@nihplod/sso-sdk 1.5.0 → 1.7.0

package/README.md

@@ -84,7 +84,7 @@ if (params.get("sso_probe") === "no_session") {
 
 ### `sso.handleCallback(callbackUrl)`
 
-Handle the OAuth callback. Parses `code` and `state` from the URL, validates state, and exchanges the code for tokens. When the requested scope includes `openid`, the token response **must** contain an `id_token` (fail-closed: a missing `id_token` is rejected instead of silently skipping validation). The SDK verifies the ID Token's signature, issuer, audience, expiry and `at_hash`, and — when the login was initiated via `login()` / `getLoginUrl()` / `loginPopup()` — also validates the OIDC `nonce` claim against the value generated at login time (constant-time comparison, protecting against ID Token replay; the check is skipped if no nonce is stored, e.g. when the Next.js nonce cookie has expired).
+Handle the OAuth callback. Parses `code` and `state` from the URL, validates state, and exchanges the code for tokens. When the requested scope includes `openid`, the token response **must** contain an `id_token` (fail-closed: a missing `id_token` is rejected instead of silently skipping validation). The SDK verifies the ID Token's signature, issuer, audience, expiry and `at_hash`, and — when the login was initiated via `login()` / `getLoginUrl()` / `loginPopup()` — also validates the OIDC `nonce` claim against the value generated at login time (constant-time comparison, protecting against ID Token replay). The check is fail-closed both ways: a stored nonce requires a matching token nonce, and (since 1.6.0) a token carrying a `nonce` claim while no expected nonce is stored locally (e.g. the nonce cookie/sessionStorage entry was evicted) is rejected as well.
 
 | Parameter | Type | Description |
 |------|------|------|
@@ -450,6 +450,8 @@ export const POST = createBackchannelLogoutRouteHandler({
 
 The backchannel handler receives `logout_token` pushes from the SSO center (OIDC Back-Channel Logout) when the user signs out globally or revokes consent, verifies the token (RS256 signature via JWKS, issuer/audience/expiry, `events` claim, `jti` replay protection), clears the SSO cookies, and calls your `onLogout` hook. If the hook throws, it responds 500 so the IdP retries delivery. **Remember to register this route's public URL as `backchannelLogoutUri` in the SSO admin console for your client.**
 
+> **jti replay storage (since 1.6.0):** the default replay cache is an in-memory per-instance Map. Multi-instance / serverless deployments MUST inject shared storage via the `jtiStore` option (e.g. Redis: `addIfAbsent` = `SET key 1 NX EX ttl`, `remove` = `DEL key` — `remove` lets the SDK release the jti so the IdP can redeliver after an `onLogout` failure; without it, redeliveries are rejected as replays).
+
 Trigger the logout endpoint with a POST request (recommended):
 
 ```tsx
@@ -469,7 +471,7 @@ Default cookie names:
 | access_token | `__Host-nihplod_sso_at` | Requires Secure + Path=/ + no Domain |
 | refresh_token | `__Host-nihplod_sso_rt` | Requires Secure + Path=/ + no Domain |
 | state | `__Host-nihplod_sso_state` | Requires Secure + Path=/ + no Domain |
-| nonce | `__Host-nihplod_sso_nonce` | OIDC nonce for ID Token replay protection. Validated when the nonce cookie is present (cookie TTL 10 minutes); if the cookie has expired, the nonce check is skipped. Requires Secure + Path=/ + no Domain |
+| nonce | `__Host-nihplod_sso_nonce` | OIDC nonce for ID Token replay protection. Validated fail-closed when the nonce cookie is present (cookie TTL 10 minutes); since 1.6.0, an id_token that carries a `nonce` while the cookie has expired is also rejected (restart the login flow). Requires Secure + Path=/ + no Domain |
 | id_token | `__Host-nihplod_sso_id` | ID token cookie used as `id_token_hint` for RP-Initiated Logout. Requires Secure + Path=/ + no Domain |
 | logout_state | `__Host-nihplod_sso_logout_state` | One-time logout state for CSRF protection on the RP-Initiated Logout callback. Requires Secure + Path=/ + no Domain |
 | return_url | `__Host-nihplod_sso_return` | Requires Secure + Path=/ + no Domain |
@@ -481,6 +483,23 @@ Default cookie names:
 
 ---
 
+## Changelog
+
+### 1.6.0
+
+Security and correctness hardening. Migration notes:
+
+- **ID Token must carry `iat`.** `validateIdToken` now rejects tokens without an `iat` claim (`id_token_invalid`). Any spec-compliant IdP already includes it.
+- **Nonce check fails closed.** An `id_token` that carries a `nonce` claim while no expected nonce is stored locally (e.g. the nonce cookie/sessionStorage entry was evicted) is now rejected with `id_token_nonce_mismatch` (OIDC Core §12.2), instead of silently skipping the check. Refresh-issued ID tokens must not carry `nonce` per spec, so the refresh flow is unaffected. If login fails with this error after upgrading, restart the login flow — do not downgrade the check.
+- **New `jtiStore` option** for `createBackchannelLogoutRouteHandler` / `verifyLogoutToken(Detailed)`. The default jti replay cache is an in-memory per-instance Map; multi-instance / serverless deployments MUST inject shared storage (e.g. Redis `SET NX EX` for `addIfAbsent`, `DEL` for `remove` — `remove` lets the SDK release the jti so the IdP can redeliver after your `onLogout` hook fails). Replay keys are now prefixed with the token issuer to prevent cross-issuer jti collisions.
+- **New `allowCrossOriginDiscoveryEndpoints` option** on `SsoClientConfig` (default `false`). Discovery documents whose `authorization_endpoint` is not same-origin with `ssoBaseUrl`, or whose `token_endpoint` / `userinfo_endpoint` is not same-origin with `ssoBaseUrl` (or `serverBaseUrl` when configured), are rejected with a warning and the SDK falls back to the default endpoints. Set this flag only if your SSO center genuinely hosts endpoints on another origin.
+- **Multi-tab token sync**: after a silent refresh, the new token data is broadcast to other tabs via `BroadcastChannel` and persisted directly (light shape check), so other tabs no longer attempt their own refresh with an already-rotated refresh_token. Older SDK tabs (no payload) fall back to the previous `loadUser()`-only behavior.
+- `handleCallback` now clears the one-time transient data (state/nonce/PKCE verifier/silent-probe marker) when the token endpoint returns an error (e.g. `invalid_grant`) or when the required `id_token` is missing — the authorization code is already consumed and retrying cannot succeed. Network failures and JWKS validation failures still retain the data for retry.
+- `getAccessToken()` / `getUserInfo()` refresh when the token has less than 10s of validity left (expiry skew), instead of returning a token that may expire in flight. `isAuthenticated()` intentionally keeps the exact check (it's a synchronous UI hint).
+- Next.js callback: the token exchange request now has a 10s timeout (previously unbounded) and still gets one retry before the 502 error page. RP-Initiated Logout state comparison is now constant-time. The middleware never asset-bypasses paths under `/api/` (e.g. `/api/app.js` no longer skips authentication; list public API paths in `publicPaths` explicitly).
+
+---
+
 ## Security Recommendations and Token Storage
 
 > ⚠️ **The Next.js middleware is only a UX gate.** It decides whether to redirect

package/dist/index.d.mts

@@ -112,6 +112,17 @@ interface SsoClientConfig {
     redirectUri: string;
     /** SSO 中心地址，如 "https://nihplod.cn" */
     ssoBaseUrl: string;
+    /**
+     * 允许 Discovery 文档声明跨源端点（默认 false）。
+     *
+     * ⚠️ 安全警告：Discovery 文档若被篡改（如中间人/反向代理劫持），攻击者可把
+     * token_endpoint 指向自己的服务器窃取 authorization code / refresh_token。
+     * SDK 默认校验 authorization_endpoint 必须与 ssoBaseUrl 同源、
+     * token_endpoint / userinfo_endpoint 必须与 ssoBaseUrl（或 serverBaseUrl）同源，
+     * 不匹配时告警并回退到默认端点。仅当 SSO 中心确实把端点托管在其他域名时
+     * 才设置此开关，并自行确保 Discovery 通道可信。
+     */
+    allowCrossOriginDiscoveryEndpoints?: boolean;
     /** 请求的 scope（空格分隔），如 "openid profile phone" */
     scopes?: string;
     /** RP-Initiated Logout 返回地址（可选）。不传时回退到 redirectUri */
@@ -195,6 +206,8 @@ declare class SsoClient {
     private _discovery;
     private _discoveryFetchedAt;
     private _refreshLock;
+    /** Discovery 端点 origin 校验失败只告警一次（拒绝的文档不缓存，避免每次调用刷屏） */
+    private _discoveryOriginWarned;
     /** Discovery 文档缓存 TTL（5 分钟） */
     private static readonly DISCOVERY_TTL_MS;
     /** Discovery fetch 超时（10 秒） */
@@ -206,6 +219,15 @@ declare class SsoClient {
      * 不会输出 token/授权码等敏感值。
      */
     debugLog(...args: unknown[]): void;
+    /**
+     * 校验 Discovery 文档端点 origin（防文档被篡改后 token/code 被导向攻击者服务器）：
+     * - authorization_endpoint 必须与 ssoBaseUrl 同源（浏览器跳转目标）；
+     * - token_endpoint / userinfo_endpoint 必须与 ssoBaseUrl 同源，
+     *   或（配置了 serverBaseUrl 时）与内网地址同源。
+     * 任一不匹配：告警并返回 null（上层回退到默认端点，fail-safe）。
+     * 可通过 config.allowCrossOriginDiscoveryEndpoints 关闭（见配置项警告）。
+     */
+    private _sanitizeDiscovery;
     /**
      * 获取 OIDC Discovery 文档（带缓存 + 超时）
      *
@@ -327,6 +349,9 @@ declare class SsoClient {
      * 检查是否已认证（不发起网络请求）
      *
      * 仅检查本地是否存在未过期的 access_token。
+     * 故意不做 EXPIRY_SKEW_MS 提前量：这是同步的 UI 提示判定（是否显示"已登录"），
+     * 提前 10s 翻转 false 会让调用方在 token 仍有效时误显示未登录；真正发请求的
+     * getAccessToken/getUserInfo 已带提前量。
      */
     isAuthenticated(): boolean;
     /**
@@ -401,7 +426,7 @@ declare function generateState(): string;
  * SSO SDK 错误类型
  */
 /** SSO 错误码 */
-type SsoErrorCode = "invalid_config" | "state_mismatch" | "pkce_required" | "token_request_failed" | "session_expired" | "no_refresh_token" | "userinfo_failed" | "not_authenticated" | "authorization_code_expired" | "authorization_code_used" | "client_disabled" | "user_denied_authorization" | "account_disabled" | "sso_server_error" | "rate_limited" | "network_error" | "popup_blocked" | "popup_closed" | "id_token_invalid" | "id_token_unsupported_alg" | "id_token_hs256_unsupported" | "id_token_missing_secret" | "id_token_invalid_signature" | "id_token_issuer_mismatch" | "id_token_audience_mismatch" | "id_token_expired" | "id_token_missing_sub" | "id_token_at_hash_mismatch" | "id_token_nonce_mismatch" | "logout_token_invalid" | "logout_token_unsupported_alg" | "logout_token_invalid_signature" | "logout_token_issuer_mismatch" | "logout_token_audience_mismatch" | "logout_token_expired" | "logout_token_replay";
+type SsoErrorCode = "invalid_config" | "state_mismatch" | "issuer_mismatch" | "pkce_required" | "token_request_failed" | "session_expired" | "no_refresh_token" | "userinfo_failed" | "not_authenticated" | "authorization_code_expired" | "authorization_code_used" | "client_disabled" | "user_denied_authorization" | "account_disabled" | "sso_server_error" | "rate_limited" | "network_error" | "popup_blocked" | "popup_closed" | "id_token_invalid" | "id_token_unsupported_alg" | "id_token_hs256_unsupported" | "id_token_missing_secret" | "id_token_invalid_signature" | "id_token_issuer_mismatch" | "id_token_audience_mismatch" | "id_token_expired" | "id_token_missing_sub" | "id_token_at_hash_mismatch" | "id_token_nonce_mismatch" | "logout_token_invalid" | "logout_token_unsupported_alg" | "logout_token_invalid_signature" | "logout_token_issuer_mismatch" | "logout_token_audience_mismatch" | "logout_token_expired" | "logout_token_replay";
 /**
  * 将 OAuth 2.0 服务端 error 字段映射到 SsoErrorCode
  *

package/dist/index.d.ts

@@ -112,6 +112,17 @@ interface SsoClientConfig {
     redirectUri: string;
     /** SSO 中心地址，如 "https://nihplod.cn" */
     ssoBaseUrl: string;
+    /**
+     * 允许 Discovery 文档声明跨源端点（默认 false）。
+     *
+     * ⚠️ 安全警告：Discovery 文档若被篡改（如中间人/反向代理劫持），攻击者可把
+     * token_endpoint 指向自己的服务器窃取 authorization code / refresh_token。
+     * SDK 默认校验 authorization_endpoint 必须与 ssoBaseUrl 同源、
+     * token_endpoint / userinfo_endpoint 必须与 ssoBaseUrl（或 serverBaseUrl）同源，
+     * 不匹配时告警并回退到默认端点。仅当 SSO 中心确实把端点托管在其他域名时
+     * 才设置此开关，并自行确保 Discovery 通道可信。
+     */
+    allowCrossOriginDiscoveryEndpoints?: boolean;
     /** 请求的 scope（空格分隔），如 "openid profile phone" */
     scopes?: string;
     /** RP-Initiated Logout 返回地址（可选）。不传时回退到 redirectUri */
@@ -195,6 +206,8 @@ declare class SsoClient {
     private _discovery;
     private _discoveryFetchedAt;
     private _refreshLock;
+    /** Discovery 端点 origin 校验失败只告警一次（拒绝的文档不缓存，避免每次调用刷屏） */
+    private _discoveryOriginWarned;
     /** Discovery 文档缓存 TTL（5 分钟） */
     private static readonly DISCOVERY_TTL_MS;
     /** Discovery fetch 超时（10 秒） */
@@ -206,6 +219,15 @@ declare class SsoClient {
      * 不会输出 token/授权码等敏感值。
      */
     debugLog(...args: unknown[]): void;
+    /**
+     * 校验 Discovery 文档端点 origin（防文档被篡改后 token/code 被导向攻击者服务器）：
+     * - authorization_endpoint 必须与 ssoBaseUrl 同源（浏览器跳转目标）；
+     * - token_endpoint / userinfo_endpoint 必须与 ssoBaseUrl 同源，
+     *   或（配置了 serverBaseUrl 时）与内网地址同源。
+     * 任一不匹配：告警并返回 null（上层回退到默认端点，fail-safe）。
+     * 可通过 config.allowCrossOriginDiscoveryEndpoints 关闭（见配置项警告）。
+     */
+    private _sanitizeDiscovery;
     /**
      * 获取 OIDC Discovery 文档（带缓存 + 超时）
      *
@@ -327,6 +349,9 @@ declare class SsoClient {
      * 检查是否已认证（不发起网络请求）
      *
      * 仅检查本地是否存在未过期的 access_token。
+     * 故意不做 EXPIRY_SKEW_MS 提前量：这是同步的 UI 提示判定（是否显示"已登录"），
+     * 提前 10s 翻转 false 会让调用方在 token 仍有效时误显示未登录；真正发请求的
+     * getAccessToken/getUserInfo 已带提前量。
      */
     isAuthenticated(): boolean;
     /**
@@ -401,7 +426,7 @@ declare function generateState(): string;
  * SSO SDK 错误类型
  */
 /** SSO 错误码 */
-type SsoErrorCode = "invalid_config" | "state_mismatch" | "pkce_required" | "token_request_failed" | "session_expired" | "no_refresh_token" | "userinfo_failed" | "not_authenticated" | "authorization_code_expired" | "authorization_code_used" | "client_disabled" | "user_denied_authorization" | "account_disabled" | "sso_server_error" | "rate_limited" | "network_error" | "popup_blocked" | "popup_closed" | "id_token_invalid" | "id_token_unsupported_alg" | "id_token_hs256_unsupported" | "id_token_missing_secret" | "id_token_invalid_signature" | "id_token_issuer_mismatch" | "id_token_audience_mismatch" | "id_token_expired" | "id_token_missing_sub" | "id_token_at_hash_mismatch" | "id_token_nonce_mismatch" | "logout_token_invalid" | "logout_token_unsupported_alg" | "logout_token_invalid_signature" | "logout_token_issuer_mismatch" | "logout_token_audience_mismatch" | "logout_token_expired" | "logout_token_replay";
+type SsoErrorCode = "invalid_config" | "state_mismatch" | "issuer_mismatch" | "pkce_required" | "token_request_failed" | "session_expired" | "no_refresh_token" | "userinfo_failed" | "not_authenticated" | "authorization_code_expired" | "authorization_code_used" | "client_disabled" | "user_denied_authorization" | "account_disabled" | "sso_server_error" | "rate_limited" | "network_error" | "popup_blocked" | "popup_closed" | "id_token_invalid" | "id_token_unsupported_alg" | "id_token_hs256_unsupported" | "id_token_missing_secret" | "id_token_invalid_signature" | "id_token_issuer_mismatch" | "id_token_audience_mismatch" | "id_token_expired" | "id_token_missing_sub" | "id_token_at_hash_mismatch" | "id_token_nonce_mismatch" | "logout_token_invalid" | "logout_token_unsupported_alg" | "logout_token_invalid_signature" | "logout_token_issuer_mismatch" | "logout_token_audience_mismatch" | "logout_token_expired" | "logout_token_replay";
 /**
  * 将 OAuth 2.0 服务端 error 字段映射到 SsoErrorCode
  *

package/dist/index.js

@@ -143,24 +143,6 @@ var SILENT_PROBE_KEY = "silent_probe";
 function buildKey(base, clientId) {
   return clientId ? `${base}:${clientId}` : base;
 }
-function createMemoryStorageAdapter() {
-  const store = /* @__PURE__ */ new Map();
-  return {
-    get(key) {
-      return store.get(key) ?? null;
-    },
-    set(key, value) {
-      store.set(key, value);
-    },
-    remove(key) {
-      store.delete(key);
-    },
-    keys() {
-      return [...store.keys()];
-    }
-  };
-}
-var memoryStorageAdapter = createMemoryStorageAdapter();
 var localStorageAdapter = {
   get(key) {
     try {
@@ -482,7 +464,19 @@ async function fetchJwks(baseUrl, options = {}) {
     return cachedJwks.jwks;
   }
   const discovery = await fetchDiscoveryDoc(baseUrl);
-  const jwksUri = discovery?.jwks_uri || `${baseUrl}/api/oauth/jwks`;
+  let jwksUri = `${baseUrl}/api/oauth/jwks`;
+  if (discovery?.jwks_uri) {
+    try {
+      if (new URL(discovery.jwks_uri).origin === new URL(baseUrl).origin) {
+        jwksUri = discovery.jwks_uri;
+      } else {
+        console.warn(
+          "[SSO SDK] Discovery \u7684 jwks_uri \u4E0E ssoBaseUrl \u4E0D\u540C\u6E90\uFF0C\u5DF2\u5FFD\u7565\u5E76\u4F7F\u7528\u9ED8\u8BA4 JWKS \u7AEF\u70B9"
+        );
+      }
+    } catch {
+    }
+  }
   try {
     const res = await fetch(jwksUri, {
       signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
@@ -612,7 +606,10 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
   if (Date.now() >= payload.exp * 1e3 + 6e4) {
     throw new SsoError("id_token_expired", "ID Token \u5DF2\u8FC7\u671F");
   }
-  if (typeof payload.iat === "number" && payload.iat * 1e3 > Date.now() + 6e4) {
+  if (typeof payload.iat !== "number") {
+    throw new SsoError("id_token_invalid", "ID Token \u7F3A\u5C11 iat \u58F0\u660E");
+  }
+  if (payload.iat * 1e3 > Date.now() + 6e4) {
     throw new SsoError("id_token_invalid", "ID Token iat \u5728\u672A\u6765\uFF0C\u7591\u4F3C\u4F2A\u9020\u6216\u65F6\u949F\u5F02\u5E38");
   }
   if (typeof payload.sub !== "string" || !payload.sub) {
@@ -629,13 +626,17 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
     if (!tokenNonce || !timingSafeEqualString(expectedNonce, tokenNonce)) {
       throw new SsoError("id_token_nonce_mismatch", "ID Token nonce \u4E0D\u5339\u914D");
     }
+  } else if (typeof payload.nonce === "string" && payload.nonce) {
+    throw new SsoError(
+      "id_token_nonce_mismatch",
+      "ID Token \u643A\u5E26 nonce \u4F46\u672C\u5730\u65E0\u671F\u671B\u503C\uFF08\u53EF\u80FD\u975E\u672C\u6B21\u767B\u5F55\u4F1A\u8BDD\u7B7E\u53D1\uFF09"
+    );
   }
   return { sub: payload.sub };
 }
 
-// src/core/SsoClient.ts
+// src/core/http.ts
 var REQUEST_TIMEOUT_MS = 1e4;
-var REVOKE_TIMEOUT_MS = 3e3;
 async function fetchWithTimeout(input, init = {}, timeoutMs = REQUEST_TIMEOUT_MS) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -645,6 +646,10 @@ async function fetchWithTimeout(input, init = {}, timeoutMs = REQUEST_TIMEOUT_MS
     clearTimeout(timer);
   }
 }
+
+// src/core/SsoClient.ts
+var REVOKE_TIMEOUT_MS = 3e3;
+var EXPIRY_SKEW_MS = 1e4;
 function assertValidTokenResponse(data, requireRefreshToken) {
   if (typeof data.access_token !== "string" || !data.access_token) {
     throw new SsoError("token_request_failed", "Token \u54CD\u5E94\u7F3A\u5C11 access_token");
@@ -662,16 +667,14 @@ function assertValidTokenResponse(data, requireRefreshToken) {
     );
   }
 }
-var SILENT_PROBE_ERRORS = /* @__PURE__ */ new Set([
-  "login_required",
-  "consent_required",
-  "interaction_required"
-]);
+var SILENT_PROBE_ERRORS = /* @__PURE__ */ new Set(["login_required", "consent_required", "interaction_required"]);
 var _SsoClient = class _SsoClient {
   constructor(config) {
     this._discovery = null;
     this._discoveryFetchedAt = 0;
     this._refreshLock = null;
+    /** Discovery 端点 origin 校验失败只告警一次（拒绝的文档不缓存，避免每次调用刷屏） */
+    this._discoveryOriginWarned = false;
     if (!config.clientId) throw new SsoError("invalid_config", "clientId \u4E0D\u80FD\u4E3A\u7A7A");
     if (!config.redirectUri) throw new SsoError("invalid_config", "redirectUri \u4E0D\u80FD\u4E3A\u7A7A");
     if (!config.ssoBaseUrl) throw new SsoError("invalid_config", "ssoBaseUrl \u4E0D\u80FD\u4E3A\u7A7A");
@@ -695,6 +698,68 @@ var _SsoClient = class _SsoClient {
   // ============================================
   // 内部方法
   // ============================================
+  /**
+   * 校验 Discovery 文档端点 origin（防文档被篡改后 token/code 被导向攻击者服务器）：
+   * - authorization_endpoint 必须与 ssoBaseUrl 同源（浏览器跳转目标）；
+   * - token_endpoint / userinfo_endpoint 必须与 ssoBaseUrl 同源，
+   *   或（配置了 serverBaseUrl 时）与内网地址同源。
+   * 任一不匹配：告警并返回 null（上层回退到默认端点，fail-safe）。
+   * 可通过 config.allowCrossOriginDiscoveryEndpoints 关闭（见配置项警告）。
+   */
+  _sanitizeDiscovery(d) {
+    if (this.config.allowCrossOriginDiscoveryEndpoints) return d;
+    const allowedOrigins = /* @__PURE__ */ new Set();
+    try {
+      allowedOrigins.add(new URL(this.config.ssoBaseUrl).origin);
+      allowedOrigins.add(new URL(this._serverBase).origin);
+    } catch {
+      return null;
+    }
+    const sameOrigin = (endpoint) => {
+      try {
+        return allowedOrigins.has(new URL(endpoint).origin);
+      } catch {
+        return false;
+      }
+    };
+    const publicOrigin = new URL(this.config.ssoBaseUrl).origin;
+    let authorizationOk = false;
+    try {
+      authorizationOk = new URL(d.authorization_endpoint).origin === publicOrigin;
+    } catch {
+      authorizationOk = false;
+    }
+    const bad = [];
+    if (!authorizationOk) bad.push("authorization_endpoint");
+    if (!sameOrigin(d.token_endpoint)) bad.push("token_endpoint");
+    if (!sameOrigin(d.userinfo_endpoint)) bad.push("userinfo_endpoint");
+    if (d.jwks_uri && !sameOrigin(d.jwks_uri)) bad.push("jwks_uri");
+    if (d.revocation_endpoint && !sameOrigin(d.revocation_endpoint)) {
+      bad.push("revocation_endpoint");
+    }
+    if (d.introspection_endpoint && !sameOrigin(d.introspection_endpoint)) {
+      bad.push("introspection_endpoint");
+    }
+    if (d.end_session_endpoint) {
+      try {
+        if (new URL(d.end_session_endpoint).origin !== publicOrigin) {
+          bad.push("end_session_endpoint");
+        }
+      } catch {
+        bad.push("end_session_endpoint");
+      }
+    }
+    if (bad.length > 0) {
+      if (!this._discoveryOriginWarned) {
+        this._discoveryOriginWarned = true;
+        console.warn(
+          `[SSO SDK] OIDC Discovery \u7AEF\u70B9 origin \u4E0E ssoBaseUrl/serverBaseUrl \u4E0D\u5339\u914D\uFF08${bad.join(", ")}\uFF09\uFF0C\u5DF2\u56DE\u9000\u5230\u9ED8\u8BA4\u7AEF\u70B9\u3002\u82E5 SSO \u4E2D\u5FC3\u786E\u5B9E\u6258\u7BA1\u8DE8\u6E90\u7AEF\u70B9\uFF0C\u8BF7\u8BBE\u7F6E allowCrossOriginDiscoveryEndpoints: true`
+        );
+      }
+      return null;
+    }
+    return d;
+  }
   /**
    * 获取 OIDC Discovery 文档（带缓存 + 超时）
    *
@@ -709,19 +774,17 @@ var _SsoClient = class _SsoClient {
     const url = `${this._serverBase}/api/oauth/.well-known/openid-configuration`;
     try {
       const controller = new AbortController();
-      const timeoutId = setTimeout(
-        () => controller.abort(),
-        _SsoClient.DISCOVERY_TIMEOUT_MS
-      );
+      const timeoutId = setTimeout(() => controller.abort(), _SsoClient.DISCOVERY_TIMEOUT_MS);
       const res = await fetch(url, { signal: controller.signal });
       clearTimeout(timeoutId);
       if (!res.ok) {
-        console.warn(
-          `[SSO SDK] OIDC Discovery \u8BF7\u6C42\u5931\u8D25: HTTP ${res.status}, \u56DE\u9000\u5230\u9ED8\u8BA4\u7AEF\u70B9`
-        );
+        console.warn(`[SSO SDK] OIDC Discovery \u8BF7\u6C42\u5931\u8D25: HTTP ${res.status}, \u56DE\u9000\u5230\u9ED8\u8BA4\u7AEF\u70B9`);
         return null;
       }
-      this._discovery = await res.json();
+      const doc = await res.json();
+      const sanitized = this._sanitizeDiscovery(doc);
+      if (!sanitized) return null;
+      this._discovery = sanitized;
       this._discoveryFetchedAt = now;
       return this._discovery;
     } catch (err) {
@@ -930,10 +993,7 @@ var _SsoClient = class _SsoClient {
       removeOAuthState(this.config.clientId);
       removeOAuthNonce(this.config.clientId);
       removePkceVerifier(`${this.config.clientId}_popup_nonce`);
-      throw new SsoError(
-        "popup_blocked",
-        "\u5F39\u7A97\u88AB\u6D4F\u89C8\u5668\u62E6\u622A\uFF0C\u8BF7\u5141\u8BB8\u5F39\u7A97\u540E\u91CD\u8BD5"
-      );
+      throw new SsoError("popup_blocked", "\u5F39\u7A97\u88AB\u6D4F\u89C8\u5668\u62E6\u622A\uFF0C\u8BF7\u5141\u8BB8\u5F39\u7A97\u540E\u91CD\u8BD5");
     }
     const redirectUriOrigin = new URL(this.config.redirectUri).origin;
     try {
@@ -962,9 +1022,7 @@ var _SsoClient = class _SsoClient {
           }
           this.handleCallback(event.data.callbackUrl).then((tokenData) => {
             if (tokenData === null) {
-              reject(
-                new SsoError("not_authenticated", "SSO \u4F1A\u8BDD\u4E0D\u5B58\u5728\uFF08\u9759\u9ED8\u63A2\u6D4B\u65E0\u4F1A\u8BDD\uFF09")
-              );
+              reject(new SsoError("not_authenticated", "SSO \u4F1A\u8BDD\u4E0D\u5B58\u5728\uFF08\u9759\u9ED8\u63A2\u6D4B\u65E0\u4F1A\u8BDD\uFF09"));
               return;
             }
             resolve(tokenData);
@@ -975,12 +1033,7 @@ var _SsoClient = class _SsoClient {
             if (!completed) {
               completed = true;
               cleanup();
-              reject(
-                new SsoError(
-                  "popup_closed",
-                  "\u767B\u5F55\u7A97\u53E3\u5DF2\u5173\u95ED"
-                )
-              );
+              reject(new SsoError("popup_closed", "\u767B\u5F55\u7A97\u53E3\u5DF2\u5173\u95ED"));
             }
           }
         }, 500);
@@ -1047,18 +1100,24 @@ var _SsoClient = class _SsoClient {
       removeOAuthNonce(this.config.clientId);
       removePkceVerifier(this.config.clientId);
       removeSilentProbe(this.config.clientId);
-      throw new SsoError(
-        "state_mismatch",
-        "State \u53C2\u6570\u4E0D\u5339\u914D\uFF0C\u53EF\u80FD\u5B58\u5728 CSRF \u653B\u51FB"
-      );
+      throw new SsoError("state_mismatch", "State \u53C2\u6570\u4E0D\u5339\u914D\uFF0C\u53EF\u80FD\u5B58\u5728 CSRF \u653B\u51FB");
+    }
+    const returnedIss = params.get("iss");
+    if (returnedIss) {
+      const discovery = await this._getDiscovery();
+      const expectedIssuer = (discovery?.issuer || this.config.ssoBaseUrl).replace(/\/+$/, "");
+      if (returnedIss.replace(/\/+$/, "") !== expectedIssuer) {
+        removeOAuthState(this.config.clientId);
+        removeOAuthNonce(this.config.clientId);
+        removePkceVerifier(this.config.clientId);
+        removeSilentProbe(this.config.clientId);
+        throw new SsoError("issuer_mismatch", "\u6388\u6743\u54CD\u5E94 issuer \u4E0D\u5339\u914D\uFF0C\u53EF\u80FD\u5B58\u5728 IdP \u6DF7\u53E0\u653B\u51FB");
+      }
     }
     const expectedNonce = getOAuthNonce(this.config.clientId) ?? void 0;
     const verifier = getPkceVerifier(this.config.clientId);
     if (!verifier) {
-      throw new SsoError(
-        "pkce_required",
-        "code_verifier \u4E0D\u5B58\u5728\uFF08\u53EF\u80FD\u5DF2\u8FC7\u671F\u6216\u6765\u81EA\u5176\u4ED6\u6807\u7B7E\u9875\uFF09"
-      );
+      throw new SsoError("pkce_required", "code_verifier \u4E0D\u5B58\u5728\uFF08\u53EF\u80FD\u5DF2\u8FC7\u671F\u6216\u6765\u81EA\u5176\u4ED6\u6807\u7B7E\u9875\uFF09");
     }
     const tokenEndpoint = await this._getTokenEndpoint();
     const body = new URLSearchParams();
@@ -1081,6 +1140,10 @@ var _SsoClient = class _SsoClient {
       throw new SsoError("network_error", "\u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25", err);
     }
     if (!res.ok) {
+      removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
+      removePkceVerifier(this.config.clientId);
+      removeSilentProbe(this.config.clientId);
       let errData = {};
       try {
         errData = await res.json();
@@ -1096,11 +1159,12 @@ var _SsoClient = class _SsoClient {
     assertValidTokenResponse(data, true);
     const requestedScopes = (this.config.scopes || "openid profile").split(" ").filter(Boolean);
     if (requestedScopes.includes("openid") && !data.id_token) {
+      removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
+      removePkceVerifier(this.config.clientId);
+      removeSilentProbe(this.config.clientId);
       removeTokenData(this.config.clientId);
-      throw new SsoError(
-        "id_token_invalid",
-        "Token \u54CD\u5E94\u7F3A\u5C11 id_token\uFF08scope \u542B openid \u65F6\u5FC5\u9700\uFF09"
-      );
+      throw new SsoError("id_token_invalid", "Token \u54CD\u5E94\u7F3A\u5C11 id_token\uFF08scope \u542B openid \u65F6\u5FC5\u9700\uFF09");
     }
     if (data.id_token) {
       try {
@@ -1165,19 +1229,14 @@ var _SsoClient = class _SsoClient {
     }
     let res = null;
     let lastErr;
-    for (let attempt = 0; attempt < 2; attempt++) {
-      try {
-        res = await fetchWithTimeout(tokenEndpoint, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: body.toString()
-        });
-        lastErr = null;
-        break;
-      } catch (err) {
-        lastErr = err;
-        if (attempt < 1) await new Promise((r) => setTimeout(r, 1e3));
-      }
+    try {
+      res = await fetchWithTimeout(tokenEndpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString()
+      });
+    } catch (err) {
+      lastErr = err;
     }
     if (lastErr || !res) {
       throw new SsoError("network_error", "\u5237\u65B0 Token \u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25", lastErr);
@@ -1240,7 +1299,7 @@ var _SsoClient = class _SsoClient {
     if (!tokenData) {
       throw new SsoError("not_authenticated", "\u672A\u767B\u5F55");
     }
-    if (Date.now() >= tokenData.expires_at) {
+    if (Date.now() >= tokenData.expires_at - EXPIRY_SKEW_MS) {
       tokenData = await this.refreshToken();
     }
     const userinfoEndpoint = await this._getUserinfoEndpoint();
@@ -1259,10 +1318,7 @@ var _SsoClient = class _SsoClient {
         removeTokenData(this.config.clientId);
         throw new SsoError("not_authenticated", "Token \u5DF2\u5931\u6548");
       }
-      throw new SsoError(
-        "userinfo_failed",
-        `\u83B7\u53D6\u7528\u6237\u4FE1\u606F\u5931\u8D25: HTTP ${res.status}`
-      );
+      throw new SsoError("userinfo_failed", `\u83B7\u53D6\u7528\u6237\u4FE1\u606F\u5931\u8D25: HTTP ${res.status}`);
     }
     return await res.json();
   }
@@ -1275,7 +1331,7 @@ var _SsoClient = class _SsoClient {
   async getAccessToken() {
     let tokenData = getTokenData(this.config.clientId);
     if (!tokenData) return null;
-    if (Date.now() >= tokenData.expires_at) {
+    if (Date.now() >= tokenData.expires_at - EXPIRY_SKEW_MS) {
       tokenData = await this.refreshToken();
     }
     return tokenData.access_token;
@@ -1284,6 +1340,9 @@ var _SsoClient = class _SsoClient {
    * 检查是否已认证（不发起网络请求）
    *
    * 仅检查本地是否存在未过期的 access_token。
+   * 故意不做 EXPIRY_SKEW_MS 提前量：这是同步的 UI 提示判定（是否显示"已登录"），
+   * 提前 10s 翻转 false 会让调用方在 token 仍有效时误显示未登录；真正发请求的
+   * getAccessToken/getUserInfo 已带提前量。
    */
   isAuthenticated() {
     const tokenData = getTokenData(this.config.clientId);
@@ -1319,7 +1378,7 @@ var _SsoClient = class _SsoClient {
         if (this.config.clientSecret) {
           revokeBody.set("client_secret", this.config.clientSecret);
         }
-        await fetchWithTimeout(
+        const doRevoke = () => fetchWithTimeout(
           revokeUrl,
           {
             method: "POST",
@@ -1328,6 +1387,14 @@ var _SsoClient = class _SsoClient {
           },
           REVOKE_TIMEOUT_MS
         );
+        let res = await doRevoke();
+        if (!res.ok && (res.status >= 500 || res.status === 429)) {
+          await new Promise((resolve) => setTimeout(resolve, 300));
+          res = await doRevoke();
+        }
+        if (!res.ok) {
+          this.debugLog("logout: \u670D\u52A1\u7AEF\u64A4\u9500 refresh_token \u5931\u8D25", { status: res.status });
+        }
       } catch {
       }
     }
@@ -1338,10 +1405,7 @@ var _SsoClient = class _SsoClient {
       logoutUrl.searchParams.set("client_id", this.config.clientId);
       const postLogoutUri = this.config.postLogoutRedirectUri || this.config.redirectUri;
       if (postLogoutUri) {
-        logoutUrl.searchParams.set(
-          "post_logout_redirect_uri",
-          postLogoutUri
-        );
+        logoutUrl.searchParams.set("post_logout_redirect_uri", postLogoutUri);
       }
       if (idTokenHint) {
         logoutUrl.searchParams.set("id_token_hint", idTokenHint);