@udibo/oauth2 0.12.0 → 0.12.2

package/esm/server/authorization-server.d.ts

@@ -489,7 +489,8 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      * Supports multiple grant types based on the configured grants.
      *
      * A malformed request — wrong method, a content-type other than
-     * `application/x-www-form-urlencoded`, or no `grant_type` — is a 400
+     * `application/x-www-form-urlencoded`, no `grant_type`, or a repeated
+     * recognized singleton form parameter — is a 400
      * `invalid_request`. A `grant_type` with no registered grant is
      * `unsupported_grant_type`, checked before client authentication; a client
      * not registered for the grant is `unauthorized_client`. A body over
@@ -643,7 +644,8 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      * endpoint cannot be used as an oracle for whether a token value is live or
      * whose it is. That covers the token only: a malformed request — wrong
      * method, a content-type other than `application/x-www-form-urlencoded`, or
-     * no `token` parameter — is a 400 `invalid_request`, as on the token
+     * no `token` parameter, or repeated `token`, `token_type_hint`, `client_id` or
+     * `client_secret` — is a 400 `invalid_request`, as on the token
      * endpoint.
      *
      * `token_type_hint` orders the lookup rather than restricting it, so a client
@@ -684,6 +686,9 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      * `application/x-www-form-urlencoded`, is a 400 `invalid_request`, as on the
      * token endpoint.
      *
+     * Repeated `token`, `token_type_hint`, `client_id` or `client_secret` form
+     * parameters are refused before the context is resolved.
+     *
      * @see https://datatracker.ietf.org/doc/html/rfc7662
      */
     handleIntrospectionRequest(request: Request): Promise<Response>;
@@ -739,6 +744,9 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      * `application/x-www-form-urlencoded`, is a 400 `invalid_request`, as on the
      * token endpoint.
      *
+     * Repeated `scope`, `client_id` or `client_secret` form parameters are
+     * refused before the context is resolved.
+     *
      * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
      * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
      */

package/esm/server/authorization-server.js

@@ -348,6 +348,37 @@ export class AuthorizationServer extends ResourceServer {
         }
         return grant;
     }
+    #assertSingletonParameters(body, parameters) {
+        for (const parameter of parameters) {
+            if (body.getAll(parameter).length > 1) {
+                throw new InvalidRequestError(`${parameter} parameter must not be repeated`);
+            }
+        }
+    }
+    #assertTokenSingletonParameters(body) {
+        this.#assertSingletonParameters(body, ["grant_type"]);
+        let parameters;
+        switch (body.get("grant_type")) {
+            case "authorization_code":
+                parameters = ["code", "redirect_uri", "code_verifier"];
+                break;
+            case "refresh_token":
+                parameters = ["refresh_token", "scope"];
+                break;
+            case "password":
+                parameters = ["username", "password", "scope"];
+                break;
+            case "client_credentials":
+                parameters = ["scope"];
+                break;
+            case DEVICE_AUTHORIZATION_GRANT_TYPE:
+                parameters = ["device_code"];
+                break;
+            default:
+                parameters = [];
+        }
+        this.#assertSingletonParameters(body, parameters);
+    }
     async #readBody(request, options = {}) {
         const bytes = await readBoundedBody(request, this.#maxBodyBytes, options)
             .catch((cause) => {
@@ -374,6 +405,8 @@ export class AuthorizationServer extends ResourceServer {
         }).formData().catch(() => {
             throw new InvalidRequestError("body must be application/x-www-form-urlencoded");
         });
+        this.#assertSingletonParameters(body, ["client_id", "client_secret"]);
+        options.validateBody?.(body);
         const context = await this.authorizationContext(request);
         const grant = options.grantFromBody?.(body);
         const client = grant
@@ -389,7 +422,8 @@ export class AuthorizationServer extends ResourceServer {
      * Supports multiple grant types based on the configured grants.
      *
      * A malformed request — wrong method, a content-type other than
-     * `application/x-www-form-urlencoded`, or no `grant_type` — is a 400
+     * `application/x-www-form-urlencoded`, no `grant_type`, or a repeated
+     * recognized singleton form parameter — is a 400
      * `invalid_request`. A `grant_type` with no registered grant is
      * `unsupported_grant_type`, checked before client authentication; a client
      * not registered for the grant is `unauthorized_client`. A body over
@@ -401,6 +435,7 @@ export class AuthorizationServer extends ResourceServer {
             const { context, body, client, grant } = await this
                 .#beginClientAuthenticatedRequest(request, {
                 grantFromBody: (body) => this.#grantFromBody(body),
+                validateBody: (body) => this.#assertTokenSingletonParameters(body),
             });
             const token = await grant.token(request, client, body);
             return await this.createTokenResponse(token, context, grant);
@@ -894,7 +929,8 @@ export class AuthorizationServer extends ResourceServer {
      * endpoint cannot be used as an oracle for whether a token value is live or
      * whose it is. That covers the token only: a malformed request — wrong
      * method, a content-type other than `application/x-www-form-urlencoded`, or
-     * no `token` parameter — is a 400 `invalid_request`, as on the token
+     * no `token` parameter, or repeated `token`, `token_type_hint`, `client_id` or
+     * `client_secret` — is a 400 `invalid_request`, as on the token
      * endpoint.
      *
      * `token_type_hint` orders the lookup rather than restricting it, so a client
@@ -905,7 +941,12 @@ export class AuthorizationServer extends ResourceServer {
     async handleRevocationRequest(request) {
         try {
             const { context, body, client } = await this
-                .#beginClientAuthenticatedRequest(request);
+                .#beginClientAuthenticatedRequest(request, {
+                validateBody: (body) => this.#assertSingletonParameters(body, [
+                    "token",
+                    "token_type_hint",
+                ]),
+            });
             const token = body.get("token");
             if (typeof token !== "string") {
                 throw new InvalidRequestError("token parameter required");
@@ -979,12 +1020,20 @@ export class AuthorizationServer extends ResourceServer {
      * `application/x-www-form-urlencoded`, is a 400 `invalid_request`, as on the
      * token endpoint.
      *
+     * Repeated `token`, `token_type_hint`, `client_id` or `client_secret` form
+     * parameters are refused before the context is resolved.
+     *
      * @see https://datatracker.ietf.org/doc/html/rfc7662
      */
     async handleIntrospectionRequest(request) {
         try {
             const { context, body, client } = await this
-                .#beginClientAuthenticatedRequest(request);
+                .#beginClientAuthenticatedRequest(request, {
+                validateBody: (body) => this.#assertSingletonParameters(body, [
+                    "token",
+                    "token_type_hint",
+                ]),
+            });
             const tokenValue = body.get("token");
             if (typeof tokenValue !== "string") {
                 throw new InvalidRequestError("token parameter required");
@@ -1164,6 +1213,9 @@ export class AuthorizationServer extends ResourceServer {
      * `application/x-www-form-urlencoded`, is a 400 `invalid_request`, as on the
      * token endpoint.
      *
+     * Repeated `scope`, `client_id` or `client_secret` form parameters are
+     * refused before the context is resolved.
+     *
      * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
      * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
      */
@@ -1172,6 +1224,7 @@ export class AuthorizationServer extends ResourceServer {
             const { context, body, client } = await this
                 .#beginClientAuthenticatedRequest(request, {
                 requiredGrantType: DEVICE_AUTHORIZATION_GRANT_TYPE,
+                validateBody: (body) => this.#assertSingletonParameters(body, ["scope"]),
             });
             const grant = this.#deviceAuthorizationGrant();
             const scopeText = body.get("scope");

package/esm/utils/url.d.ts

@@ -13,7 +13,9 @@ import "../_dnt.polyfills.js";
  * that some browsers resolve as a host, and any value containing a C0 control
  * character or `DEL` — browsers strip TAB/CR/LF before parsing a URL, so
  * `/<TAB>/evil.com` would otherwise navigate to `evil.com`. Anything else
- * collapses to `fallback` (default `/`).
+ * collapses to `fallback` (default `/`), which is returned verbatim. The
+ * fallback is trusted caller configuration; do not pass user-controlled input
+ * there.
  *
  * Percent-encoded control characters (`/%09/x`) are safe and pass through: a
  * browser does not decode them before parsing, so they stay on the origin.
@@ -34,17 +36,17 @@ import "../_dnt.polyfills.js";
  * ```
  */
 export declare function safeReturnTo(value: string | null | undefined, fallback?: string): string;
-/** Options for {@link loginContinuation}. */
+/** Trusted application configuration for {@link loginContinuation}. */
 export interface LoginContinuationOptions {
     /**
-     * The authorization endpoint (absolute URL or path). When `returnTo` points at
-     * it, the flow is **resumed** (the in-flight authorize request already carries
+     * Trusted authorization endpoint (absolute URL or path). When `returnTo` points
+     * at it, the flow is **resumed** (the in-flight authorize request already carries
      * its `state`). Omit it and every `returnTo` starts a fresh login.
      */
     authorizeEndpoint?: string;
-    /** The login path to start a fresh login. Defaults to `"/auth/login"`. */
+    /** Trusted login path for a fresh login. Defaults to `"/auth/login"`. */
     loginPath?: string;
-    /** Fallback when `returnTo` is missing/unsafe. Defaults to `"/"`. */
+    /** Trusted fallback for missing/unsafe `returnTo`. Defaults to `"/"`. */
     defaultReturnTo?: string;
 }
 /**
@@ -61,6 +63,7 @@ export interface LoginContinuationOptions {
  *
  * Pure and client-safe — the same logic behind `HonoBff.loginContinuation`
  * (server) and `BffClient.loginContinuation` (browser). `returnTo` is
- * open-redirect-guarded via {@link safeReturnTo}.
+ * open-redirect-guarded via {@link safeReturnTo}. The fallback, authorization
+ * endpoint and login path are trusted application configuration.
  */
 export declare function loginContinuation(returnTo: string | null | undefined, options?: LoginContinuationOptions): string;

package/esm/utils/url.js

@@ -22,7 +22,9 @@ function hasControlCharacter(value) {
  * that some browsers resolve as a host, and any value containing a C0 control
  * character or `DEL` — browsers strip TAB/CR/LF before parsing a URL, so
  * `/<TAB>/evil.com` would otherwise navigate to `evil.com`. Anything else
- * collapses to `fallback` (default `/`).
+ * collapses to `fallback` (default `/`), which is returned verbatim. The
+ * fallback is trusted caller configuration; do not pass user-controlled input
+ * there.
  *
  * Percent-encoded control characters (`/%09/x`) are safe and pass through: a
  * browser does not decode them before parsing, so they stay on the origin.
@@ -74,7 +76,8 @@ export function safeReturnTo(value, fallback = "/") {
  *
  * Pure and client-safe — the same logic behind `HonoBff.loginContinuation`
  * (server) and `BffClient.loginContinuation` (browser). `returnTo` is
- * open-redirect-guarded via {@link safeReturnTo}.
+ * open-redirect-guarded via {@link safeReturnTo}. The fallback, authorization
+ * endpoint and login path are trusted application configuration.
  */
 export function loginContinuation(returnTo, options = {}) {
     const safe = safeReturnTo(returnTo, options.defaultReturnTo ?? "/");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "repository": {
     "type": "git",