@sourceregistry/sveltekit-oidc 1.6.3 → 1.6.5

package/README.md

@@ -1,11 +1,18 @@
 # sveltekit-oidc
 
+[![npm version](https://img.shields.io/npm/v/@sourceregistry/sveltekit-oidc.svg)](https://www.npmjs.com/package/@sourceregistry/sveltekit-oidc)
+[![npm downloads](https://img.shields.io/npm/dm/@sourceregistry/sveltekit-oidc.svg)](https://www.npmjs.com/package/@sourceregistry/sveltekit-oidc)
+[![license](https://img.shields.io/npm/l/@sourceregistry/sveltekit-oidc.svg)](LICENSE)
+[![types](https://img.shields.io/npm/types/@sourceregistry/sveltekit-oidc.svg)](https://www.npmjs.com/package/@sourceregistry/sveltekit-oidc)
+[![Svelte](https://img.shields.io/badge/Svelte-5-ff3e00.svg)](https://svelte.dev/)
+[![publint](https://img.shields.io/badge/publint-passing-brightgreen.svg)](https://publint.dev/@sourceregistry/sveltekit-oidc)
+
 OIDC authentication helpers for SvelteKit with:
 
 - server-side login, callback, logout, and session refresh flows
 - token endpoint auth support for `none`, `client_secret_basic`, `client_secret_post`, `client_secret_jwt`, and `private_key_jwt`
 - back-channel logout support through a revocation store
-- signed cookie-backed sessions and PKCE/state protection
+- encrypted cookie-backed sessions and PKCE/state protection
 - a `handle` hook for attaching auth state to `event.locals`
 - a small `OIDCContext` provider for client-side auth state and session lifecycle handling
 
@@ -64,7 +71,6 @@ export const GET = oidc.callbackHandler({
 // src/routes/auth/logout/+server.ts
 import { oidc } from '$lib/server/auth';
 
-export const GET = oidc.logoutHandler();
 export const POST = oidc.logoutHandler();
 ```
 
@@ -290,6 +296,7 @@ Set these environment variables to enable it:
 ## Notes
 
 - `cookieSecret` should be a strong random secret and must stay stable across instances.
+- Built-in `returnTo` and logout redirect values are restricted to same-origin paths. Use your own callback `onsuccess` logic if you need custom redirect policy.
 - `clockSkewSeconds` defaults to `30` and tolerates small clock drift between your app and the identity provider.
 - `createInMemoryBackChannelLogoutStore()` is suitable for local development or single-instance deployments. Use Redis, SQL, or another shared store for production.
 - The library validates `id_token` and `logout_token` values through `@sourceregistry/node-jwt` and provider JWKS metadata.

package/dist/server/index.js

@@ -4,7 +4,7 @@ import { decode, fromWeb, verify } from '@sourceregistry/node-jwt/promises';
 import { createOIDCCookieStore } from './cookies.js';
 import { asAuthorizationHeader, createClientSecretJwtAssertion, createPrivateKeyJwtAssertion, fetchJson } from './jwt.js';
 import { normalizeTokens, shouldRefresh } from './session.js';
-import { absoluteUrl, base64UrlEncode, buildCookieOptions, collectGroups, createPKCEPair, normalizeIssuer, normalizeScope, parseProviderError, toPublicSession } from './utils.js';
+import { absoluteUrl, base64UrlEncode, buildCookieOptions, collectGroups, createPKCEPair, internalRedirectPath, normalizeIssuer, normalizeScope, parseProviderError, toPublicSession } from './utils.js';
 export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 import { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 function buildLogger(logger) {
@@ -233,6 +233,9 @@ export function createOIDC(options) {
         if (transformedClaims.nonce !== nonce) {
             throw error(401, { message: 'Invalid id_token nonce' });
         }
+        if (!transformedClaims.sub) {
+            throw error(401, { message: 'id_token subject is required' });
+        }
         return transformedClaims;
     }
     async function validateBackChannelLogoutToken(logoutToken) {
@@ -327,7 +330,7 @@ export function createOIDC(options) {
         const pkce = createPKCEPair();
         const state = base64UrlEncode(randomBytes(24));
         const nonce = base64UrlEncode(randomBytes(24));
-        const returnTo = loginOptions.returnTo ?? options.defaultLoginRedirect ?? '/';
+        const returnTo = internalRedirectPath(event, loginOptions.returnTo ?? options.defaultLoginRedirect, '/');
         cookieStore.writeState(event.cookies, {
             state,
             nonce,
@@ -375,9 +378,10 @@ export function createOIDC(options) {
             redirectUri: absoluteUrl(event, redirectPath),
             codeVerifier: stateCookie.codeVerifier
         });
-        const claims = tokenResponse.id_token
-            ? await validateIdToken(tokenResponse.id_token, stateCookie.nonce)
-            : undefined;
+        if (!tokenResponse.id_token) {
+            throw error(401, { message: 'OIDC callback response must include an id_token' });
+        }
+        const claims = await validateIdToken(tokenResponse.id_token, stateCookie.nonce);
         const rawUser = options.fetchUserInfo === false
             ? undefined
             : await fetchUserInfo(tokenResponse.access_token).catch(() => undefined);
@@ -421,20 +425,15 @@ export function createOIDC(options) {
         const session = persisted?.session ?? null;
         cookieStore.clearState(event.cookies);
         await clearPersistedSession(event.cookies, persisted?.id);
+        const postLogoutRedirectPath = internalRedirectPath(event, logoutOptions.postLogoutRedirectUri ?? options.defaultLogoutRedirect ?? options.postLogoutRedirectUri, '/');
         if (logoutOptions.clearSessionOnly || !metadata.end_session_endpoint) {
-            throw redirect(302, logoutOptions.postLogoutRedirectUri ??
-                options.defaultLogoutRedirect ??
-                options.postLogoutRedirectUri ??
-                '/');
+            throw redirect(302, postLogoutRedirectPath);
         }
         const url = new URL(metadata.end_session_endpoint);
         if (session?.tokens.idToken) {
             url.searchParams.set('id_token_hint', session.tokens.idToken);
         }
-        url.searchParams.set('post_logout_redirect_uri', absoluteUrl(event, logoutOptions.postLogoutRedirectUri ??
-            options.postLogoutRedirectUri ??
-            options.defaultLogoutRedirect ??
-            '/'));
+        url.searchParams.set('post_logout_redirect_uri', absoluteUrl(event, postLogoutRedirectPath));
         if (logoutOptions.state) {
             url.searchParams.set('state', logoutOptions.state);
         }
@@ -471,7 +470,7 @@ export function createOIDC(options) {
         if (session) {
             return session;
         }
-        throw redirect(302, `${absoluteUrl(event, loginPath)}?returnTo=${encodeURIComponent(returnTo ?? `${event.url.pathname}${event.url.search}`)}`);
+        throw redirect(302, `${absoluteUrl(event, loginPath)}?returnTo=${encodeURIComponent(internalRedirectPath(event, returnTo ?? `${event.url.pathname}${event.url.search}`, '/'))}`);
     }
     const handle = async ({ event, resolve }) => {
         const { oidc } = await hook(event);
@@ -510,7 +509,7 @@ export function createOIDC(options) {
                 if (response) {
                     return response;
                 }
-                throw redirect(302, handlerOptions.redirectTo ?? result.returnTo);
+                throw redirect(302, internalRedirectPath(event, handlerOptions.redirectTo ?? result.returnTo, '/'));
             }
             catch (err) {
                 const response = await handlerOptions.onfailure?.(event, err);
@@ -523,6 +522,9 @@ export function createOIDC(options) {
     }
     function logoutHandler(defaults = {}) {
         return async (event) => {
+            if (event.request.method !== 'POST') {
+                throw error(405, { message: 'Logout requires POST' });
+            }
             const postLogoutRedirectUri = event.url.searchParams.get('postLogoutRedirectUri') ?? defaults.postLogoutRedirectUri;
             const clearSessionOnly = event.url.searchParams.get('clearSessionOnly') === '1' ||
                 event.url.searchParams.get('clearSessionOnly') === 'true' ||

package/dist/server/types.d.ts

@@ -263,7 +263,10 @@ export type OIDCInstance<TClaims extends OIDCUserClaims = OIDCUserClaims, TSessi
         login: Action;
         logout: Action;
     }>;
-    requireAuth: (event: RequestEvent, returnTo?: string) => Promise<TSession>;
+    requireAuth: (event: {
+        cookies: Cookies;
+        url: URL;
+    }, returnTo?: string) => Promise<TSession>;
     clearSession: (cookies: Cookies) => Promise<void>;
 };
 export type OIDCInferClaims<T> = T extends OIDCInstance<infer TClaims> ? TClaims : OIDCUserClaims;

package/dist/server/utils.d.ts

@@ -1,4 +1,3 @@
-import { type RequestEvent } from '@sveltejs/kit';
 import type { CookieOptions, OIDCPublicSession, OIDCSession, OIDCUserClaims } from './types.js';
 export declare function base64UrlEncode(value: string | Uint8Array): string;
 export declare function createPKCEPair(length?: number): {
@@ -14,6 +13,13 @@ export declare function verifySignedValue(value: string, secret: string): string
 export declare function serializeSignedCookie(payload: unknown, secret: string): string;
 export declare function parseSignedCookie<T>(value: string | undefined, secret: string): T | null;
 export declare function buildCookieOptions(options?: Partial<CookieOptions>): CookieOptions;
-export declare function parseProviderError(event: RequestEvent): null;
-export declare function absoluteUrl(event: RequestEvent, pathOrUrl: string): string;
+export declare function parseProviderError(event: {
+    url: URL;
+}): null;
+export declare function absoluteUrl(event: {
+    url: URL;
+}, pathOrUrl: string): string;
+export declare function internalRedirectPath(event: {
+    url: URL;
+}, pathOrUrl: string | undefined, fallback?: string): string;
 export declare function toPublicSession<TClaims extends OIDCUserClaims = OIDCUserClaims>(session: OIDCSession<TClaims> | null): OIDCPublicSession<TClaims> | null;

package/dist/server/utils.js

@@ -1,5 +1,5 @@
 import { error } from '@sveltejs/kit';
-import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 export function base64UrlEncode(value) {
     const buffer = typeof value === 'string' ? Buffer.from(value, 'utf8') : Buffer.from(value);
     return buffer.toString('base64url');
@@ -51,17 +51,34 @@ export function verifySignedValue(value, secret) {
     }
     return payload;
 }
+function cookieEncryptionKey(secret) {
+    return createHash('sha256').update(`sveltekit-oidc-cookie:${secret}`).digest();
+}
 export function serializeSignedCookie(payload, secret) {
-    return createSignedValue(base64UrlEncode(JSON.stringify(payload)), secret);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', cookieEncryptionKey(secret), iv);
+    const ciphertext = Buffer.concat([
+        cipher.update(JSON.stringify(payload), 'utf8'),
+        cipher.final()
+    ]);
+    const tag = cipher.getAuthTag();
+    return `v2.${iv.toString('base64url')}.${tag.toString('base64url')}.${ciphertext.toString('base64url')}`;
 }
 export function parseSignedCookie(value, secret) {
     if (!value)
         return null;
-    const payload = verifySignedValue(value, secret);
-    if (!payload)
+    const parts = value.split('.');
+    if (parts.length !== 4 || parts[0] !== 'v2')
         return null;
     try {
-        return JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        const [, iv, tag, ciphertext] = parts;
+        const decipher = createDecipheriv('aes-256-gcm', cookieEncryptionKey(secret), Buffer.from(iv, 'base64url'));
+        decipher.setAuthTag(Buffer.from(tag, 'base64url'));
+        const plaintext = Buffer.concat([
+            decipher.update(Buffer.from(ciphertext, 'base64url')),
+            decipher.final()
+        ]);
+        return JSON.parse(plaintext.toString('utf8'));
     }
     catch {
         return null;
@@ -89,6 +106,19 @@ export function absoluteUrl(event, pathOrUrl) {
         return pathOrUrl;
     return new URL(pathOrUrl, event.url).toString();
 }
+export function internalRedirectPath(event, pathOrUrl, fallback = '/') {
+    if (!pathOrUrl)
+        return fallback;
+    try {
+        const url = new URL(pathOrUrl, event.url);
+        if (url.origin !== event.url.origin)
+            return fallback;
+        return `${url.pathname}${url.search}${url.hash}`;
+    }
+    catch {
+        return fallback;
+    }
+}
 export function toPublicSession(session) {
     if (!session)
         return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.6.3",
+  "version": "1.6.5",
   "description": "OIDC authentication helpers for SvelteKit applications",
   "license": "Apache-2.0",
   "scripts": {
@@ -41,7 +41,8 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "svelte": "./dist/index.js"
+      "svelte": "./dist/index.js",
+      "default": "./dist/index.js"
     },
     "./client": {
       "types": "./dist/client/index.d.ts",