@segmentstream-cloud/app 0.16.1 → 0.16.2

package/dist/decision-pages.d.ts

@@ -7,6 +7,7 @@ import { type SegmentStreamProxy } from "./proxy.js";
 export declare function withUnframeablePages(proxy: SegmentStreamProxy): SegmentStreamProxy;
 /**
  * Whether a form post came from the app's own pages. A decision must never be made from another
- * site, which could otherwise approve an agent in the member's name.
+ * site, which could otherwise approve an agent in the member's name. Fetch Metadata describes
+ * the browser's public request even when a trusted proxy rewrites the server's request URL.
  */
 export declare function isSameOrigin(request: Request): boolean;

package/dist/decision-pages.js

@@ -1,3 +1,4 @@
+import { isLoopbackHostname } from "./cookies.js";
 import { AGENT_CONNECT_PAGE, CONSENT_PAGE } from "./pages.js";
 import { matchesPathPrefix } from "./proxy.js";
 /** Pages where a signed-in member lets an agent act for them. */
@@ -26,12 +27,48 @@ export function withUnframeablePages(proxy) {
 }
 /**
  * Whether a form post came from the app's own pages. A decision must never be made from another
- * site, which could otherwise approve an agent in the member's name.
+ * site, which could otherwise approve an agent in the member's name. Fetch Metadata describes
+ * the browser's public request even when a trusted proxy rewrites the server's request URL.
  */
 export function isSameOrigin(request) {
-    const origin = request.headers.get("origin");
-    if (origin !== null) {
-        return origin === new URL(request.url).origin;
+    const site = request.headers.get("sec-fetch-site");
+    if (site !== null) {
+        return site === "same-origin";
     }
-    return request.headers.get("sec-fetch-site") === "same-origin";
+    const supplied = request.headers.get("origin");
+    const origin = supplied === null ? undefined : httpOrigin(supplied);
+    if (origin === undefined) {
+        return false;
+    }
+    if (origin === new URL(request.url).origin) {
+        return true;
+    }
+    const host = (request.headers.get("x-forwarded-host") ?? request.headers.get("host"))
+        ?.split(",")[0]
+        ?.trim();
+    if (!host) {
+        return false;
+    }
+    const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+    const protocol = forwardedProto === "http" || forwardedProto === "https"
+        ? forwardedProto
+        : isLoopbackHostname(host.replace(/:\d+$/, ""))
+            ? "http"
+            : "https";
+    return origin === httpOrigin(`${protocol}://${host}`);
+}
+/** An Origin names only an HTTP(S) authority, never credentials, a path or query. */
+function httpOrigin(value) {
+    if (!URL.canParse(value)) {
+        return undefined;
+    }
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:") &&
+        url.username === "" &&
+        url.password === "" &&
+        url.pathname === "/" &&
+        url.search === "" &&
+        url.hash === ""
+        ? url.origin
+        : undefined;
 }

package/dist/handlers.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { authFlowCookieName, clearCookie, clearSessionCookies, cookiePolicyFor, decodeAuthFlowState, pendingAuthFlowCookies, safeReturnTo, setSessionCookies, } from "./cookies.js";
+import { isSameOrigin } from "./decision-pages.js";
 import { constantTimeEqual } from "./pkce.js";
 import { CALLBACK_PATH, SIGNED_OUT_PATH, SIGN_IN_PATH, SDK_ROUTE_PREFIX, signInRedirect, } from "./sign-in.js";
 export function createHandlers(context) {
@@ -92,8 +93,7 @@ function returnToApp(request, policy, flowCookie, returnTo) {
     return response;
 }
 async function handleSignOut(context, request) {
-    const origin = request.headers.get("origin");
-    if (origin !== null && origin !== request.nextUrl.origin) {
+    if (!isSameOrigin(request)) {
         return htmlResponse(403, "Sign-out refused", "Sign out from this app's own pages.", "Return to the app");
     }
     const policy = cookiePolicyFor(request.nextUrl, context.config.workspaceId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segmentstream-cloud/app",
-  "version": "0.16.1",
+  "version": "0.16.2",
   "description": "Sign-in, users, permissions, the ontology client and warehouse data access for SegmentStream workspace apps built with Next.js.",
   "license": "Apache-2.0",
   "author": "SegmentStream",