@strapi/plugin-users-permissions 5.52.2 → 5.53.0

package/server/src/utils/oauth-connect/index.js

@@ -5,6 +5,7 @@ const { errors } = require('@strapi/utils');
 const builtinProviderEndpoints = require('./providers');
 const oauth1 = require('./oauth1');
 const oauth2 = require('./oauth2');
+const { trimGrantSessionResponse } = require('../trim-grant-session-response');
 
 const CONNECT_PREFIX = '/connect';
 
@@ -87,6 +88,15 @@ const preserveGrantDynamic = (ctx) => {
   return dynamic ? { dynamic } : {};
 };
 
+const redirectWithSessionResponse = (ctx, callbackUrl, provider, tokenResponse) => {
+  const grantResponse = oauth2.tokensToQueryPayload(provider, tokenResponse);
+  ctx.session.grant = {
+    response: trimGrantSessionResponse(grantResponse, provider.name),
+  };
+
+  return redirectWithPayload(ctx, callbackUrl, {});
+};
+
 const startOAuth1Flow = async (ctx, provider, parsed, redirectUri) => {
   const requestToken = await oauth1.requestToken({
     requestUrl: provider.request_url,
@@ -142,9 +152,7 @@ const handleOAuth1Callback = async (ctx, provider, callbackUrl) => {
     oauthTokenCredential: requestToken.oauth_token_secret,
   });
 
-  const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);
-  ctx.session.grant = {};
-  return redirectWithPayload(ctx, callbackUrl, payload);
+  return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);
 };
 
 const handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri) => {
@@ -176,9 +184,7 @@ const handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri) =>
     subdomain: provider.subdomain,
   });
 
-  const payload = oauth2.tokensToQueryPayload(provider, tokenResponse);
-  ctx.session.grant = {};
-  return redirectWithPayload(ctx, callbackUrl, payload);
+  return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);
 };
 
 const createOAuthConnectMiddleware = () => {

package/server/src/utils/trim-grant-session-response.js

@@ -0,0 +1,70 @@
+'use strict';
+
+const compact = (value) => {
+  if (value === null || value === undefined) {
+    return undefined;
+  }
+
+  if (typeof value !== 'object' || Array.isArray(value)) {
+    return value;
+  }
+
+  return Object.fromEntries(
+    Object.entries(value)
+      .map(([key, entry]) => [key, compact(entry)])
+      .filter(([, entry]) => entry !== undefined)
+  );
+};
+
+/**
+ * Compact grant's OAuth token response before it is written to the signed
+ * koa-session cookie. The full token exchange payload (especially Cognito's
+ * dual JWTs plus a duplicated raw blob) can exceed the browser's ~4 KB
+ * per-cookie limit and silently break the auth callback.
+ *
+ * Keep only fields that auth.callback / providers-registry actually read.
+ */
+const trimGrantSessionResponse = (grantResponse, provider) => {
+  if (!grantResponse || typeof grantResponse !== 'object') {
+    return grantResponse;
+  }
+
+  switch (provider) {
+    case 'cognito':
+      return compact({
+        id_token: grantResponse.id_token,
+      });
+
+    case 'twitter':
+      return compact({
+        access_token: grantResponse.access_token,
+        access_secret: grantResponse.access_secret,
+        raw: grantResponse.raw?.screen_name
+          ? { screen_name: grantResponse.raw.screen_name }
+          : undefined,
+      });
+
+    case 'vk':
+      return compact({
+        access_token: grantResponse.access_token,
+        raw:
+          grantResponse.raw?.email != null && grantResponse.raw?.user_id != null
+            ? {
+                email: grantResponse.raw.email,
+                user_id: grantResponse.raw.user_id,
+              }
+            : undefined,
+      });
+
+    default:
+      return compact({
+        access_token: grantResponse.access_token,
+        oauth_token: grantResponse.oauth_token,
+        id_token: grantResponse.id_token,
+      });
+  }
+};
+
+module.exports = {
+  trimGrantSessionResponse,
+};