@udibo/oauth2 0.12.0 → 0.12.1

package/esm/server/authorization-server.d.ts

@@ -489,7 +489,8 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      * Supports multiple grant types based on the configured grants.
      *
      * A malformed request — wrong method, a content-type other than
-     * `application/x-www-form-urlencoded`, or no `grant_type` — is a 400
+     * `application/x-www-form-urlencoded`, no `grant_type`, or a repeated
+     * recognized singleton form parameter — is a 400
      * `invalid_request`. A `grant_type` with no registered grant is
      * `unsupported_grant_type`, checked before client authentication; a client
      * not registered for the grant is `unauthorized_client`. A body over
@@ -643,7 +644,8 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      * endpoint cannot be used as an oracle for whether a token value is live or
      * whose it is. That covers the token only: a malformed request — wrong
      * method, a content-type other than `application/x-www-form-urlencoded`, or
-     * no `token` parameter — is a 400 `invalid_request`, as on the token
+     * no `token` parameter, or repeated `token`, `token_type_hint`, `client_id` or
+     * `client_secret` — is a 400 `invalid_request`, as on the token
      * endpoint.
      *
      * `token_type_hint` orders the lookup rather than restricting it, so a client
@@ -684,6 +686,9 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      * `application/x-www-form-urlencoded`, is a 400 `invalid_request`, as on the
      * token endpoint.
      *
+     * Repeated `token`, `token_type_hint`, `client_id` or `client_secret` form
+     * parameters are refused before the context is resolved.
+     *
      * @see https://datatracker.ietf.org/doc/html/rfc7662
      */
     handleIntrospectionRequest(request: Request): Promise<Response>;
@@ -739,6 +744,9 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      * `application/x-www-form-urlencoded`, is a 400 `invalid_request`, as on the
      * token endpoint.
      *
+     * Repeated `scope`, `client_id` or `client_secret` form parameters are
+     * refused before the context is resolved.
+     *
      * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
      * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
      */

package/esm/server/authorization-server.js

@@ -348,6 +348,37 @@ export class AuthorizationServer extends ResourceServer {
         }
         return grant;
     }
+    #assertSingletonParameters(body, parameters) {
+        for (const parameter of parameters) {
+            if (body.getAll(parameter).length > 1) {
+                throw new InvalidRequestError(`${parameter} parameter must not be repeated`);
+            }
+        }
+    }
+    #assertTokenSingletonParameters(body) {
+        this.#assertSingletonParameters(body, ["grant_type"]);
+        let parameters;
+        switch (body.get("grant_type")) {
+            case "authorization_code":
+                parameters = ["code", "redirect_uri", "code_verifier"];
+                break;
+            case "refresh_token":
+                parameters = ["refresh_token", "scope"];
+                break;
+            case "password":
+                parameters = ["username", "password", "scope"];
+                break;
+            case "client_credentials":
+                parameters = ["scope"];
+                break;
+            case DEVICE_AUTHORIZATION_GRANT_TYPE:
+                parameters = ["device_code"];
+                break;
+            default:
+                parameters = [];
+        }
+        this.#assertSingletonParameters(body, parameters);
+    }
     async #readBody(request, options = {}) {
         const bytes = await readBoundedBody(request, this.#maxBodyBytes, options)
             .catch((cause) => {
@@ -374,6 +405,8 @@ export class AuthorizationServer extends ResourceServer {
         }).formData().catch(() => {
             throw new InvalidRequestError("body must be application/x-www-form-urlencoded");
         });
+        this.#assertSingletonParameters(body, ["client_id", "client_secret"]);
+        options.validateBody?.(body);
         const context = await this.authorizationContext(request);
         const grant = options.grantFromBody?.(body);
         const client = grant
@@ -389,7 +422,8 @@ export class AuthorizationServer extends ResourceServer {
      * Supports multiple grant types based on the configured grants.
      *
      * A malformed request — wrong method, a content-type other than
-     * `application/x-www-form-urlencoded`, or no `grant_type` — is a 400
+     * `application/x-www-form-urlencoded`, no `grant_type`, or a repeated
+     * recognized singleton form parameter — is a 400
      * `invalid_request`. A `grant_type` with no registered grant is
      * `unsupported_grant_type`, checked before client authentication; a client
      * not registered for the grant is `unauthorized_client`. A body over
@@ -401,6 +435,7 @@ export class AuthorizationServer extends ResourceServer {
             const { context, body, client, grant } = await this
                 .#beginClientAuthenticatedRequest(request, {
                 grantFromBody: (body) => this.#grantFromBody(body),
+                validateBody: (body) => this.#assertTokenSingletonParameters(body),
             });
             const token = await grant.token(request, client, body);
             return await this.createTokenResponse(token, context, grant);
@@ -894,7 +929,8 @@ export class AuthorizationServer extends ResourceServer {
      * endpoint cannot be used as an oracle for whether a token value is live or
      * whose it is. That covers the token only: a malformed request — wrong
      * method, a content-type other than `application/x-www-form-urlencoded`, or
-     * no `token` parameter — is a 400 `invalid_request`, as on the token
+     * no `token` parameter, or repeated `token`, `token_type_hint`, `client_id` or
+     * `client_secret` — is a 400 `invalid_request`, as on the token
      * endpoint.
      *
      * `token_type_hint` orders the lookup rather than restricting it, so a client
@@ -905,7 +941,12 @@ export class AuthorizationServer extends ResourceServer {
     async handleRevocationRequest(request) {
         try {
             const { context, body, client } = await this
-                .#beginClientAuthenticatedRequest(request);
+                .#beginClientAuthenticatedRequest(request, {
+                validateBody: (body) => this.#assertSingletonParameters(body, [
+                    "token",
+                    "token_type_hint",
+                ]),
+            });
             const token = body.get("token");
             if (typeof token !== "string") {
                 throw new InvalidRequestError("token parameter required");
@@ -979,12 +1020,20 @@ export class AuthorizationServer extends ResourceServer {
      * `application/x-www-form-urlencoded`, is a 400 `invalid_request`, as on the
      * token endpoint.
      *
+     * Repeated `token`, `token_type_hint`, `client_id` or `client_secret` form
+     * parameters are refused before the context is resolved.
+     *
      * @see https://datatracker.ietf.org/doc/html/rfc7662
      */
     async handleIntrospectionRequest(request) {
         try {
             const { context, body, client } = await this
-                .#beginClientAuthenticatedRequest(request);
+                .#beginClientAuthenticatedRequest(request, {
+                validateBody: (body) => this.#assertSingletonParameters(body, [
+                    "token",
+                    "token_type_hint",
+                ]),
+            });
             const tokenValue = body.get("token");
             if (typeof tokenValue !== "string") {
                 throw new InvalidRequestError("token parameter required");
@@ -1164,6 +1213,9 @@ export class AuthorizationServer extends ResourceServer {
      * `application/x-www-form-urlencoded`, is a 400 `invalid_request`, as on the
      * token endpoint.
      *
+     * Repeated `scope`, `client_id` or `client_secret` form parameters are
+     * refused before the context is resolved.
+     *
      * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
      * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
      */
@@ -1172,6 +1224,7 @@ export class AuthorizationServer extends ResourceServer {
             const { context, body, client } = await this
                 .#beginClientAuthenticatedRequest(request, {
                 requiredGrantType: DEVICE_AUTHORIZATION_GRANT_TYPE,
+                validateBody: (body) => this.#assertSingletonParameters(body, ["scope"]),
             });
             const grant = this.#deviceAuthorizationGrant();
             const scopeText = body.get("scope");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "repository": {
     "type": "git",