@nuxtjs/better-auth 0.3.0 → 0.3.2

package/dist/runtime/app/composables/runWithSessionRefresh.js

@@ -5,8 +5,9 @@ export async function runWithSessionRefresh(runner) {
   if (typeof runner !== "function")
     throw new TypeError("runWithSessionRefresh(runner) requires an async function");
   const auth = useUserSession();
+  const wasLoggedIn = auth.loggedIn.value;
   const result = await runner();
   if (!isAuthActionErrorResult(result))
-    await refreshSessionAfterAuthAction(auth.fetchSession, auth.loggedIn, auth.waitForSession);
+    await refreshSessionAfterAuthAction(auth.fetchSession, auth.loggedIn, auth.waitForSession, true, wasLoggedIn);
   return result;
 }

package/dist/runtime/app/composables/useAuthRequestFetch.d.ts

@@ -6,6 +6,6 @@ type AuthRequestFetchExtractedMethod<Options> = Options extends undefined ? 'get
 } ? Method : never, undefined>, string>> extends infer NormalizedMethod extends string ? NormalizedMethod : 'get';
 type AuthRequestFetchMethodFromOptions<Options> = RequestFetchOptions extends Options ? 'get' : AuthRequestFetchExtractedMethod<Options>;
 type AuthRequestFetchResolvedMethod<Path extends AuthApiEndpointPath, Options> = Extract<AuthRequestFetchMethodFromOptions<Options>, AuthApiEndpointMethod<Path>> extends infer Method extends string ? Method : never;
-type AuthRequestFetch = <Path extends AuthApiEndpointPath, Options extends RequestFetchOptions = RequestFetchOptions>(request: Path, opts?: Options) => Promise<AuthApiEndpointResponse<Path, Extract<AuthRequestFetchResolvedMethod<Path, Options>, AuthApiEndpointMethod<Path>>>>;
+type AuthRequestFetch = <Path extends AuthApiEndpointPath & ('/api/auth' | `/api/auth/${string}`), Options extends RequestFetchOptions = RequestFetchOptions>(request: Path, opts?: Options) => Promise<AuthApiEndpointResponse<Path, Extract<AuthRequestFetchResolvedMethod<Path, Options>, AuthApiEndpointMethod<Path>>>>;
 export declare function useAuthRequestFetch(): AuthRequestFetch & ReturnType<typeof useRequestFetch>;
 export {};

package/dist/runtime/app/composables/useAuthRequestFetch.js

@@ -1,4 +1,24 @@
-import { useRequestFetch } from "#imports";
+import createAppAuthClient from "#auth/client";
+import { joinURL } from "ufo";
+import { useRequestFetch, useRuntimeConfig } from "#imports";
 export function useAuthRequestFetch() {
-  return useRequestFetch();
+  const requestFetch = useRequestFetch();
+  const runtimeConfig = useRuntimeConfig();
+  const authRuntimeConfig = runtimeConfig.public.auth;
+  if (!authRuntimeConfig?.clientOnly)
+    return requestFetch;
+  const siteUrl = runtimeConfig.public.siteUrl;
+  const clientOptions = createAppAuthClient.resolveOptions(siteUrl);
+  const configuredBaseURL = clientOptions.baseURL ?? siteUrl;
+  const baseURL = configuredBaseURL && new URL(configuredBaseURL).pathname.replace(/\/+$/, "") ? configuredBaseURL : joinURL(configuredBaseURL || "/", clientOptions.basePath ?? "/api/auth");
+  const externalRequestFetch = requestFetch;
+  return ((request, opts) => {
+    if (typeof request !== "string" || !/^\/api\/auth(?=\/|$)/.test(request))
+      return externalRequestFetch(request, opts);
+    return externalRequestFetch(request.slice("/api/auth".length), {
+      ...opts,
+      baseURL,
+      credentials: "include"
+    });
+  });
 }

package/dist/runtime/app/composables/useSignIn.d.ts

@@ -1,9 +1,6 @@
-import type { AppAuthClient, AuthSocialProviderRegistry } from '#nuxt-better-auth';
+import type { AppAuthClient, AuthSocialProviderId } from '#nuxt-better-auth';
 import type { ActionHandleFor } from '../internal/auth-action-handles.js';
 type SignIn = NonNullable<AppAuthClient>['signIn'];
-type AuthSocialProviderId = AuthSocialProviderRegistry extends {
-    ids: infer T;
-} ? Extract<T, string> : never;
 type TypedSocialMethod<Method> = Method extends (data: infer Data, ...rest: infer Rest) => Promise<infer Result> ? (data: Omit<Extract<Data, Record<string, unknown>>, 'provider'> & {
     provider: AuthSocialProviderId;
 }, ...rest: Rest) => Promise<Result> : Method;

package/dist/runtime/app/composables/useUserSession.js

@@ -1,7 +1,7 @@
 import { computed, navigateTo, nextTick, useNuxtApp, useRequestURL, useRuntimeConfig, useState, watch } from "#imports";
 import { normalizeAuthActionError } from "../internal/auth-action-error.js";
 import { resolvePostAuthSuccessRedirect, withFallbackSocialCallbackURL } from "../internal/redirect-helpers.js";
-import { fetchSessionClient, fetchSessionServer, stripToken } from "../internal/session-fetch.js";
+import { fetchSessionClient, fetchSessionServer, isExpectedSignedOutSessionError, stripToken } from "../internal/session-fetch.js";
 import { isRecord } from "../internal/utils.js";
 import { createVueSafeAuthFacade, isAuthProxyProbeKey } from "../internal/vue-safe-auth-proxy.js";
 import { wrapAuthMethod } from "../internal/wrap-auth-method.js";
@@ -22,6 +22,11 @@ function createServerOnlyActionNamespace(path) {
 }
 const _signInServerOnly = createServerOnlyActionNamespace("signIn");
 const _signUpServerOnly = createServerOnlyActionNamespace("signUp");
+function shouldWaitForSignUpSession(context) {
+  if (!isRecord(context) || !isRecord(context.data))
+    return true;
+  return context.data.token !== null;
+}
 export function useUserSession() {
   const runtimeFlags = getAuthRuntimeFlags();
   const runtimeConfig = useRuntimeConfig();
@@ -88,14 +93,28 @@ export function useUserSession() {
       throw error;
     }
   }
+  let mountedReconciliationStarted = false;
   function queueHydrationReconciliation() {
     if (hydrationReconcileQueued.value)
       return;
     hydrationReconcileQueued.value = true;
-    nuxtApp.hook("app:mounted", async () => {
-      await fetchSession({ force: true });
-      hydrationReconcileQueued.value = false;
-    });
+    const reconcile = async () => {
+      try {
+        await fetchSession({ force: true });
+      } catch (error) {
+        console.error("[nuxt-better-auth] Failed to fetch session during hydration reconciliation:", error);
+      } finally {
+        hydrationReconcileQueued.value = false;
+      }
+    };
+    if (mountedReconciliationStarted) {
+      void reconcile();
+    } else {
+      nuxtApp.hook("app:mounted", () => {
+        mountedReconciliationStarted = true;
+        return reconcile();
+      });
+    }
   }
   if (runtimeFlags.client && rawClient && !_sessionSyncApps.has(nuxtApp)) {
     const clientSession = rawClient.useSession();
@@ -118,7 +137,8 @@ export function useUserSession() {
             queueHydrationReconciliation();
             return;
           }
-          clearSession();
+          if (!newSession?.error || isExpectedSignedOutSessionError(newSession.error))
+            clearSession();
         }
         if (!authReady.value && !newSession?.isPending && !newSession?.isRefetching)
           authReady.value = true;
@@ -203,8 +223,9 @@ export function useAuthActionNamespaces() {
       wrapDeps,
       isRedirectOAuthSignIn ? {
         shouldSkipSessionSync: (data) => !isRecord(data) || data.disableRedirect !== true,
+        shouldWaitForSession: () => true,
         transformData: (data) => withFallbackSocialCallbackURL(data, requestURL)
-      } : {}
+      } : { shouldWaitForSession: () => true }
     );
   }) : _signInServerOnly;
   const signUp = rawClient?.signUp ? createVueSafeAuthFacade((prop) => {
@@ -212,7 +233,11 @@ export function useAuthActionNamespaces() {
     const method = targetRecord[prop];
     if (typeof method !== "function")
       return method;
-    return wrapAuthMethod((...args) => targetRecord[prop](...args), wrapDeps);
+    return wrapAuthMethod(
+      (...args) => targetRecord[prop](...args),
+      wrapDeps,
+      { shouldWaitForSession: shouldWaitForSignUpSession }
+    );
   }) : _signUpServerOnly;
   return { signIn, signUp };
 }

package/dist/runtime/app/internal/redirect-helpers.js

@@ -1,11 +1,32 @@
 import { navigateTo, useRuntimeConfig } from "#imports";
 import { isRecord } from "./utils.js";
+const ENCODED_PATH_SEPARATOR_RE = /%(?:2f|5c)/gi;
+const REDIRECT_VALIDATION_ORIGIN = "https://nuxt-better-auth.invalid";
+function containsControlCharacter(value) {
+  return Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+}
 export function isSafeLocalRedirect(redirect) {
   if (typeof redirect !== "string")
     return;
   if (!redirect.startsWith("/") || redirect.startsWith("//"))
     return;
-  return redirect;
+  if (redirect.includes("\\") || containsControlCharacter(redirect))
+    return;
+  try {
+    const parsed = new URL(redirect, REDIRECT_VALIDATION_ORIGIN);
+    if (parsed.origin !== REDIRECT_VALIDATION_ORIGIN || parsed.pathname.startsWith("//"))
+      return;
+    const normalizedPath = parsed.pathname.replace(ENCODED_PATH_SEPARATOR_RE, "/");
+    const normalized = new URL(normalizedPath, REDIRECT_VALIDATION_ORIGIN);
+    if (normalized.origin !== REDIRECT_VALIDATION_ORIGIN || normalized.pathname.startsWith("//"))
+      return;
+    return redirect;
+  } catch {
+    return void 0;
+  }
 }
 export function resolvePostAuthRedirect(requestURL) {
   const runtimeConfig = useRuntimeConfig();

package/dist/runtime/app/internal/session-fetch.d.ts

@@ -3,6 +3,7 @@ import type { AppAuthClient, AuthSession, AuthUser, ClientAuthSession } from '#n
 export declare function stripToken(session: AuthSession & {
     token?: string;
 }): ClientAuthSession;
+export declare function isExpectedSignedOutSessionError(error: unknown): boolean;
 export declare function fetchSessionServer(session: Ref<ClientAuthSession | null>, user: Ref<AuthUser | null>, authReady: Ref<boolean>, options?: {
     headers?: HeadersInit;
     force?: boolean;

package/dist/runtime/app/internal/session-fetch.js

@@ -5,12 +5,26 @@ export function stripToken(session) {
   const { token: _, ...safe } = session;
   return safe;
 }
-function isExpectedSignedOutSessionError(error) {
+export function isExpectedSignedOutSessionError(error) {
   const normalizedError = normalizeAuthActionError(error);
   if (normalizedError.status === 401)
     return true;
   return normalizedError.code === "UNAUTHORIZED";
 }
+function handleSessionFetchError(error, session, user) {
+  if (isExpectedSignedOutSessionError(error)) {
+    session.value = null;
+    user.value = null;
+    return;
+  }
+  if (error instanceof Error)
+    throw error;
+  const normalizedError = normalizeAuthActionError(error);
+  throw new Error(
+    `[nuxt-better-auth] Failed to fetch session: ${normalizedError.message}`,
+    { cause: error }
+  );
+}
 export async function fetchSessionServer(session, user, authReady, options = {}) {
   try {
     const headers = options.headers || useRequestHeaders(["cookie"]);
@@ -27,9 +41,8 @@ export async function fetchSessionServer(session, user, authReady, options = {})
       session.value = null;
       user.value = null;
     }
-  } catch {
-    session.value = null;
-    user.value = null;
+  } catch (error) {
+    handleSessionFetchError(error, session, user);
   } finally {
     if (!authReady.value)
       authReady.value = true;
@@ -41,6 +54,10 @@ export async function fetchSessionClient(client, session, user, authReady, optio
     const fetchOptions = { ...headers ? { headers } : {}, throw: false };
     const query = options.force ? { disableCookieCache: true } : void 0;
     const result = await client.getSession({ query }, fetchOptions);
+    if (result.error) {
+      handleSessionFetchError(result.error, session, user);
+      return;
+    }
     const data = result.data;
     if (data?.session && data?.user) {
       session.value = stripToken(data.session);
@@ -50,10 +67,7 @@ export async function fetchSessionClient(client, session, user, authReady, optio
       user.value = null;
     }
   } catch (error) {
-    session.value = null;
-    user.value = null;
-    if (!isExpectedSignedOutSessionError(error))
-      console.error("[nuxt-better-auth] Failed to fetch session:", error);
+    handleSessionFetchError(error, session, user);
   } finally {
     if (!authReady.value)
       authReady.value = true;

package/dist/runtime/app/internal/wrap-auth-method.d.ts

@@ -1,10 +1,10 @@
 import type { ComputedRef } from 'vue';
 export declare function refreshSessionAfterAuthAction(fetchSession: (options?: {
     force?: boolean;
-}) => Promise<void>, loggedIn: ComputedRef<boolean>, waitForSession: () => Promise<void>): Promise<void>;
+}) => Promise<void>, loggedIn: ComputedRef<boolean>, waitForSession: () => Promise<void>, shouldWaitForSession?: boolean, wasLoggedIn?: boolean): Promise<void>;
 export declare function wrapOnSuccess(fetchSession: (options?: {
     force?: boolean;
-}) => Promise<void>, loggedIn: ComputedRef<boolean>, waitForSession: () => Promise<void>, cb: (ctx: unknown) => void | Promise<void>): (ctx: unknown) => Promise<void>;
+}) => Promise<void>, loggedIn: ComputedRef<boolean>, waitForSession: () => Promise<void>, cb: (ctx: unknown) => void | Promise<void>, shouldWaitForSession: (ctx: unknown) => boolean, wasLoggedIn: boolean): (ctx: unknown) => Promise<void>;
 export declare function wrapAuthMethod<T extends (...args: unknown[]) => Promise<unknown>>(method: T, deps: {
     fetchSession: (options?: {
         force?: boolean;
@@ -14,5 +14,6 @@ export declare function wrapAuthMethod<T extends (...args: unknown[]) => Promise
     resolvePostAuthSuccessRedirect: () => (() => Promise<void>) | undefined;
 }, wrapOptions?: {
     shouldSkipSessionSync?: (data: unknown, options: unknown) => boolean;
+    shouldWaitForSession?: (ctx: unknown) => boolean;
     transformData?: (data: unknown, options: unknown) => unknown;
 }): T;

package/dist/runtime/app/internal/wrap-auth-method.js

@@ -1,19 +1,20 @@
 import { nextTick } from "#imports";
 import { isRecord } from "./utils.js";
-export async function refreshSessionAfterAuthAction(fetchSession, loggedIn, waitForSession) {
+export async function refreshSessionAfterAuthAction(fetchSession, loggedIn, waitForSession, shouldWaitForSession = true, wasLoggedIn = loggedIn.value) {
   await fetchSession({ force: true });
-  if (!loggedIn.value)
+  if (shouldWaitForSession && !wasLoggedIn && !loggedIn.value)
     await waitForSession();
   await nextTick();
 }
-export function wrapOnSuccess(fetchSession, loggedIn, waitForSession, cb) {
+export function wrapOnSuccess(fetchSession, loggedIn, waitForSession, cb, shouldWaitForSession, wasLoggedIn) {
   return async (ctx) => {
-    await refreshSessionAfterAuthAction(fetchSession, loggedIn, waitForSession);
+    await refreshSessionAfterAuthAction(fetchSession, loggedIn, waitForSession, shouldWaitForSession(ctx), wasLoggedIn);
     await cb(ctx);
   };
 }
 export function wrapAuthMethod(method, deps, wrapOptions = {}) {
   return (async (...args) => {
+    const wasLoggedIn = deps.loggedIn.value;
     const originalData = args[0];
     const options = args[1];
     const data = wrapOptions.transformData?.(originalData, options) ?? originalData;
@@ -24,18 +25,19 @@ export function wrapAuthMethod(method, deps, wrapOptions = {}) {
     const fetchOptions = isRecord(dataRecord?.fetchOptions) ? dataRecord.fetchOptions : void 0;
     const nestedOnSuccess = fetchOptions?.onSuccess;
     const topLevelOnSuccess = optionsRecord?.onSuccess;
+    const shouldWaitForSession = wrapOptions.shouldWaitForSession ?? (() => false);
     const fallbackOnSuccess = deps.resolvePostAuthSuccessRedirect();
     const wrappedFallbackOnSuccess = fallbackOnSuccess && wrapOnSuccess(deps.fetchSession, deps.loggedIn, deps.waitForSession, async () => {
       if (!deps.loggedIn.value)
         return;
       await fallbackOnSuccess();
-    });
+    }, shouldWaitForSession, wasLoggedIn);
     if (typeof nestedOnSuccess === "function") {
       const nextData = {
         ...dataRecord,
         fetchOptions: {
           ...fetchOptions,
-          onSuccess: wrapOnSuccess(deps.fetchSession, deps.loggedIn, deps.waitForSession, nestedOnSuccess)
+          onSuccess: wrapOnSuccess(deps.fetchSession, deps.loggedIn, deps.waitForSession, nestedOnSuccess, shouldWaitForSession, wasLoggedIn)
         }
       };
       return method(nextData, options);
@@ -43,7 +45,7 @@ export function wrapAuthMethod(method, deps, wrapOptions = {}) {
     if (typeof topLevelOnSuccess === "function") {
       const nextOptions = {
         ...optionsRecord,
-        onSuccess: wrapOnSuccess(deps.fetchSession, deps.loggedIn, deps.waitForSession, topLevelOnSuccess)
+        onSuccess: wrapOnSuccess(deps.fetchSession, deps.loggedIn, deps.waitForSession, topLevelOnSuccess, shouldWaitForSession, wasLoggedIn)
       };
       return method(data, nextOptions);
     }

package/dist/runtime/app/plugins/session.client.js

@@ -5,7 +5,8 @@ export default defineNuxtPlugin(async (nuxtApp) => {
   const safeFetch = async () => {
     try {
       await fetchSession();
-    } catch {
+    } catch (error) {
+      console.error("[nuxt-better-auth] Failed to fetch session during app startup:", error);
     }
   };
   if (!nuxtApp.payload.serverRendered) {

package/dist/runtime/app/plugins/session.server.js

@@ -1,5 +1,6 @@
 import { parseJSON } from "better-auth/client";
-import { defineNuxtPlugin, useRequestEvent, useRequestHeaders, useState } from "#imports";
+import { defineNuxtPlugin, useRequestEvent, useRequestFetch, useState } from "#imports";
+import { appendSetCookieHeaders } from "../../server/internal/cookie-headers.js";
 export default defineNuxtPlugin({
   name: "auth:session-init",
   enforce: "pre",
@@ -10,8 +11,12 @@ export default defineNuxtPlugin({
     const event = useRequestEvent();
     if (event) {
       try {
-        const headers = useRequestHeaders(["cookie"]);
-        const data = await $fetch("/api/auth/get-session", { headers, parseResponse: parseJSON });
+        const data = await useRequestFetch()("/api/auth/get-session", {
+          parseResponse: parseJSON,
+          onResponse({ response }) {
+            appendSetCookieHeaders(event, response.headers);
+          }
+        });
         if (data?.session && data?.user) {
           const { token: _, ...safeSession } = data.session;
           session.value = safeSession;

package/dist/runtime/composables.d.ts

@@ -1,6 +1,7 @@
 export { runWithSessionRefresh } from './app/composables/runWithSessionRefresh.js';
 export { useAction } from './app/composables/useAction.js';
 export { useAuthAsyncData } from './app/composables/useAuthAsyncData.js';
+export type { UseAuthAsyncDataOptions } from './app/composables/useAuthAsyncData.js';
 export { useAuthClient } from './app/composables/useAuthClient.js';
 export { useAuthClientAction } from './app/composables/useAuthClientAction.js';
 export { useAuthRequestFetch } from './app/composables/useAuthRequestFetch.js';
@@ -11,3 +12,4 @@ export { useUserSession } from './app/composables/useUserSession.js';
 export type { SignOutOptions, UseUserSessionReturn } from './app/composables/useUserSession.js';
 export { useUserSessionState } from './app/composables/useUserSessionState.js';
 export type { UseUserSessionStateReturn } from './app/composables/useUserSessionState.js';
+export type { ActionHandleFor, UserAuthActionHandle, UserAuthActionStatus } from './app/internal/auth-action-handles.js';

package/dist/runtime/internal/auth-route-rules.d.ts

@@ -1 +1,4 @@
+import type { AuthRouteRules } from '../types.js';
+export declare function normalizeAuthRoutePath(path: string, baseURL?: string): string;
+export declare function normalizeAuthRouteRule(rule: unknown): AuthRouteRules['auth'];
 export declare function shouldSkipAuthRouteRules(path: string): boolean;

package/dist/runtime/internal/auth-route-rules.js

@@ -1,3 +1,4 @@
+import { withoutBase } from "ufo";
 const internalRouteRuleAuthPaths = /* @__PURE__ */ new Set([
   "/_ipx",
   "/_nuxt",
@@ -18,6 +19,15 @@ const internalRouteRuleAuthPrefixes = [
   "/api/_nuxt_icon/",
   "/api/auth/"
 ];
+export function normalizeAuthRoutePath(path, baseURL = "/") {
+  const pathname = path.split(/[?#]/, 1)[0] || "/";
+  return withoutBase(pathname, baseURL) || "/";
+}
+export function normalizeAuthRouteRule(rule) {
+  if (rule && typeof rule === "object" && Object.hasOwn(rule, "options"))
+    return rule.options;
+  return rule;
+}
 export function shouldSkipAuthRouteRules(path) {
   const pathname = path.split(/[?#]/, 1)[0] || "/";
   return internalRouteRuleAuthPaths.has(pathname) || internalRouteRuleAuthPrefixes.some((prefix) => pathname.startsWith(prefix));

package/dist/runtime/server/internal/cookie-headers.d.ts

@@ -0,0 +1,3 @@
+import type { ServerEvent } from './nitro-compat.js';
+export declare function appendCookieHeader(event: ServerEvent, header: string): void;
+export declare function appendSetCookieHeaders(event: ServerEvent, headers: Headers): void;

package/dist/runtime/server/internal/cookie-headers.js

@@ -0,0 +1,30 @@
+export function appendCookieHeader(event, header) {
+  const nodeResponse = event.node?.res;
+  if (nodeResponse?.setHeader) {
+    const current = nodeResponse.getHeader?.("set-cookie");
+    if (Array.isArray(current))
+      nodeResponse.setHeader("set-cookie", [...current, header]);
+    else if (typeof current === "string")
+      nodeResponse.setHeader("set-cookie", [current, header]);
+    else
+      nodeResponse.setHeader("set-cookie", [header]);
+    return;
+  }
+  const eventWithResponse = event;
+  const responseHeaders = eventWithResponse.res?.headers ?? eventWithResponse.response?.headers;
+  responseHeaders?.append("set-cookie", header);
+}
+function getSetCookieHeaders(headers) {
+  const cookieHeaders = headers;
+  const getSetCookie = cookieHeaders.getSetCookie;
+  if (getSetCookie)
+    return getSetCookie.call(headers);
+  if (cookieHeaders.getAll)
+    return cookieHeaders.getAll.call(headers, "set-cookie");
+  const header = headers.get("set-cookie");
+  return header ? [header] : [];
+}
+export function appendSetCookieHeaders(event, headers) {
+  for (const header of getSetCookieHeaders(headers))
+    appendCookieHeader(event, header);
+}

package/dist/runtime/server/internal/nitro2.d.ts

@@ -1,8 +1,10 @@
 import type { H3Event } from 'h3';
 import type { AuthRouteRules } from '../../types.js';
-import { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody, splitCookiesString, toWebRequest } from 'h3';
+import { splitSetCookieString } from 'cookie-es';
+import { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody, toWebRequest } from 'h3';
 import { useRuntimeConfig } from 'nitropack/runtime';
-export { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody, splitCookiesString, toWebRequest, useRuntimeConfig, };
+export { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody, toWebRequest, useRuntimeConfig, };
 export type ServerEvent = H3Event;
+export { splitSetCookieString as splitCookiesString };
 export declare function getAuthRouteRules(event: ServerEvent): AuthRouteRules;
 export declare function createAuthError(status: number, statusText: string): Error;

package/dist/runtime/server/internal/nitro2.js

@@ -1,3 +1,4 @@
+import { splitSetCookieString } from "cookie-es";
 import {
   createError,
   defineEventHandler,
@@ -6,7 +7,6 @@ import {
   getRequestProtocol,
   getRequestURL,
   readBody,
-  splitCookiesString,
   toWebRequest
 } from "h3";
 import { getRouteRules, useRuntimeConfig } from "nitropack/runtime";
@@ -17,10 +17,10 @@ export {
   getRequestProtocol,
   getRequestURL,
   readBody,
-  splitCookiesString,
   toWebRequest,
   useRuntimeConfig
 };
+export { splitSetCookieString as splitCookiesString };
 export function getAuthRouteRules(event) {
   return getRouteRules(event);
 }

package/dist/runtime/server/internal/nitro3.d.ts

@@ -1,10 +1,11 @@
 import type { H3Event } from 'nitro/h3';
 import type { AuthRouteRules } from '../../types.js';
+import { splitSetCookieString } from 'cookie-es';
 import { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody } from 'nitro/h3';
 import { useRuntimeConfig } from 'nitro/runtime-config';
 export { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody, useRuntimeConfig, };
 export type ServerEvent = H3Event;
+export { splitSetCookieString as splitCookiesString };
 export declare function getAuthRouteRules(event: ServerEvent): AuthRouteRules;
 export declare function createAuthError(status: number, statusText: string): Error;
 export declare function toWebRequest(event: ServerEvent): Request;
-export declare function splitCookiesString(header: string): string[];

package/dist/runtime/server/internal/nitro3.js

@@ -1,3 +1,4 @@
+import { splitSetCookieString } from "cookie-es";
 import { getRouteRules } from "nitro/app";
 import {
   defineEventHandler,
@@ -9,6 +10,7 @@ import {
   readBody
 } from "nitro/h3";
 import { useRuntimeConfig } from "nitro/runtime-config";
+import { normalizeAuthRouteRule } from "../../internal/auth-route-rules.js";
 export {
   defineEventHandler,
   getQuery,
@@ -18,9 +20,10 @@ export {
   readBody,
   useRuntimeConfig
 };
+export { splitSetCookieString as splitCookiesString };
 export function getAuthRouteRules(event) {
-  const auth = getRouteRules(event.req.method, getRequestURL(event).pathname).routeRules.auth?.options;
-  return { auth };
+  const auth = getRouteRules(event.req.method, getRequestURL(event).pathname).routeRules?.auth;
+  return { auth: normalizeAuthRouteRule(auth) };
 }
 export function createAuthError(status, statusText) {
   return HTTPError.status(status, statusText);
@@ -28,33 +31,3 @@ export function createAuthError(status, statusText) {
 export function toWebRequest(event) {
   return event.req;
 }
-export function splitCookiesString(header) {
-  const cookies = [];
-  let position = 0;
-  while (position < header.length) {
-    const start = position;
-    let separator;
-    while (position < header.length) {
-      if (header[position] !== ",") {
-        position += 1;
-        continue;
-      }
-      separator = position;
-      position += 1;
-      while (position < header.length && /\s/.test(header[position]))
-        position += 1;
-      const nextStart = position;
-      while (position < header.length && !["=", ";", ","].includes(header[position]))
-        position += 1;
-      if (header[position] === "=") {
-        cookies.push(header.slice(start, separator));
-        position = nextStart;
-        break;
-      }
-      position = separator + 1;
-    }
-    if (separator === void 0 || position >= header.length)
-      cookies.push(header.slice(start));
-  }
-  return cookies;
-}

package/dist/runtime/server/middleware/route-access.js

@@ -1,10 +1,13 @@
-import { shouldSkipAuthRouteRules } from "../../internal/auth-route-rules.js";
+import { normalizeAuthRoutePath, shouldSkipAuthRouteRules } from "../../internal/auth-route-rules.js";
 import { matchesUser } from "../../utils/match-user.js";
-import { createAuthError, defineEventHandler, getAuthRouteRules, getRequestURL } from "../internal/nitro-compat.js";
+import { createAuthError, defineEventHandler, getAuthRouteRules, getRequestURL, useRuntimeConfig } from "../internal/nitro-compat.js";
 import { getUserSession, requireUserSession } from "../utils/session.js";
 export default defineEventHandler(async (event) => {
-  const path = getRequestURL(event).pathname;
-  if (!path.startsWith("/api/"))
+  const path = normalizeAuthRoutePath(
+    getRequestURL(event).pathname,
+    useRuntimeConfig().app?.baseURL
+  );
+  if (path !== "/api" && !path.startsWith("/api/"))
     return;
   if (shouldSkipAuthRouteRules(path))
     return;

package/dist/runtime/server/utils/auth.js

@@ -43,9 +43,18 @@ function logInferredBaseURL(baseURL, source) {
 }
 function validateURL(url) {
   try {
-    return normalizeLoopbackOrigin(new URL(url).origin);
+    const firstCode = url.charCodeAt(0);
+    if (firstCode <= 32 || firstCode === 127)
+      throw new Error("leading whitespace and control characters are not allowed");
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+      throw new Error("unsupported protocol");
+    const hasUserinfo = /^https?:[/\\]*[^/\\?#]*@/i.test(url.trim().replace(/[\t\n\r]/g, ""));
+    if (parsed.username || parsed.password || hasUserinfo)
+      throw new Error("credentials are not allowed");
+    return normalizeLoopbackOrigin(parsed.origin);
   } catch {
-    throw new Error(`Invalid siteUrl: "${url}". Must be a valid URL.`);
+    throw new Error("Invalid siteUrl. Must be a valid HTTP(S) URL without credentials.");
   }
 }
 function resolveConfiguredSiteUrl(config) {