@sourceregistry/sveltekit-oidc 1.6.8 → 1.6.10

package/README.md

@@ -298,8 +298,9 @@ Set these environment variables to enable it:
 - `cookieSecret` should be a strong random secret and must stay stable across instances.
 - Built-in `returnTo` and logout redirect values are restricted to same-origin paths. Use your own callback `onsuccess` logic if you need custom redirect policy.
 - `clockSkewSeconds` defaults to `30` and tolerates small clock drift between your app and the identity provider.
+- Local browser sessions expire after 8 hours by default (`sessionMaxAgeSeconds`). They also end when an unrefreshable access token expires; set a shorter value for higher-risk applications.
 - `createInMemoryBackChannelLogoutStore()` is suitable for local development or single-instance deployments. Use Redis, SQL, or another shared store for production.
-- The library validates `id_token` and `logout_token` values through `@sourceregistry/node-jwt` and provider JWKS metadata.
+- The library validates `id_token` and `logout_token` values through `@sourceregistry/node-jwt` and provider JWKS metadata. ID tokens must contain `exp`, `iat`, and a matching nonce; UserInfo subjects must match the validated ID token.
 - `groups` are normalized onto the session from `groups` and `roles` claims when present.
 - Use `transformClaims`, `transformUser`, and `transformSession` to project provider-specific claims into your own session shape.
 - `check_session_iframe` monitoring only runs when `monitorSession` is enabled, the provider advertises that endpoint, and the session includes `session_state`.

package/dist/client/OIDCContext.svelte

@@ -6,7 +6,7 @@
 </script>
 
 <script lang="ts" generics="TClaims extends OIDCUserClaims = OIDCUserClaims">
-    import {invalidateAll} from '$app/navigation';
+    import {invalidateAll, beforeNavigate} from '$app/navigation';
     import {tick} from 'svelte';
     import type {Snippet} from 'svelte';
 
@@ -44,6 +44,7 @@
 
     let iframe = $state<HTMLIFrameElement | undefined>(undefined);
     let status = $state<'authenticated' | 'unauthenticated' | 'expired' | 'revoked'>('unauthenticated');
+    let revalidating = $state(false);
     let handledUnauthenticated = $state(false);
 
     const metadata = $derived(config.metadata);
@@ -77,6 +78,9 @@
         get status() {
             return status;
         },
+        get revalidating() {
+            return revalidating;
+        },
         login: (returnTo?: string) => login(returnTo),
         logout,
         revalidate
@@ -110,7 +114,32 @@
     }
 
     async function revalidate() {
-        await invalidateAll();
+        if (revalidating) return;
+        revalidating = true;
+
+        // If the server redirects to the login path during a background
+        // revalidation (e.g. session lost, HMR store reset), intercept the
+        // SvelteKit router navigation so we can handle it through
+        // handleRedirect instead of a jarring mid-page router transition.
+        let sessionExpiredDuringRevalidation = false;
+        const stopIntercept = beforeNavigate(({ to, cancel }) => {
+            if (to?.url.pathname.startsWith(resolvedLoginPath)) {
+                cancel();
+                sessionExpiredDuringRevalidation = true;
+            }
+        });
+
+        try {
+            await invalidateAll();
+        } finally {
+            stopIntercept();
+            revalidating = false;
+        }
+
+        if (sessionExpiredDuringRevalidation) {
+            status = 'expired';
+            void handleRedirect(redirectOnExpired);
+        }
     }
 
     async function handleRedirect(mode: RedirectMode) {
@@ -132,6 +161,10 @@
 
     $effect(() => {
         const isAuthenticated = Boolean(session?.isAuthenticated);
+        // Suppress authenticated→unauthenticated transition while a revalidation is
+        // in-flight — the effect re-runs once revalidating flips false with the
+        // final session state, preventing a mid-refresh flicker.
+        if (revalidating && !isAuthenticated) return;
         status = isAuthenticated ? 'authenticated' : status === 'authenticated' ? 'unauthenticated' : status;
     });
 

package/dist/client/context.d.ts

@@ -10,6 +10,7 @@ export type OIDCClientContextValue<TClaims extends OIDCUserClaims = OIDCUserClai
     groups: OIDCPublicSession<TClaims>['groups'];
     metadata?: Pick<OIDCDiscoveryDocument, 'issuer' | 'check_session_iframe' | 'end_session_endpoint' | 'backchannel_logout_supported' | 'backchannel_logout_session_supported'>;
     status: 'authenticated' | 'unauthenticated' | 'expired' | 'revoked';
+    revalidating: boolean;
     login: (returnTo?: string) => void;
     logout: (clearSessionOnly?: boolean) => Promise<void>;
     revalidate: () => Promise<void>;

package/dist/server/index.js

@@ -3,8 +3,8 @@ import { randomBytes } from 'node:crypto';
 import { decode, fromWeb, verify } from '@sourceregistry/node-jwt/promises';
 import { createOIDCCookieStore } from './cookies.js';
 import { asAuthorizationHeader, createClientSecretJwtAssertion, createPrivateKeyJwtAssertion, fetchJson } from './jwt.js';
-import { normalizeTokens, shouldRefresh } from './session.js';
-import { absoluteUrl, base64UrlEncode, buildCookieOptions, collectGroups, createPKCEPair, internalRedirectPath, normalizeIssuer, normalizeScope, parseProviderError, toPublicSession } from './utils.js';
+import { isSessionExpired, normalizeTokens, shouldRefresh } from './session.js';
+import { absoluteUrl, base64UrlEncode, buildCookieOptions, collectGroups, createPKCEPair, internalRedirectPath, normalizeIssuer, normalizeScope, parseProviderError, toPublicSession, validateIdTokenClaims, validateUserInfoSubject } from './utils.js';
 export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 import { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 function buildLogger(logger) {
@@ -38,12 +38,17 @@ export function createOIDC(options) {
     const cookieOptions = buildCookieOptions(options.cookieOptions);
     const clockSkewSeconds = options.clockSkewSeconds ?? 30;
     const refreshToleranceSeconds = options.refreshToleranceSeconds ?? 30;
+    const sessionMaxAgeSeconds = options.sessionMaxAgeSeconds ?? 60 * 60 * 8;
+    if (!Number.isFinite(sessionMaxAgeSeconds) || sessionMaxAgeSeconds <= 0) {
+        throw new TypeError('sessionMaxAgeSeconds must be a positive finite number');
+    }
     const sessionCookieName = options.sessionCookieName ?? 'oidc_session';
     const stateCookieName = options.stateCookieName ?? 'oidc_auth_state';
     const defaultScope = normalizeScope(options.scope);
     const loginPath = options.loginPath ?? '/auth/login';
     const redirectPath = options.redirectPath ?? '/auth/callback';
     const clientAuthMethod = options.clientAuthMethod ?? (options.clientSecret ? 'client_secret_basic' : 'none');
+    const fetchImpl = options.fetch ?? fetch;
     const cookieStore = createOIDCCookieStore(options.cookieSecret, sessionCookieName, stateCookieName, cookieOptions);
     let metadataPromise;
     let jwksPromise;
@@ -101,7 +106,7 @@ export function createOIDC(options) {
                 if (!discoveryUrl) {
                     throw error(500, { message: 'OIDC issuer or discoveryUrl must be configured' });
                 }
-                const document = await fetchJson(discoveryUrl);
+                const document = await fetchJson(discoveryUrl, undefined, fetchImpl);
                 return {
                     ...document,
                     ...options.endpoints,
@@ -117,7 +122,7 @@ export function createOIDC(options) {
                 if (!metadata.jwks_uri) {
                     throw error(500, { message: 'OIDC jwks_uri is required to validate id_token values' });
                 }
-                return fromWeb(metadata.jwks_uri, { overrideEndpointCheck: true });
+                return fromWeb(metadata.jwks_uri, { overrideEndpointCheck: true, fetch: fetchImpl });
             });
         }
         return jwksPromise;
@@ -206,7 +211,7 @@ export function createOIDC(options) {
             method: 'POST',
             headers: auth.headers,
             body: auth.body
-        });
+        }, fetchImpl);
     }
     async function refreshTokens(refreshToken) {
         const metadata = await getMetadata();
@@ -217,7 +222,7 @@ export function createOIDC(options) {
             method: 'POST',
             headers: auth.headers,
             body: auth.body
-        });
+        }, fetchImpl);
     }
     async function validateIdToken(idToken, nonce) {
         const metadata = await getMetadata();
@@ -227,15 +232,10 @@ export function createOIDC(options) {
             algorithms: metadata.id_token_signing_alg_values_supported,
             clockSkew: clockSkewSeconds
         });
+        validateIdTokenClaims(claims, nonce);
         const transformedClaims = options.transformClaims
             ? await options.transformClaims(claims)
             : claims;
-        if (transformedClaims.nonce !== nonce) {
-            throw error(401, { message: 'Invalid id_token nonce' });
-        }
-        if (!transformedClaims.sub) {
-            throw error(401, { message: 'id_token subject is required' });
-        }
         return transformedClaims;
     }
     async function validateBackChannelLogoutToken(logoutToken) {
@@ -265,7 +265,7 @@ export function createOIDC(options) {
             headers: {
                 authorization: `Bearer ${accessToken}`
             }
-        });
+        }, fetchImpl);
     }
     async function isRevoked(session) {
         if (!session || !backChannelLogoutStore) {
@@ -278,6 +278,10 @@ export function createOIDC(options) {
         if (!session) {
             return null;
         }
+        if (isSessionExpired(session, sessionMaxAgeSeconds)) {
+            await clearPersistedSession(cookies, persisted?.id);
+            return null;
+        }
         if (await isRevoked(session)) {
             await clearPersistedSession(cookies, persisted?.id);
             return null;
@@ -291,6 +295,9 @@ export function createOIDC(options) {
                 ? await validateIdToken(tokenResponse.id_token, session.nonce)
                 : session.claims;
             const rawUser = options.fetchUserInfo !== false ? await fetchUserInfo(tokenResponse.access_token) : session.user;
+            if (claims) {
+                validateUserInfoSubject(claims, rawUser);
+            }
             const user = options.transformUser
                 ? await options.transformUser(rawUser, { claims })
                 : rawUser;
@@ -385,6 +392,7 @@ export function createOIDC(options) {
         const rawUser = options.fetchUserInfo === false
             ? undefined
             : await fetchUserInfo(tokenResponse.access_token).catch(() => undefined);
+        validateUserInfoSubject(claims, rawUser);
         const user = options.transformUser
             ? await options.transformUser(rawUser, { claims })
             : rawUser;

package/dist/server/jwt.d.ts

@@ -1,5 +1,5 @@
 import type { OIDCClientAssertionOptions, OIDCClientSecretJwtOptions, OIDCPrivateKeyJwtOptions } from './types.js';
-export declare function fetchJson<T>(url: string, init?: RequestInit): Promise<T>;
+export declare function fetchJson<T>(url: string, init?: RequestInit, fetchImpl?: typeof fetch): Promise<T>;
 export declare function asAuthorizationHeader(clientId: string, clientSecret: string): string;
 export declare function createClientSecretJwtAssertion(options: OIDCClientAssertionOptions & OIDCClientSecretJwtOptions): Promise<string>;
 export declare function createPrivateKeyJwtAssertion(options: OIDCClientAssertionOptions & OIDCPrivateKeyJwtOptions): Promise<string>;

package/dist/server/jwt.js

@@ -2,8 +2,8 @@ import { error } from '@sveltejs/kit';
 import { randomBytes } from 'node:crypto';
 import { sign } from '@sourceregistry/node-jwt/promises';
 import { base64UrlEncode } from './utils.js';
-export async function fetchJson(url, init) {
-    const response = await fetch(url, init);
+export async function fetchJson(url, init, fetchImpl = fetch) {
+    const response = await fetchImpl(url, init);
     if (!response.ok) {
         const body = await response.text().catch(() => '');
         throw error(response.status, {

package/dist/server/session.d.ts

@@ -1,3 +1,4 @@
 import type { OIDCSession, OIDCSessionTokens, OIDCTokenResponse, OIDCUserClaims } from './types.js';
 export declare function normalizeTokens(tokenResponse: OIDCTokenResponse, defaultScope: string[], existing?: OIDCSessionTokens, now?: number): OIDCSessionTokens;
 export declare function shouldRefresh<TClaims extends OIDCUserClaims = OIDCUserClaims>(session: OIDCSession<TClaims>, refreshToleranceSeconds: number, now?: number): boolean;
+export declare function isSessionExpired<TClaims extends OIDCUserClaims = OIDCUserClaims>(session: OIDCSession<TClaims>, sessionMaxAgeSeconds: number, now?: number): boolean;

package/dist/server/session.js

@@ -17,3 +17,13 @@ export function shouldRefresh(session, refreshToleranceSeconds, now = Math.floor
     }
     return session.tokens.expiresAt - refreshToleranceSeconds <= now;
 }
+export function isSessionExpired(session, sessionMaxAgeSeconds, now = Math.floor(Date.now() / 1000)) {
+    if (session.createdAt + sessionMaxAgeSeconds <= now) {
+        return true;
+    }
+    // Without a refresh token, an expired access token cannot establish that
+    // the user's session is still valid. Do not keep the local session alive.
+    return !session.tokens.refreshToken &&
+        session.tokens.expiresAt !== undefined &&
+        session.tokens.expiresAt <= now;
+}

package/dist/server/store.js

@@ -17,7 +17,10 @@ export function createInMemoryBackChannelLogoutStore() {
     };
 }
 export function createInMemorySessionStore() {
-    const sessions = new Map();
+    // Persist the Map on globalThis so Vite HMR module re-evaluations don't
+    // create a fresh store and orphan all live session cookies.
+    const g = globalThis;
+    const sessions = (g['__oidc_sessions__'] ??= new Map());
     return {
         async get(sessionId) {
             return sessions.get(sessionId) ?? null;

package/dist/server/types.d.ts

@@ -53,6 +53,7 @@ export type OIDCUserClaims = Record<string, unknown> & {
     iss?: string;
     aud?: string | string[];
     exp?: number;
+    iat?: number;
     nbf?: number;
     nonce?: string;
 };
@@ -159,6 +160,8 @@ export type OIDCOptions<TClaims extends OIDCUserClaims = OIDCUserClaims, TSessio
     cookieOptions?: Partial<CookieOptions>;
     clockSkewSeconds?: number;
     refreshToleranceSeconds?: number;
+    /** Maximum lifetime of a local browser session. Defaults to 8 hours. */
+    sessionMaxAgeSeconds?: number;
     defaultLoginRedirect?: string;
     defaultLogoutRedirect?: string;
     sessionStore?: OIDCSessionStore<TClaims, TSession> | 'memory';
@@ -176,6 +179,13 @@ export type OIDCOptions<TClaims extends OIDCUserClaims = OIDCUserClaims, TSessio
     }) => MaybePromise<TSession>;
     endpoints?: Partial<OIDCDiscoveryDocument>;
     logger?: OIDCLogger | false;
+    /**
+     * Custom fetch implementation used for all OIDC network calls
+     * (discovery, token, userinfo, JWKS). Useful in dev to work around
+     * self-signed certs via a custom https.Agent — do not disable
+     * TLS verification in production.
+     */
+    fetch?: typeof fetch;
 };
 export type OIDCLoginOptions = {
     returnTo?: string;

package/dist/server/utils.d.ts

@@ -22,4 +22,6 @@ export declare function absoluteUrl(event: {
 export declare function internalRedirectPath(event: {
     url: URL;
 }, pathOrUrl: string | undefined, fallback?: string): string;
+export declare function validateIdTokenClaims(claims: OIDCUserClaims, nonce: string): void;
+export declare function validateUserInfoSubject(claims: OIDCUserClaims, user: OIDCUserClaims | undefined): void;
 export declare function toPublicSession<TClaims extends OIDCUserClaims = OIDCUserClaims>(session: OIDCSession<TClaims> | null): OIDCPublicSession<TClaims> | null;

package/dist/server/utils.js

@@ -119,6 +119,25 @@ export function internalRedirectPath(event, pathOrUrl, fallback = '/') {
         return fallback;
     }
 }
+export function validateIdTokenClaims(claims, nonce) {
+    if (!Number.isFinite(claims.exp)) {
+        throw error(401, { message: 'id_token expiration is required' });
+    }
+    if (!Number.isFinite(claims.iat)) {
+        throw error(401, { message: 'id_token issued-at time is required' });
+    }
+    if (claims.nonce !== nonce) {
+        throw error(401, { message: 'Invalid id_token nonce' });
+    }
+    if (!claims.sub) {
+        throw error(401, { message: 'id_token subject is required' });
+    }
+}
+export function validateUserInfoSubject(claims, user) {
+    if (user && user.sub !== claims.sub) {
+        throw error(401, { message: 'UserInfo subject does not match id_token subject' });
+    }
+}
 export function toPublicSession(session) {
     if (!session)
         return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.6.8",
+  "version": "1.6.10",
   "description": "OIDC authentication helpers for SvelteKit applications",
   "license": "Apache-2.0",
   "scripts": {
@@ -84,7 +84,7 @@
     "oauth"
   ],
   "dependencies": {
-    "@sourceregistry/node-jwt": "^1.5.10"
+    "@sourceregistry/node-jwt": "^1.5.11"
   },
   "release": {
     "branches": [