@sourceregistry/sveltekit-oidc 1.1.0 → 1.1.1

package/README.md

@@ -33,6 +33,7 @@ export const oidc = createOIDC({
 	loginPath: '/auth/login',
 	redirectPath: '/auth/callback',
 	scope: ['openid', 'profile', 'email', 'offline_access'],
+	clockSkewSeconds: 30,
 	fetchUserInfo: true,
 	backChannelLogoutStore: createInMemoryBackChannelLogoutStore(),
 	transformSession(session) {
@@ -175,6 +176,7 @@ Set these environment variables to enable it:
 ## Notes
 
 - `cookieSecret` should be a strong random secret and must stay stable across instances.
+- `clockSkewSeconds` defaults to `30` and tolerates small clock drift between your app and the identity provider.
 - `createInMemoryBackChannelLogoutStore()` is suitable for local development or single-instance deployments. Use Redis, SQL, or another shared store for production.
 - The library validates `id_token` and `logout_token` values through `@sourceregistry/node-jwt` and provider JWKS metadata.
 - `groups` are normalized onto the session from `groups` and `roles` claims when present.

package/dist/server/index.js

@@ -8,6 +8,7 @@ import { absoluteUrl, base64UrlEncode, buildCookieOptions, collectGroups, create
 export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 export function createOIDC(options) {
     const cookieOptions = buildCookieOptions(options.cookieOptions);
+    const clockSkewSeconds = options.clockSkewSeconds ?? 30;
     const refreshToleranceSeconds = options.refreshToleranceSeconds ?? 30;
     const sessionCookieName = options.sessionCookieName ?? 'oidc_session';
     const stateCookieName = options.stateCookieName ?? 'oidc_auth_state';
@@ -195,7 +196,8 @@ export function createOIDC(options) {
         const claims = await verifyJwtWithJwks(idToken, {
             issuer: metadata.issuer,
             audience: options.clientId,
-            algorithms: metadata.id_token_signing_alg_values_supported
+            algorithms: metadata.id_token_signing_alg_values_supported,
+            clockSkew: clockSkewSeconds
         });
         const transformedClaims = options.transformClaims ? await options.transformClaims(claims) : claims;
         if (transformedClaims.nonce !== nonce) {
@@ -207,7 +209,8 @@ export function createOIDC(options) {
         const metadata = await getMetadata();
         const claims = await verifyJwtWithJwks(logoutToken, {
             issuer: metadata.issuer,
-            audience: options.clientId
+            audience: options.clientId,
+            clockSkew: clockSkewSeconds
         });
         if (!claims.events?.['http://schemas.openid.net/event/backchannel-logout']) {
             throw error(400, { message: 'Invalid logout_token events claim' });

package/dist/server/types.d.ts

@@ -151,6 +151,7 @@ export type OIDCOptions = {
     stateCookieName?: string;
     cookieSecret: string;
     cookieOptions?: Partial<CookieOptions>;
+    clockSkewSeconds?: number;
     refreshToleranceSeconds?: number;
     defaultLoginRedirect?: string;
     defaultLogoutRedirect?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "OIDC authentication helpers for SvelteKit applications.",
   "license": "Apache-2.0",
   "scripts": {