@sourceregistry/sveltekit-oidc 2.1.0 → 3.0.0

package/dist/server/cookies.js

@@ -1,11 +1,20 @@
 import { parseSignedCookie, serializeSignedCookie } from './utils.js';
-export function createOIDCCookieStore(cookieSecret, sessionCookieName, stateCookieName, cookieOptions) {
+export function createOIDCCookieStore(cookieSecret, sessionCookieName, stateCookieName, cookieOptions, stateMaxAgeSeconds, maxCookieSizeBytes) {
+    const stateCookiePrefix = `${stateCookieName}.`;
+    const stateName = (token) => `${stateCookiePrefix}${token.slice(0, 16)}`;
+    const assertCookieSize = (name, value) => {
+        if (Buffer.byteLength(`${name}=${value}`, 'utf8') > maxCookieSizeBytes) {
+            throw new TypeError(`OIDC cookie '${name}' exceeds ${maxCookieSizeBytes} bytes; configure sessionStore to keep tokens server-side`);
+        }
+    };
     return {
         readSession(cookies) {
             return parseSignedCookie(cookies.get(sessionCookieName), cookieSecret);
         },
         writeSession(cookies, session) {
-            cookies.set(sessionCookieName, serializeSignedCookie(session, cookieSecret), cookieOptions);
+            const value = serializeSignedCookie(session, cookieSecret);
+            assertCookieSize(sessionCookieName, value);
+            cookies.set(sessionCookieName, value, cookieOptions);
         },
         clearSession(cookies) {
             cookies.delete(sessionCookieName, cookieOptions);
@@ -19,17 +28,29 @@ export function createOIDCCookieStore(cookieSecret, sessionCookieName, stateCook
         clearSessionReference(cookies) {
             cookies.delete(sessionCookieName, cookieOptions);
         },
-        readState(cookies) {
-            return parseSignedCookie(cookies.get(stateCookieName), cookieSecret);
+        readState(cookies, stateToken) {
+            const transactionValue = stateToken ? cookies.get(stateName(stateToken)) : undefined;
+            return parseSignedCookie(transactionValue ?? cookies.get(stateCookieName), cookieSecret);
         },
         writeState(cookies, state) {
-            cookies.set(stateCookieName, serializeSignedCookie(state, cookieSecret), {
+            const name = stateName(state.state);
+            const value = serializeSignedCookie(state, cookieSecret);
+            assertCookieSize(name, value);
+            cookies.set(name, value, {
                 ...cookieOptions,
-                maxAge: 60 * 10
+                maxAge: stateMaxAgeSeconds
             });
         },
-        clearState(cookies) {
+        clearState(cookies, stateToken) {
+            if (stateToken)
+                cookies.delete(stateName(stateToken), cookieOptions);
             cookies.delete(stateCookieName, cookieOptions);
+            if (!stateToken) {
+                for (const cookie of cookies.getAll()) {
+                    if (cookie.name.startsWith(stateCookiePrefix))
+                        cookies.delete(cookie.name, cookieOptions);
+                }
+            }
         }
     };
 }