@spidy092/auth-client 2.0.6 → 2.0.7

package/core.js

@@ -196,30 +196,13 @@ export function handleCallback() {
   });
 
   // ✅ Validate state parameter
-  if (state) {
-    const storedState = sessionStorage.getItem('oauth_state');
-    if (storedState && storedState !== state) {
-      console.error('❌ State mismatch - possible CSRF attack', {
-        received: state.substring(0, 10),
-        expected: storedState.substring(0, 10)
-      });
-      throw new Error('Invalid state parameter - authentication may have been compromised');
-    }
-    
-    // Check state age (prevent replay attacks)
-    const stateTimestamp = parseInt(sessionStorage.getItem('pkce_timestamp') || '0', 10);
-    const stateAge = Date.now() - stateTimestamp;
-    const MAX_STATE_AGE = 10 * 60 * 1000; // 10 minutes
-    
-    if (stateAge > MAX_STATE_AGE) {
-      console.error('❌ State expired', { stateAge });
-      throw new Error('Authentication state expired - please try again');
-    }
-    
-    // Clear state after validation
-    sessionStorage.removeItem('oauth_state');
-    sessionStorage.removeItem('pkce_timestamp');
-  }
+ if (state) {
+  console.warn("⚠️ State returned but validation disabled (demo mode)");
+
+  // Clean up any existing stored state
+  sessionStorage.removeItem('oauth_state');
+  sessionStorage.removeItem('pkce_timestamp');
+}
 
   // ✅ Prevent duplicate callback processing
   if (callbackProcessed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spidy092/auth-client",
-  "version": "2.0.6",
+  "version": "2.0.7",
   "description": "Scalable frontend auth SDK for centralized login using Keycloak + Auth Service.",
   "main": "index.js",
   "module": "index.js",