg|jpeg|svg|css|js|woff2?)$/)) {
+    if (!pathname.startsWith("/api/") && (pathname.startsWith("/_next/") || pathname.startsWith("/favicon.ico") || pathname.match(/\.(ico|png|jpg|jpeg|svg|css|js|woff2?)$/))) {
       return NextResponse.next();
     }
     if (pathname === callbackPath) {
@@ -191,22 +198,6 @@ function createSsoMiddleware(config) {
     if (matchesPath(pathname, allPublicPaths)) {
       return NextResponse.next();
     }
-    const ssoSession = request.cookies.get(ssoCookieName);
-    if (ssoSession?.value) {
-      if (validateSsoCookie) {
-        const introspectResult = await introspectAccessToken(
-          ssoSession.value,
-          normalizedServerBase,
-          clientId,
-          clientSecret
-        );
-        if (introspectResult === "active") {
-          return NextResponse.next();
-        }
-      } else {
-        return NextResponse.next();
-      }
-    }
     const accessTokenCookie = request.cookies.get(accessTokenCookieName);
     if (accessTokenCookie?.value) {
       const introspectResult = await introspectAccessToken(
@@ -219,6 +210,15 @@ function createSsoMiddleware(config) {
         return NextResponse.next();
       }
       if (introspectResult === "unreachable") {
+        if (failClosedOnIntrospectionError) {
+          console.warn(
+            "[SSO SDK] introspection \u4E0D\u53EF\u8FBE\uFF08\u7F51\u7EDC\u5F02\u5E38/\u8D85\u65F6/5xx\uFF09\uFF0CfailClosedOnIntrospectionError=true\uFF0C\u5BF9\u6301\u6709 SSO access token Cookie \u7684\u8BF7\u6C42 fail-closed \u8FD4\u56DE 502\u3002"
+          );
+          return new NextResponse(
+            "SSO \u8BA4\u8BC1\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528\uFF08introspection unreachable\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+            { status: 502 }
+          );
+        }
         console.warn(
           "[SSO SDK] introspection \u4E0D\u53EF\u8FBE\uFF08\u7F51\u7EDC\u5F02\u5E38/\u8D85\u65F6/5xx\uFF09\uFF0C\u5BF9\u6301\u6709 SSO access token Cookie \u7684\u8BF7\u6C42 fail-open \u653E\u884C\uFF1B\u654F\u611F\u6570\u636E\u7684\u9274\u6743\u7531 Route Handler \u515C\u5E95\u3002"
         );
@@ -241,11 +241,28 @@ function createSsoMiddleware(config) {
     const loginUrl = new URL("/api/oauth/authorize", normalizedBase);
     loginUrl.search = authorizeParams.toString();
     const response = NextResponse.redirect(loginUrl);
-    response.cookies.set(stateCookieName, state, getHostCookieOptions(600, secureCookies));
-    response.cookies.set(nonceCookieName, nonce, getHostCookieOptions(600, secureCookies));
-    response.cookies.set(verifierCookieName, verifier, getSecureCookieOptions(600, callbackPath, secureCookies));
+    const attemptSuffix = `_${state}`;
+    response.cookies.set(
+      `${stateCookieName}${attemptSuffix}`,
+      state,
+      getHostCookieOptions(600, secureCookies)
+    );
+    response.cookies.set(
+      `${nonceCookieName}${attemptSuffix}`,
+      nonce,
+      getHostCookieOptions(600, secureCookies)
+    );
+    response.cookies.set(
+      `${verifierCookieName}${attemptSuffix}`,
+      verifier,
+      getSecureCookieOptions(600, callbackPath, secureCookies)
+    );
     const safeReturnUrl = (request.nextUrl.pathname + request.nextUrl.search).slice(0, 2048);
-    response.cookies.set(returnUrlCookieName, safeReturnUrl, getHostCookieOptions(600, secureCookies));
+    response.cookies.set(
+      `${returnUrlCookieName}${attemptSuffix}`,
+      safeReturnUrl,
+      getHostCookieOptions(600, secureCookies)
+    );
     if (accessTokenCookie?.value) {
       response.cookies.set(accessTokenCookieName, "", getHostCookieOptions(0, secureCookies));
     }
@@ -268,12 +285,17 @@ var SsoError = class extends Error {
 };
 
 // src/core/security.ts
+var UNSAFE_URL_CHAR_PATTERN = /[\\\u0000-\u001F\u007F]/;
 function isTrustedReturnUrl(url, currentOrigin) {
   if (!url) return false;
-  if (url.includes("\\")) return false;
-  if (url.startsWith("/") && !url.startsWith("//")) return true;
+  if (UNSAFE_URL_CHAR_PATTERN.test(url)) return false;
+  if (url.startsWith("//")) return false;
+  if (url.startsWith("/")) return true;
   try {
-    return new URL(url).origin === currentOrigin;
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+    if (parsed.username || parsed.password) return false;
+    return parsed.origin === currentOrigin;
   } catch {
     return false;
   }
@@ -485,7 +507,10 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
   if (Date.now() >= payload.exp * 1e3 + 6e4) {
     throw new SsoError("id_token_expired", "ID Token \u5DF2\u8FC7\u671F");
   }
-  if (typeof payload.iat === "number" && payload.iat * 1e3 > Date.now() + 6e4) {
+  if (typeof payload.iat !== "number") {
+    throw new SsoError("id_token_invalid", "ID Token \u7F3A\u5C11 iat \u58F0\u660E");
+  }
+  if (payload.iat * 1e3 > Date.now() + 6e4) {
     throw new SsoError("id_token_invalid", "ID Token iat \u5728\u672A\u6765\uFF0C\u7591\u4F3C\u4F2A\u9020\u6216\u65F6\u949F\u5F02\u5E38");
   }
   if (typeof payload.sub !== "string" || !payload.sub) {
@@ -502,11 +527,114 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
     if (!tokenNonce || !timingSafeEqualString(expectedNonce, tokenNonce)) {
       throw new SsoError("id_token_nonce_mismatch", "ID Token nonce \u4E0D\u5339\u914D");
     }
+  } else if (typeof payload.nonce === "string" && payload.nonce) {
+    throw new SsoError(
+      "id_token_nonce_mismatch",
+      "ID Token \u643A\u5E26 nonce \u4F46\u672C\u5730\u65E0\u671F\u671B\u503C\uFF08\u53EF\u80FD\u975E\u672C\u6B21\u767B\u5F55\u4F1A\u8BDD\u7B7E\u53D1\uFF09"
+    );
   }
   return { sub: payload.sub };
 }
 
+// src/core/http.ts
+var REQUEST_TIMEOUT_MS = 1e4;
+async function fetchWithTimeout(input, init = {}, timeoutMs = REQUEST_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(input, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // src/next/callback.ts
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (ch) => {
+    switch (ch) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      default:
+        return "&#39;";
+    }
+  });
+}
+function buildErrorPage(status, error, errorDescription) {
+  const safeDescription = escapeHtml(errorDescription);
+  const safeError = escapeHtml(error);
+  return `<!doctype html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<meta name="robots" content="noindex" />
+<title>\u767B\u5F55\u5931\u8D25</title>
+<style>
+  :root { color-scheme: light; }
+  body { margin: 0; font-family: system-ui, -apple-system, "PingFang SC", "Microsoft YaHei", sans-serif; background: #fafafa; color: #2c2c2c; }
+  main { min-height: 100vh; display: flex; flex-direction: column; align-items: center; justify-content: center; padding: 2rem; text-align: center; }
+  h1 { font-size: 1.25rem; font-weight: 500; letter-spacing: 0.08em; margin: 0 0 0.75rem; }
+  p { margin: 0 0 1.5rem; color: #6b7280; font-size: 0.875rem; line-height: 1.6; max-width: 28rem; }
+  .actions { display: flex; gap: 0.75rem; }
+  a { display: inline-block; padding: 0.6rem 1.4rem; font-size: 0.8125rem; letter-spacing: 0.08em; text-decoration: none; }
+  a.primary { background: #2c2c2c; color: #fff; }
+  a.secondary { border: 1px solid rgba(44, 44, 44, 0.25); color: #2c2c2c; }
+  .code { margin-top: 2rem; font-size: 0.6875rem; color: #9ca3af; }
+</style>
+</head>
+<body>
+<main>
+  <h1>\u767B\u5F55\u5931\u8D25</h1>
+  <p>${safeDescription}</p>
+  <div class="actions">
+    <a class="primary" href="/">\u91CD\u65B0\u767B\u5F55</a>
+    <a class="secondary" href="/">\u8FD4\u56DE\u9996\u9875</a>
+  </div>
+  <p class="code">\u9519\u8BEF\u7801\uFF1A${safeError}\uFF08\u53CD\u9988\u95EE\u9898\u65F6\u8BF7\u9644\u4E0A\uFF09</p>
+</main>
+</body>
+</html>`;
+}
+function buildErrorResponse(request, status, error, errorDescription, custom) {
+  if (custom) {
+    const handled = custom({ error, errorDescription, status, request });
+    if (handled instanceof Promise) {
+      return handled.then(
+        (res) => res ? toNextResponse(res) : defaultErrorResponse(request, status, error, errorDescription)
+      );
+    }
+    if (handled) return toNextResponse(handled);
+  }
+  return defaultErrorResponse(request, status, error, errorDescription);
+}
+function toNextResponse(res) {
+  if (res instanceof NextResponse2) return res;
+  return new NextResponse2(res.body, {
+    status: res.status,
+    statusText: res.statusText,
+    headers: res.headers
+  });
+}
+function defaultErrorResponse(request, status, error, errorDescription) {
+  const accept = request.headers.get("accept") ?? "";
+  const wantsHtml = accept.includes("text/html") && request.nextUrl.searchParams.get("format") !== "json";
+  if (wantsHtml) {
+    return new NextResponse2(buildErrorPage(status, error, errorDescription), {
+      status,
+      headers: {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store"
+      }
+    });
+  }
+  return NextResponse2.json({ error, error_description: errorDescription }, { status });
+}
 function createCallbackRouteHandler(config) {
   const {
     clientId,
@@ -514,6 +642,7 @@ function createCallbackRouteHandler(config) {
     redirectUri,
     clientSecret,
     defaultReturnPath = "/",
+    scopes,
     insecureLocalDev: insecureLocalDevOpt = false
   } = config;
   const insecureLocalDev = resolveInsecureLocalDev(insecureLocalDevOpt, ssoBaseUrl);
@@ -531,7 +660,21 @@ function createCallbackRouteHandler(config) {
   return async function GET(request) {
     const response = await handleCallback(request);
     if (response.status >= 400) {
+      if (config.debug) {
+        console.warn(
+          `[SSO SDK] \u56DE\u8C03\u5931\u8D25 status=${response.status}`,
+          request.nextUrl.searchParams.get("error") ?? ""
+        );
+      }
       response.cookies.set(nonceCookieName, "", getHostCookieOptions(0, secureCookies));
+      const returnedState = request.nextUrl.searchParams.get("state");
+      if (returnedState && /^[A-Za-z0-9\-._~]{8,512}$/.test(returnedState)) {
+        response.cookies.set(
+          `${nonceCookieName}_${returnedState}`,
+          "",
+          getHostCookieOptions(0, secureCookies)
+        );
+      }
     }
     return response;
   };
@@ -540,50 +683,75 @@ function createCallbackRouteHandler(config) {
     const error = searchParams.get("error");
     if (error) {
       const desc = searchParams.get("error_description") || error;
-      return NextResponse2.json(
-        { error: "authorization_failed", error_description: desc },
-        { status: 400 }
+      return buildErrorResponse(
+        request,
+        400,
+        "authorization_failed",
+        desc,
+        config.renderErrorPage
       );
     }
     const code = searchParams.get("code");
     const returnedState = searchParams.get("state");
     if (!code) {
-      return NextResponse2.json(
-        {
-          error: "invalid_request",
-          error_description: "\u7F3A\u5C11 authorization code"
-        },
-        { status: 400 }
+      return buildErrorResponse(
+        request,
+        400,
+        "invalid_request",
+        "\u767B\u5F55\u4FE1\u606F\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u767B\u5F55",
+        config.renderErrorPage
       );
     }
-    const savedState = request.cookies.get(stateCookieName)?.value;
+    if (!returnedState || !/^[A-Za-z0-9\-._~]{8,512}$/.test(returnedState)) {
+      return buildErrorResponse(
+        request,
+        400,
+        "invalid_request",
+        "State \u53C2\u6570\u7F3A\u5931\u6216\u683C\u5F0F\u975E\u6CD5\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u8BF7\u6C42",
+        config.renderErrorPage
+      );
+    }
+    const attemptSuffix = `_${returnedState}`;
+    const readTransientCookie = (name) => request.cookies.get(`${name}${attemptSuffix}`)?.value ?? request.cookies.get(name)?.value;
+    const savedState = readTransientCookie(stateCookieName);
     if (!savedState) {
-      return NextResponse2.json(
-        {
-          error: "invalid_request",
-          error_description: "State \u53C2\u6570\u7F3A\u5931\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u8BF7\u6C42"
-        },
-        { status: 400 }
+      const alternateName = secureCookies ? toInsecureCookieName(stateCookieName) : DEFAULT_STATE_COOKIE_NAME;
+      const alternateValue = request.cookies.get(`${alternateName}${attemptSuffix}`)?.value ?? request.cookies.get(alternateName)?.value;
+      if (alternateValue) {
+        return buildErrorResponse(
+          request,
+          500,
+          "invalid_config",
+          "\u68C0\u6D4B\u5230 SSO SDK \u914D\u7F6E\u4E0D\u4E00\u81F4\uFF1Amiddleware \u4E0E callback \u7684 insecureLocalDev \u6216 Cookie \u540D\u79F0\u4E0D\u5339\u914D\uFF0C\u8BF7\u7EDF\u4E00\u914D\u7F6E",
+          config.renderErrorPage
+        );
+      }
+      return buildErrorResponse(
+        request,
+        400,
+        "invalid_request",
+        "\u767B\u5F55\u4F1A\u8BDD\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u8BF7\u6C42",
+        config.renderErrorPage
       );
     }
-    if (!timingSafeEqualString(returnedState ?? "", savedState)) {
-      return NextResponse2.json(
-        {
-          error: "invalid_request",
-          error_description: "State \u53C2\u6570\u4E0D\u5339\u914D\uFF0C\u53EF\u80FD\u5B58\u5728 CSRF \u653B\u51FB"
-        },
-        { status: 400 }
+    if (!timingSafeEqualString(returnedState, savedState)) {
+      return buildErrorResponse(
+        request,
+        400,
+        "invalid_request",
+        "\u767B\u5F55\u4F1A\u8BDD\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u8BF7\u6C42",
+        config.renderErrorPage
       );
     }
-    const expectedNonce = request.cookies.get(nonceCookieName)?.value;
-    const verifier = request.cookies.get(verifierCookieName)?.value;
+    const expectedNonce = readTransientCookie(nonceCookieName);
+    const verifier = readTransientCookie(verifierCookieName);
     if (!verifier) {
-      return NextResponse2.json(
-        {
-          error: "invalid_request",
-          error_description: "PKCE verifier \u7F3A\u5931\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u8BF7\u6C42"
-        },
-        { status: 400 }
+      return buildErrorResponse(
+        request,
+        400,
+        "invalid_request",
+        "\u767B\u5F55\u4F1A\u8BDD\u5DF2\u8FC7\u671F\uFF08\u53EF\u80FD\u5207\u6362\u4E86\u6807\u7B7E\u9875\uFF09\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u767B\u5F55",
+        config.renderErrorPage
       );
     }
     const tokenEndpoint = `${normalizedServerBase}/api/oauth/token`;
@@ -604,27 +772,37 @@ function createCallbackRouteHandler(config) {
         await new Promise((r) => setTimeout(r, 1e3 * Math.pow(2, attempt - 1)));
       }
       try {
-        res = await fetch(tokenEndpoint, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: body.toString()
-        });
+        res = await fetchWithTimeout(
+          tokenEndpoint,
+          {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: body.toString()
+          },
+          1e4
+        );
         lastError = null;
         break;
       } catch (err) {
         lastError = err;
         if (attempt >= maxRetries) {
-          return NextResponse2.json(
-            { error: "server_error", error_description: "Token \u8BF7\u6C42\u5931\u8D25\uFF0C\u5DF2\u91CD\u8BD5\u4ECD\u4E0D\u53EF\u8FBE" },
-            { status: 502 }
+          return buildErrorResponse(
+            request,
+            502,
+            "server_error",
+            "\u767B\u5F55\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528\uFF08Token \u8BF7\u6C42\u5931\u8D25\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+            config.renderErrorPage
           );
         }
       }
     }
     if (lastError || !res) {
-      return NextResponse2.json(
-        { error: "server_error", error_description: "Token \u8BF7\u6C42\u5931\u8D25" },
-        { status: 502 }
+      return buildErrorResponse(
+        request,
+        502,
+        "server_error",
+        "\u767B\u5F55\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528\uFF08Token \u8BF7\u6C42\u5931\u8D25\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+        config.renderErrorPage
       );
     }
     if (!res.ok) {
@@ -633,22 +811,32 @@ function createCallbackRouteHandler(config) {
         errData = await res.json();
       } catch {
       }
-      return NextResponse2.json(
-        {
-          error: "token_request_failed",
-          error_description: errData.error_description || `Token \u8BF7\u6C42\u5931\u8D25: HTTP ${res.status}`
-        },
-        { status: 502 }
+      return buildErrorResponse(
+        request,
+        502,
+        "token_request_failed",
+        errData.error_description || `\u767B\u5F55\u5931\u8D25\uFF08Token \u8BF7\u6C42\u5931\u8D25: HTTP ${res.status}\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5`,
+        config.renderErrorPage
       );
     }
     const tokenData = await res.json();
-    if (!tokenData.access_token || !tokenData.refresh_token) {
-      return NextResponse2.json(
-        {
-          error: "server_error",
-          error_description: "Token \u54CD\u5E94\u7F3A\u5C11 access_token \u6216 refresh_token"
-        },
-        { status: 502 }
+    if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number" || !Number.isFinite(tokenData.expires_in) || tokenData.expires_in <= 0) {
+      return buildErrorResponse(
+        request,
+        502,
+        "server_error",
+        "\u767B\u5F55\u670D\u52A1\u8FD4\u56DE\u5F02\u5E38\uFF08Token \u54CD\u5E94\u4E0D\u5B8C\u6574\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+        config.renderErrorPage
+      );
+    }
+    const requiresIdToken = scopes !== void 0 && scopes.split(" ").filter(Boolean).includes("openid");
+    if (requiresIdToken && !tokenData.id_token) {
+      return buildErrorResponse(
+        request,
+        400,
+        "id_token_invalid",
+        "\u767B\u5F55\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u767B\u5F55",
+        config.renderErrorPage
       );
     }
     if (tokenData.id_token) {
@@ -661,17 +849,17 @@ function createCallbackRouteHandler(config) {
           { expectedNonce }
         );
       } catch (err) {
-        return NextResponse2.json(
-          {
-            error: "id_token_invalid",
-            error_description: err instanceof Error ? err.message : "ID Token \u9A8C\u8BC1\u5931\u8D25"
-          },
-          { status: 400 }
+        return buildErrorResponse(
+          request,
+          400,
+          "id_token_invalid",
+          err instanceof Error && /[\u4e00-\u9fff]/.test(err.message) ? err.message : "\u767B\u5F55\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u767B\u5F55",
+          config.renderErrorPage
         );
       }
     }
     const callbackOrigin = new URL(redirectUri).origin;
-    const rawReturnUrl = request.cookies.get(returnUrlCookieName)?.value || defaultReturnPath;
+    const rawReturnUrl = readTransientCookie(returnUrlCookieName) || defaultReturnPath;
     const returnUrl = isTrustedReturnUrl(rawReturnUrl, callbackOrigin) ? rawReturnUrl : "/";
     const response = NextResponse2.redirect(new URL(returnUrl, callbackOrigin));
     response.cookies.set(accessTokenCookieName, tokenData.access_token, {
@@ -701,11 +889,18 @@ function createCallbackRouteHandler(config) {
         });
       }
     }
-    response.cookies.set(stateCookieName, "", getHostCookieOptions(0, secureCookies));
-    response.cookies.set(nonceCookieName, "", getHostCookieOptions(0, secureCookies));
-    response.cookies.set(returnUrlCookieName, "", getHostCookieOptions(0, secureCookies));
-    response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, "/", secureCookies));
-    response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, request.nextUrl.pathname, secureCookies));
+    for (const name of [stateCookieName, nonceCookieName, returnUrlCookieName]) {
+      response.cookies.set(name, "", getHostCookieOptions(0, secureCookies));
+      response.cookies.set(`${name}${attemptSuffix}`, "", getHostCookieOptions(0, secureCookies));
+    }
+    for (const path of ["/", request.nextUrl.pathname]) {
+      response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, path, secureCookies));
+      response.cookies.set(
+        `${verifierCookieName}${attemptSuffix}`,
+        "",
+        getSecureCookieOptions(0, path, secureCookies)
+      );
+    }
     return response;
   }
 }
@@ -819,7 +1014,7 @@ function createLogoutRouteHandler(config) {
     const returnedState = request.nextUrl.searchParams.get("state");
     if (returnedState) {
       const savedState = request.cookies.get(logoutStateCookieName)?.value;
-      if (!savedState || savedState !== returnedState) {
+      if (!savedState || !timingSafeEqualString(savedState, returnedState)) {
         return NextResponse3.json(
           { error: "invalid_request", error_description: "Logout state \u4E0D\u5339\u914D" },
           { status: 400 }
@@ -835,6 +1030,20 @@ function createLogoutRouteHandler(config) {
         headers: { "content-type": "text/html; charset=utf-8" }
       });
     }
+    const requestOrigin = request.headers.get("origin");
+    if (requestOrigin && requestOrigin !== callbackOrigin) {
+      return NextResponse3.json(
+        { error: "forbidden", error_description: "\u8DE8\u7AD9\u8BF7\u6C42\u88AB\u62D2\u7EDD" },
+        { status: 403 }
+      );
+    }
+    const secFetchSite = request.headers.get("sec-fetch-site");
+    if (!requestOrigin && secFetchSite && secFetchSite !== "same-origin" && secFetchSite !== "none") {
+      return NextResponse3.json(
+        { error: "forbidden", error_description: "\u8DE8\u7AD9\u8BF7\u6C42\u88AB\u62D2\u7EDD" },
+        { status: 403 }
+      );
+    }
     let formGlobal = null;
     try {
       formGlobal = new URLSearchParams(await request.text()).get("global");
@@ -873,6 +1082,21 @@ function createLogoutRouteHandler(config) {
       res.cookies.set(returnUrlCookieName, "", getHostCookieOptions(0, secureCookies));
       res.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, "/", secureCookies));
       res.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, callbackPath, secureCookies));
+      const suffixedPrefixes = [
+        `${stateCookieName}_`,
+        `${nonceCookieName}_`,
+        `${returnUrlCookieName}_`,
+        `${verifierCookieName}_`
+      ];
+      for (const cookie of request.cookies.getAll()) {
+        if (!suffixedPrefixes.some((prefix) => cookie.name.startsWith(prefix))) continue;
+        if (cookie.name.startsWith(`${verifierCookieName}_`)) {
+          res.cookies.set(cookie.name, "", getSecureCookieOptions(0, "/", secureCookies));
+          res.cookies.set(cookie.name, "", getSecureCookieOptions(0, callbackPath, secureCookies));
+        } else {
+          res.cookies.set(cookie.name, "", getHostCookieOptions(0, secureCookies));
+        }
+      }
       return res;
     };
     if (effectiveScope === "global") {
@@ -906,6 +1130,20 @@ import { NextResponse as NextResponse4 } from "next/server";
 var BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
 var JTI_CACHE_CAPACITY = 1e3;
 var seenJti = /* @__PURE__ */ new Map();
+async function releaseLogoutTokenJti(replayKey, options = {}) {
+  const store = options.jtiStore;
+  if (store?.remove) {
+    await store.remove(replayKey);
+    return;
+  }
+  if (store) {
+    console.warn(
+      "[SSO SDK] \u81EA\u5B9A\u4E49 jtiStore \u672A\u5B9E\u73B0 remove()\uFF1AonLogout \u5931\u8D25\u540E\u65E0\u6CD5\u91CA\u653E jti\uFF0CIdP \u7528\u540C\u4E00 logout_token \u91CD\u6295\u5C06\u88AB\u91CD\u653E\u68C0\u67E5\u62D2\u7EDD\uFF08logout_token_replay\uFF09"
+    );
+    return;
+  }
+  seenJti.delete(replayKey);
+}
 function recordJti(jti, expiresAtMs) {
   const now = Date.now();
   const existing = seenJti.get(jti);
@@ -921,7 +1159,7 @@ function recordJti(jti, expiresAtMs) {
   seenJti.set(jti, expiresAtMs);
   return true;
 }
-async function verifyLogoutToken(logoutToken, ssoBaseUrl, clientId) {
+async function verifyLogoutTokenDetailed(logoutToken, ssoBaseUrl, clientId, options = {}) {
   const baseUrl = ssoBaseUrl.replace(/\/+$/, "");
   const header = decodeJwtHeader(logoutToken);
   if (!header) {
@@ -998,8 +1236,21 @@ async function verifyLogoutToken(logoutToken, ssoBaseUrl, clientId) {
   if (Date.now() >= payload.exp * 1e3 + 6e4) {
     throw new SsoError("logout_token_expired", "Logout Token \u5DF2\u8FC7\u671F");
   }
+  if (payload.type !== "logout_token") {
+    throw new SsoError(
+      "logout_token_invalid",
+      "Logout Token type \u5FC5\u987B\u4E3A logout_token"
+    );
+  }
   const events = payload.events;
-  if (!events || typeof events !== "object" || !(BACKCHANNEL_LOGOUT_EVENT in events)) {
+  if (!events || typeof events !== "object" || Array.isArray(events)) {
+    throw new SsoError(
+      "logout_token_invalid",
+      "Logout Token \u7F3A\u5C11 backchannel-logout events \u58F0\u660E"
+    );
+  }
+  const logoutEvent = events[BACKCHANNEL_LOGOUT_EVENT];
+  if (!logoutEvent || typeof logoutEvent !== "object" || Array.isArray(logoutEvent)) {
     throw new SsoError(
       "logout_token_invalid",
       "Logout Token \u7F3A\u5C11 backchannel-logout events \u58F0\u660E"
@@ -1017,10 +1268,27 @@ async function verifyLogoutToken(logoutToken, ssoBaseUrl, clientId) {
   if (!jti) {
     throw new SsoError("logout_token_invalid", "Logout Token \u7F3A\u5C11 jti \u58F0\u660E");
   }
-  if (!recordJti(jti, payload.exp * 1e3 + 6e4)) {
+  const replayKey = `${normalizedIssuer}:${jti}`;
+  const replayTtlSeconds = Math.max(
+    1,
+    Math.ceil((payload.exp * 1e3 + 6e4 - Date.now()) / 1e3)
+  );
+  const jtiStore = options.jtiStore;
+  if (jtiStore) {
+    if (jtiStore.addIfAbsent) {
+      if (!await jtiStore.addIfAbsent(replayKey, replayTtlSeconds)) {
+        throw new SsoError("logout_token_replay", "Logout Token jti \u91CD\u653E");
+      }
+    } else {
+      if (await jtiStore.has(replayKey)) {
+        throw new SsoError("logout_token_replay", "Logout Token jti \u91CD\u653E");
+      }
+      await jtiStore.add(replayKey, replayTtlSeconds);
+    }
+  } else if (!recordJti(replayKey, payload.exp * 1e3 + 6e4)) {
     throw new SsoError("logout_token_replay", "Logout Token jti \u91CD\u653E");
   }
-  return { sub, sid };
+  return { payload: { sub, sid }, jti, replayKey };
 }
 
 // src/next/backchannel-logout.ts
@@ -1060,9 +1328,11 @@ function createBackchannelLogoutRouteHandler(config) {
         { status: 400 }
       );
     }
-    let payload;
+    let verified;
     try {
-      payload = await verifyLogoutToken(logoutToken, ssoBaseUrl, clientId);
+      verified = await verifyLogoutTokenDetailed(logoutToken, ssoBaseUrl, clientId, {
+        jtiStore: config.jtiStore
+      });
     } catch (err) {
       const code = err instanceof SsoError ? err.code : "logout_token_invalid";
       const description = err instanceof SsoError ? err.description : "Logout Token \u9A8C\u8BC1\u5931\u8D25";
@@ -1072,8 +1342,9 @@ function createBackchannelLogoutRouteHandler(config) {
       );
     }
     try {
-      await onLogout?.(payload, request);
+      await onLogout?.(verified.payload, request);
     } catch (err) {
+      await releaseLogoutTokenJti(verified.replayKey, { jtiStore: config.jtiStore });
       console.error(
         "[SSO SDK] backchannel logout onLogout \u94A9\u5B50\u6267\u884C\u5931\u8D25:",
         err