@server/next 0.48.0 → 0.48.2

package/index.js

@@ -1021,6 +1021,16 @@ function seconds(expires) {
   if (!ms) throw new Error(`Invalid \`expires\`: "${expires}"`);
   return Math.round(ms / 1e3);
 }
+var looksLikeOurs = (token) => {
+  const parts = token.split(".");
+  if (parts.length !== 3) return false;
+  try {
+    const header = JSON.parse(atob(parts[0].replace(/-/g, "+").replace(/_/g, "/")));
+    return header?.alg === "HS256";
+  } catch {
+    return false;
+  }
+};
 var bearer = (ctx) => {
   const header = ctx.headers.authorization;
   if (!header) return;
@@ -1034,8 +1044,13 @@ async function read(ctx, strategy) {
   if (!token) return;
   const payload = await verifyJwt(token, ctx.options.secrets);
   if (!payload) {
-    if (inCookie(strategy)) return;
-    throw ServerError_default.AUTH_INVALID_TOKEN();
+    if (!inCookie(strategy)) throw ServerError_default.AUTH_INVALID_TOKEN();
+    ctx.clearCookie = NAME;
+    ctx.options.log?.message(
+      "auth",
+      looksLikeOurs(token) ? "discarded a session cookie signed with a key that is not in SECRETS. If you rotated it, keep the previous value: secrets: [current, previous]" : "discarded a session cookie that was not issued by this app"
+    );
+    return;
   }
   return payload;
 }
@@ -1592,8 +1607,13 @@ function entry2(options) {
       try {
         claims2 = await check(token, issuer, allowed, claimNames);
       } catch (error) {
-        if (options.cookie) return;
-        throw error;
+        if (!options.cookie) throw error;
+        ctx.clearCookie = options.cookie;
+        ctx.options.log?.message(
+          "auth",
+          `discarded a ${options.cookie} cookie that ${issuer} did not sign, or that has expired`
+        );
+        return;
       }
       ctx.auth = {
         issuedAt: new Date((claims2.iat ?? 0) * 1e3),
@@ -2090,6 +2110,27 @@ function applyCors(res, ctx) {
   }
 }
 
+// src/helpers/forwarded.ts
+var first2 = (value) => {
+  const one = Array.isArray(value) ? value[0] : value;
+  return one?.split(",")[0].trim() || void 0;
+};
+function forwarded(url, headers2, trustProxy) {
+  if (!trustProxy) return;
+  const proto = first2(headers2["x-forwarded-proto"]);
+  if (proto === "http" || proto === "https") url.protocol = `${proto}:`;
+  const host = first2(headers2["x-forwarded-host"]);
+  const port = first2(headers2["x-forwarded-port"]);
+  if (host?.includes(":")) {
+    url.host = host;
+  } else if (host) {
+    url.hostname = host;
+    url.port = port ?? "";
+  } else if (port) {
+    url.port = port;
+  }
+}
+
 // src/helpers/createWebsocket.ts
 function createWebsocket(sockets, handlers) {
   const run2 = (event, socket, body) => {
@@ -2170,6 +2211,12 @@ async function parseResponse(out, ctx) {
   applyCors(out, ctx);
   applySecurity(out, ctx);
   out = await applyCache(out, ctx);
+  if (ctx.clearCookie) {
+    out.headers.append(
+      "set-cookie",
+      `${ctx.clearCookie}=; Path=/; Max-Age=0; HttpOnly`
+    );
+  }
   if (ctx.time?.times?.length > 1) {
     out.headers.set("Server-Timing", ctx.time.headers());
   }
@@ -2880,6 +2927,7 @@ async function createNode(req, app, signal = new AbortController().signal) {
   const path = (req.url || "/").replace(/\/$/, "") || "/";
   const baseUrl = `${scheme}://${host}`;
   const url = new URL(path, baseUrl);
+  forwarded(url, headers2, app.settings.security.trustProxy);
   define(
     url,
     "query",
@@ -2923,6 +2971,7 @@ async function createWinter(req, app, server2) {
   const cookies2 = parseCookies(headers2.cookie);
   const baseUrl = req.url.replace(/\/$/, "") || "/";
   const url = new URL(baseUrl);
+  forwarded(url, headers2, app.settings.security.trustProxy);
   define(
     url,
     "query",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.48.0",
+  "version": "0.48.2",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",