@sourceregistry/sveltekit-oidc 1.6.9 → 1.6.11

package/README.md

@@ -298,8 +298,9 @@ Set these environment variables to enable it:
 - `cookieSecret` should be a strong random secret and must stay stable across instances.
 - Built-in `returnTo` and logout redirect values are restricted to same-origin paths. Use your own callback `onsuccess` logic if you need custom redirect policy.
 - `clockSkewSeconds` defaults to `30` and tolerates small clock drift between your app and the identity provider.
+- Local browser sessions expire after 8 hours by default (`sessionMaxAgeSeconds`). They also end when an unrefreshable access token expires; set a shorter value for higher-risk applications.
 - `createInMemoryBackChannelLogoutStore()` is suitable for local development or single-instance deployments. Use Redis, SQL, or another shared store for production.
-- The library validates `id_token` and `logout_token` values through `@sourceregistry/node-jwt` and provider JWKS metadata.
+- The library validates `id_token` and `logout_token` values through `@sourceregistry/node-jwt` and provider JWKS metadata. ID tokens must contain `exp`, `iat`, and a matching nonce; UserInfo subjects must match the validated ID token.
 - `groups` are normalized onto the session from `groups` and `roles` claims when present.
 - Use `transformClaims`, `transformUser`, and `transformSession` to project provider-specific claims into your own session shape.
 - `check_session_iframe` monitoring only runs when `monitorSession` is enabled, the provider advertises that endpoint, and the session includes `session_state`.

package/dist/client/OIDCContext.svelte

@@ -46,6 +46,7 @@
     let status = $state<'authenticated' | 'unauthenticated' | 'expired' | 'revoked'>('unauthenticated');
     let revalidating = $state(false);
     let handledUnauthenticated = $state(false);
+    let sessionExpiredDuringRevalidation = false;
 
     const metadata = $derived(config.metadata);
     const resolvedLoginPath = $derived(loginPath ?? config.loginPath ?? '/auth/login');
@@ -88,23 +89,43 @@
 
     void context;
 
+    // SvelteKit navigation hooks are registered for the component lifetime.
+    // Only intercept login redirects while a background revalidation is active.
+    beforeNavigate(({to, cancel}) => {
+        if (revalidating && to?.url.pathname.startsWith(resolvedLoginPath)) {
+            cancel();
+            sessionExpiredDuringRevalidation = true;
+        }
+    });
+
     function buildLoginUrl(returnTo = `${window.location.pathname}${window.location.search}`) {
         return `${resolvedLoginPath}?returnTo=${encodeURIComponent(returnTo)}`;
     }
 
     async function logout(clearSessionOnly = false) {
-        const body = new URLSearchParams();
         if (clearSessionOnly) {
-            body.set('clearSessionOnly', '1');
+            // Session-monitor events must clear only this application's session.
+            // Keep the flag in the URL because logoutHandler also supports callers
+            // that do not send a form body.
+            const url = new URL(logoutPath, window.location.href);
+            url.searchParams.set('clearSessionOnly', '1');
+
+            await fetch(url, {
+                method: 'POST',
+                redirect: 'manual'
+            });
+            return;
         }
 
-        await fetch(logoutPath, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/x-www-form-urlencoded'
-            },
-            body
-        });
+        // Provider logout can include an interactive confirmation and redirects.
+        // A fetch would follow that flow in the background, leaving the provider
+        // session intact and allowing the app to immediately sign in again.
+        const form = document.createElement('form');
+        form.method = 'POST';
+        form.action = logoutPath;
+        form.style.display = 'none';
+        document.body.append(form);
+        form.submit();
     }
 
     function login(returnTo?: string) {
@@ -118,21 +139,13 @@
         revalidating = true;
 
         // If the server redirects to the login path during a background
-        // revalidation (e.g. session lost, HMR store reset), intercept the
-        // SvelteKit router navigation so we can handle it through
-        // handleRedirect instead of a jarring mid-page router transition.
-        let sessionExpiredDuringRevalidation = false;
-        const stopIntercept = beforeNavigate(({ to, cancel }) => {
-            if (to?.url.pathname.startsWith(resolvedLoginPath)) {
-                cancel();
-                sessionExpiredDuringRevalidation = true;
-            }
-        });
+        // revalidation (e.g. session lost, HMR store reset), the component's
+        // navigation hook records it so we can handle the redirect below.
+        sessionExpiredDuringRevalidation = false;
 
         try {
             await invalidateAll();
         } finally {
-            stopIntercept();
             revalidating = false;
         }
 

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-import type { OIDCOptions, OIDCInstance, OIDCSession, OIDCUserClaims } from './types.js';
+import type { OIDCInstance, OIDCOptions, OIDCSession, OIDCUserClaims } from './types.js';
 export type * from './types.js';
 export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 export declare function createOIDC<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>>(options: OIDCOptions<TClaims, TSession>): OIDCInstance<TClaims, TSession>;

package/dist/server/index.js

@@ -3,10 +3,10 @@ import { randomBytes } from 'node:crypto';
 import { decode, fromWeb, verify } from '@sourceregistry/node-jwt/promises';
 import { createOIDCCookieStore } from './cookies.js';
 import { asAuthorizationHeader, createClientSecretJwtAssertion, createPrivateKeyJwtAssertion, fetchJson } from './jwt.js';
-import { normalizeTokens, shouldRefresh } from './session.js';
-import { absoluteUrl, base64UrlEncode, buildCookieOptions, collectGroups, createPKCEPair, internalRedirectPath, normalizeIssuer, normalizeScope, parseProviderError, toPublicSession } from './utils.js';
-export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
+import { isSessionExpired, normalizeTokens, shouldRefresh } from './session.js';
+import { absoluteUrl, base64UrlEncode, buildCookieOptions, collectGroups, createPKCEPair, internalRedirectPath, normalizeIssuer, normalizeScope, parseProviderError, toPublicSession, validateIdTokenClaims, validateUserInfoSubject } from './utils.js';
 import { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
+export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 function buildLogger(logger) {
     const noop = () => {
     };
@@ -38,12 +38,17 @@ export function createOIDC(options) {
     const cookieOptions = buildCookieOptions(options.cookieOptions);
     const clockSkewSeconds = options.clockSkewSeconds ?? 30;
     const refreshToleranceSeconds = options.refreshToleranceSeconds ?? 30;
+    const sessionMaxAgeSeconds = options.sessionMaxAgeSeconds ?? 60 * 60 * 8;
+    if (!Number.isFinite(sessionMaxAgeSeconds) || sessionMaxAgeSeconds <= 0) {
+        throw new TypeError('sessionMaxAgeSeconds must be a positive finite number');
+    }
     const sessionCookieName = options.sessionCookieName ?? 'oidc_session';
     const stateCookieName = options.stateCookieName ?? 'oidc_auth_state';
     const defaultScope = normalizeScope(options.scope);
     const loginPath = options.loginPath ?? '/auth/login';
     const redirectPath = options.redirectPath ?? '/auth/callback';
     const clientAuthMethod = options.clientAuthMethod ?? (options.clientSecret ? 'client_secret_basic' : 'none');
+    const fetchImpl = options.fetch ?? fetch;
     const cookieStore = createOIDCCookieStore(options.cookieSecret, sessionCookieName, stateCookieName, cookieOptions);
     let metadataPromise;
     let jwksPromise;
@@ -101,7 +106,7 @@ export function createOIDC(options) {
                 if (!discoveryUrl) {
                     throw error(500, { message: 'OIDC issuer or discoveryUrl must be configured' });
                 }
-                const document = await fetchJson(discoveryUrl);
+                const document = await fetchJson(discoveryUrl, undefined, fetchImpl);
                 return {
                     ...document,
                     ...options.endpoints,
@@ -117,7 +122,7 @@ export function createOIDC(options) {
                 if (!metadata.jwks_uri) {
                     throw error(500, { message: 'OIDC jwks_uri is required to validate id_token values' });
                 }
-                return fromWeb(metadata.jwks_uri, { overrideEndpointCheck: true });
+                return fromWeb(metadata.jwks_uri, { overrideEndpointCheck: true, fetch: fetchImpl });
             });
         }
         return jwksPromise;
@@ -206,7 +211,7 @@ export function createOIDC(options) {
             method: 'POST',
             headers: auth.headers,
             body: auth.body
-        });
+        }, fetchImpl);
     }
     async function refreshTokens(refreshToken) {
         const metadata = await getMetadata();
@@ -217,7 +222,7 @@ export function createOIDC(options) {
             method: 'POST',
             headers: auth.headers,
             body: auth.body
-        });
+        }, fetchImpl);
     }
     async function validateIdToken(idToken, nonce) {
         const metadata = await getMetadata();
@@ -227,16 +232,10 @@ export function createOIDC(options) {
             algorithms: metadata.id_token_signing_alg_values_supported,
             clockSkew: clockSkewSeconds
         });
-        const transformedClaims = options.transformClaims
+        validateIdTokenClaims(claims, nonce);
+        return options.transformClaims
             ? await options.transformClaims(claims)
             : claims;
-        if (transformedClaims.nonce !== nonce) {
-            throw error(401, { message: 'Invalid id_token nonce' });
-        }
-        if (!transformedClaims.sub) {
-            throw error(401, { message: 'id_token subject is required' });
-        }
-        return transformedClaims;
     }
     async function validateBackChannelLogoutToken(logoutToken) {
         const metadata = await getMetadata();
@@ -265,7 +264,7 @@ export function createOIDC(options) {
             headers: {
                 authorization: `Bearer ${accessToken}`
             }
-        });
+        }, fetchImpl);
     }
     async function isRevoked(session) {
         if (!session || !backChannelLogoutStore) {
@@ -278,6 +277,10 @@ export function createOIDC(options) {
         if (!session) {
             return null;
         }
+        if (isSessionExpired(session, sessionMaxAgeSeconds)) {
+            await clearPersistedSession(cookies, persisted?.id);
+            return null;
+        }
         if (await isRevoked(session)) {
             await clearPersistedSession(cookies, persisted?.id);
             return null;
@@ -291,6 +294,9 @@ export function createOIDC(options) {
                 ? await validateIdToken(tokenResponse.id_token, session.nonce)
                 : session.claims;
             const rawUser = options.fetchUserInfo !== false ? await fetchUserInfo(tokenResponse.access_token) : session.user;
+            if (claims) {
+                validateUserInfoSubject(claims, rawUser);
+            }
             const user = options.transformUser
                 ? await options.transformUser(rawUser, { claims })
                 : rawUser;
@@ -385,6 +391,7 @@ export function createOIDC(options) {
         const rawUser = options.fetchUserInfo === false
             ? undefined
             : await fetchUserInfo(tokenResponse.access_token).catch(() => undefined);
+        validateUserInfoSubject(claims, rawUser);
         const user = options.transformUser
             ? await options.transformUser(rawUser, { claims })
             : rawUser;
@@ -526,9 +533,14 @@ export function createOIDC(options) {
             if (event.request.method !== 'POST') {
                 throw error(405, { message: 'Logout requires POST' });
             }
-            const postLogoutRedirectUri = event.url.searchParams.get('postLogoutRedirectUri') ?? defaults.postLogoutRedirectUri;
+            const form = await event.request.formData().catch(() => null);
+            const postLogoutRedirectUri = event.url.searchParams.get('postLogoutRedirectUri') ??
+                form?.get('postLogoutRedirectUri')?.toString() ??
+                defaults.postLogoutRedirectUri;
             const clearSessionOnly = event.url.searchParams.get('clearSessionOnly') === '1' ||
                 event.url.searchParams.get('clearSessionOnly') === 'true' ||
+                form?.get('clearSessionOnly')?.toString() === '1' ||
+                form?.get('clearSessionOnly')?.toString() === 'true' ||
                 defaults.clearSessionOnly;
             return signOut(event, { ...defaults, postLogoutRedirectUri, clearSessionOnly });
         };

package/dist/server/jwt.d.ts

@@ -1,5 +1,5 @@
 import type { OIDCClientAssertionOptions, OIDCClientSecretJwtOptions, OIDCPrivateKeyJwtOptions } from './types.js';
-export declare function fetchJson<T>(url: string, init?: RequestInit): Promise<T>;
+export declare function fetchJson<T>(url: string, init?: RequestInit, fetchImpl?: typeof fetch): Promise<T>;
 export declare function asAuthorizationHeader(clientId: string, clientSecret: string): string;
 export declare function createClientSecretJwtAssertion(options: OIDCClientAssertionOptions & OIDCClientSecretJwtOptions): Promise<string>;
 export declare function createPrivateKeyJwtAssertion(options: OIDCClientAssertionOptions & OIDCPrivateKeyJwtOptions): Promise<string>;

package/dist/server/jwt.js

@@ -2,8 +2,8 @@ import { error } from '@sveltejs/kit';
 import { randomBytes } from 'node:crypto';
 import { sign } from '@sourceregistry/node-jwt/promises';
 import { base64UrlEncode } from './utils.js';
-export async function fetchJson(url, init) {
-    const response = await fetch(url, init);
+export async function fetchJson(url, init, fetchImpl = fetch) {
+    const response = await fetchImpl(url, init);
     if (!response.ok) {
         const body = await response.text().catch(() => '');
         throw error(response.status, {

package/dist/server/session.d.ts

@@ -1,3 +1,4 @@
 import type { OIDCSession, OIDCSessionTokens, OIDCTokenResponse, OIDCUserClaims } from './types.js';
 export declare function normalizeTokens(tokenResponse: OIDCTokenResponse, defaultScope: string[], existing?: OIDCSessionTokens, now?: number): OIDCSessionTokens;
 export declare function shouldRefresh<TClaims extends OIDCUserClaims = OIDCUserClaims>(session: OIDCSession<TClaims>, refreshToleranceSeconds: number, now?: number): boolean;
+export declare function isSessionExpired<TClaims extends OIDCUserClaims = OIDCUserClaims>(session: OIDCSession<TClaims>, sessionMaxAgeSeconds: number, now?: number): boolean;

package/dist/server/session.js

@@ -17,3 +17,13 @@ export function shouldRefresh(session, refreshToleranceSeconds, now = Math.floor
     }
     return session.tokens.expiresAt - refreshToleranceSeconds <= now;
 }
+export function isSessionExpired(session, sessionMaxAgeSeconds, now = Math.floor(Date.now() / 1000)) {
+    if (session.createdAt + sessionMaxAgeSeconds <= now) {
+        return true;
+    }
+    // Without a refresh token, an expired access token cannot establish that
+    // the user's session is still valid. Do not keep the local session alive.
+    return !session.tokens.refreshToken &&
+        session.tokens.expiresAt !== undefined &&
+        session.tokens.expiresAt <= now;
+}

package/dist/server/types.d.ts

@@ -53,6 +53,7 @@ export type OIDCUserClaims = Record<string, unknown> & {
     iss?: string;
     aud?: string | string[];
     exp?: number;
+    iat?: number;
     nbf?: number;
     nonce?: string;
 };
@@ -159,6 +160,8 @@ export type OIDCOptions<TClaims extends OIDCUserClaims = OIDCUserClaims, TSessio
     cookieOptions?: Partial<CookieOptions>;
     clockSkewSeconds?: number;
     refreshToleranceSeconds?: number;
+    /** Maximum lifetime of a local browser session. Defaults to 8 hours. */
+    sessionMaxAgeSeconds?: number;
     defaultLoginRedirect?: string;
     defaultLogoutRedirect?: string;
     sessionStore?: OIDCSessionStore<TClaims, TSession> | 'memory';
@@ -176,6 +179,13 @@ export type OIDCOptions<TClaims extends OIDCUserClaims = OIDCUserClaims, TSessio
     }) => MaybePromise<TSession>;
     endpoints?: Partial<OIDCDiscoveryDocument>;
     logger?: OIDCLogger | false;
+    /**
+     * Custom fetch implementation used for all OIDC network calls
+     * (discovery, token, userinfo, JWKS). Useful in dev to work around
+     * self-signed certs via a custom https.Agent — do not disable
+     * TLS verification in production.
+     */
+    fetch?: typeof fetch;
 };
 export type OIDCLoginOptions = {
     returnTo?: string;

package/dist/server/utils.d.ts

@@ -22,4 +22,6 @@ export declare function absoluteUrl(event: {
 export declare function internalRedirectPath(event: {
     url: URL;
 }, pathOrUrl: string | undefined, fallback?: string): string;
+export declare function validateIdTokenClaims(claims: OIDCUserClaims, nonce: string): void;
+export declare function validateUserInfoSubject(claims: OIDCUserClaims, user: OIDCUserClaims | undefined): void;
 export declare function toPublicSession<TClaims extends OIDCUserClaims = OIDCUserClaims>(session: OIDCSession<TClaims> | null): OIDCPublicSession<TClaims> | null;

package/dist/server/utils.js

@@ -119,6 +119,25 @@ export function internalRedirectPath(event, pathOrUrl, fallback = '/') {
         return fallback;
     }
 }
+export function validateIdTokenClaims(claims, nonce) {
+    if (!Number.isFinite(claims.exp)) {
+        throw error(401, { message: 'id_token expiration is required' });
+    }
+    if (!Number.isFinite(claims.iat)) {
+        throw error(401, { message: 'id_token issued-at time is required' });
+    }
+    if (claims.nonce !== nonce) {
+        throw error(401, { message: 'Invalid id_token nonce' });
+    }
+    if (!claims.sub) {
+        throw error(401, { message: 'id_token subject is required' });
+    }
+}
+export function validateUserInfoSubject(claims, user) {
+    if (user && user.sub !== claims.sub) {
+        throw error(401, { message: 'UserInfo subject does not match id_token subject' });
+    }
+}
 export function toPublicSession(session) {
     if (!session)
         return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.6.9",
+  "version": "1.6.11",
   "description": "OIDC authentication helpers for SvelteKit applications",
   "license": "Apache-2.0",
   "scripts": {
@@ -84,7 +84,7 @@
     "oauth"
   ],
   "dependencies": {
-    "@sourceregistry/node-jwt": "^1.5.10"
+    "@sourceregistry/node-jwt": "^1.5.11"
   },
   "release": {
     "branches": [