@udibo/oauth2 0.15.1 → 0.15.2

package/dist/adapters/hono/identity.d.ts

@@ -88,6 +88,23 @@ export interface HonoIdentityOptions<User extends IdentityUser> {
      * outer middleware already terminates CSRF.
      */
     csrf?: HonoIdentityCsrfOptions | false;
+    /**
+     * The most bytes a route reads from a request body. Every route reads its
+     * body before anyone is authenticated, so the cap bounds what an anonymous
+     * request can make the server buffer. Bytes are counted as they arrive, so a
+     * chunked body or an understated `Content-Length` cannot get past it. A
+     * larger body is refused with `413` `{ error: "invalid_request" }` before
+     * the service is called.
+     *
+     * When a middleware mounted before these routes has already read the body
+     * (for example with `c.req.parseBody()`), the routes read Hono's parsed copy
+     * and the cap does not apply, so that middleware needs its own limit.
+     *
+     * @default 65536
+     * @throws {RangeError} From {@linkcode honoIdentityRoutes} when it is not a
+     *   positive integer.
+     */
+    maxBodyBytes?: number;
     /**
      * Called after `signup`/`signin` authenticates a user. Your app owns what
      * happens next — create your session and return a `Response` (e.g. a redirect
@@ -112,7 +129,12 @@ export interface HonoIdentityOptions<User extends IdentityUser> {
  * Every mounted route sits behind the same-origin guard described in
  * {@link HonoIdentityOptions.csrf}, which is on unless you pass `csrf: false`.
  *
+ * Every route reads at most {@link HonoIdentityOptions.maxBodyBytes} of its
+ * body and answers a larger one with `413`.
+ *
  * Passwordless, MFA, and social are intentionally not mounted — see the module
  * doc for why and where to hand-wire each.
+ *
+ * @throws {RangeError} If `maxBodyBytes` is not a positive integer.
  */
 export declare function honoIdentityRoutes<User extends IdentityUser>(service: IdentityService<User>, options?: HonoIdentityOptions<User>): Hono;

package/dist/adapters/hono/identity.js

@@ -41,12 +41,16 @@
  */
 import { Hono } from "hono";
 import { identityErrorStatus, isIdentityError, } from "../../identity/errors.js";
+import { assertMaxBodyBytes, DEFAULT_MAX_BODY_BYTES, readBoundedBody, } from "../../utils/_body.js";
 function handle(fn) {
     return async (c) => {
         try {
             return await fn(c);
         }
         catch (error) {
+            if (error instanceof BodyTooLargeError) {
+                return c.json({ error: "invalid_request" }, 413);
+            }
             if (!isIdentityError(error))
                 throw error;
             if (error.retryAfterMs !== undefined) {
@@ -57,11 +61,24 @@ function handle(fn) {
     };
 }
 const STRING_FIELDS = new Set(["password", "identifier", "email", "token"]);
-async function readBody(c) {
+class BodyTooLargeError extends Error {
+}
+async function boundedBody(c, maxBytes) {
+    if (c.req.raw.bodyUsed)
+        return c.req;
+    const bytes = await readBoundedBody(c.req.raw, maxBytes).catch(() => new Uint8Array());
+    if (!bytes)
+        throw new BodyTooLargeError();
+    return new Response(bytes, {
+        headers: { "content-type": c.req.header("content-type") ?? "" },
+    });
+}
+async function readBody(c, maxBytes) {
     const contentType = c.req.header("content-type") ?? "";
+    const source = await boundedBody(c, maxBytes);
     if (contentType.includes("application/json")) {
         try {
-            const body = await c.req.json();
+            const body = await source.json();
             if (typeof body !== "object" || body === null || Array.isArray(body)) {
                 return {};
             }
@@ -79,7 +96,7 @@ async function readBody(c) {
         }
     }
     try {
-        const form = await c.req.formData();
+        const form = await source.formData();
         const out = {};
         for (const [key, value] of form)
             out[key] = String(value);
@@ -135,10 +152,17 @@ function sameOriginGuard(options) {
  * Every mounted route sits behind the same-origin guard described in
  * {@link HonoIdentityOptions.csrf}, which is on unless you pass `csrf: false`.
  *
+ * Every route reads at most {@link HonoIdentityOptions.maxBodyBytes} of its
+ * body and answers a larger one with `413`.
+ *
  * Passwordless, MFA, and social are intentionally not mounted — see the module
  * doc for why and where to hand-wire each.
+ *
+ * @throws {RangeError} If `maxBodyBytes` is not a positive integer.
  */
 export function honoIdentityRoutes(service, options = {}) {
+    const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    assertMaxBodyBytes(maxBodyBytes, "maxBodyBytes");
     const app = new Hono();
     const paths = {
         signUp: "/signup",
@@ -154,7 +178,7 @@ export function honoIdentityRoutes(service, options = {}) {
     }
     if (onAuthenticated) {
         app.post(paths.signUp, handle(async (c) => {
-            const { password, ...profile } = await readBody(c);
+            const { password, ...profile } = await readBody(c, maxBodyBytes);
             if (typeof password !== "string" || !password) {
                 return c.json({ error: "invalid_request" }, 400);
             }
@@ -162,7 +186,7 @@ export function honoIdentityRoutes(service, options = {}) {
             return await onAuthenticated(c, user, "signUp");
         }));
         app.post(paths.signIn, handle(async (c) => {
-            const body = await readBody(c);
+            const body = await readBody(c, maxBodyBytes);
             const user = await service.signIn({
                 identifier: String(body.identifier ?? ""),
                 password: String(body.password ?? ""),
@@ -173,12 +197,12 @@ export function honoIdentityRoutes(service, options = {}) {
         }));
     }
     app.post(paths.requestPasswordReset, handle(async (c) => {
-        const body = await readBody(c);
+        const body = await readBody(c, maxBodyBytes);
         await service.requestPasswordReset(String(body.email ?? ""));
         return c.json({ ok: true });
     }));
     app.post(paths.resetPassword, handle(async (c) => {
-        const body = await readBody(c);
+        const body = await readBody(c, maxBodyBytes);
         const result = await service.resetPassword({
             token: String(body.token ?? ""),
             password: String(body.password ?? ""),
@@ -188,7 +212,7 @@ export function honoIdentityRoutes(service, options = {}) {
             : c.json({ error: "invalid_token" }, 400);
     }));
     app.post(paths.verifyEmail, handle(async (c) => {
-        const body = await readBody(c);
+        const body = await readBody(c, maxBodyBytes);
         const result = await service.verifyEmail(String(body.token ?? ""));
         if (result.status === "success") {
             return c.json({ ok: true, userId: result.userId });

package/dist/server/authorization-server.d.ts

@@ -444,7 +444,8 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      *
      * @throws {Error} If any grant's map key does not equal its `grantType`.
      * @throws {Error} If `requireOidc` is set without `signingKeys`.
-     * @throws {RangeError} If `maxBodyBytes` is not a positive integer.
+     * @throws {RangeError} If `maxBodyBytes` or `maxTokenBodyBytes` is not a
+     *   positive integer.
      */
     constructor(options: AuthorizationServerOptions<Client, User, S>);
     /**

package/dist/server/authorization-server.js

@@ -197,7 +197,8 @@ export class AuthorizationServer extends ResourceServer {
      *
      * @throws {Error} If any grant's map key does not equal its `grantType`.
      * @throws {Error} If `requireOidc` is set without `signingKeys`.
-     * @throws {RangeError} If `maxBodyBytes` is not a positive integer.
+     * @throws {RangeError} If `maxBodyBytes` or `maxTokenBodyBytes` is not a
+     *   positive integer.
      */
     constructor(options) {
         super({
@@ -205,6 +206,7 @@ export class AuthorizationServer extends ResourceServer {
             Scope: options.Scope,
             realm: options.realm,
             clockSkewSeconds: options.clockSkewSeconds,
+            maxTokenBodyBytes: options.maxTokenBodyBytes,
             errorFormat: options.errorFormat,
             throwOnError: options.throwOnError,
         });

package/dist/server/resource-server.d.ts

@@ -55,6 +55,27 @@ export interface ResourceServerOptions<Client extends ClientInterface, User, S e
      * matter which reader is in play.
      */
     clockSkewSeconds?: number;
+    /**
+     * The most bytes {@linkcode ResourceServer.getAccessToken} reads from a
+     * form-encoded `POST` body while looking for an RFC 6750 §2.2
+     * `access_token`, which it does only when no bearer `Authorization` header
+     * is sent. That read happens before the caller is authenticated, so the cap
+     * bounds what an anonymous request can make the server buffer, including
+     * through `protect()` middleware mounted ahead of a route's own body limit.
+     * Bytes are counted as they arrive, so a chunked body or an understated
+     * `Content-Length` cannot get past it.
+     *
+     * A larger body is not searched: the request is treated as carrying no
+     * token (`authenticate` throws {@linkcode AccessDeniedError}, a `401`), and
+     * the body is left for the route. A client that sends a bigger form body
+     * should send its token in the `Authorization` header instead, as RFC 6750
+     * §2.1 recommends.
+     *
+     * @default 16384
+     * @throws {RangeError} From the constructor when it is not a positive
+     *   integer.
+     */
+    maxTokenBodyBytes?: number;
     /**
      * Format for error responses.
      * - `"oauth2"` (default): Standard OAuth2 error format with `error`,
@@ -162,7 +183,8 @@ export declare class ResourceServer<Client extends ClientInterface, User, S exte
      * Creates a resource server from the given {@linkcode ResourceServerOptions}.
      *
      * @throws {RangeError} If `clockSkewSeconds` is negative, non-finite, or
-     *   overflows when converted to milliseconds.
+     *   overflows when converted to milliseconds, or if `maxTokenBodyBytes` is
+     *   not a positive integer.
      */
     constructor(options: ResourceServerOptions<Client, User, S>);
     /**
@@ -239,8 +261,11 @@ export declare class ResourceServer<Client extends ClientInterface, User, S exte
     handleAuthError(error: unknown): Response;
     /**
      * Extracts an access token from a request.
-     * Looks in the Authorization header (Bearer token) first,
-     * then in the request body for form-encoded requests.
+     * Looks in the Authorization header (Bearer token) first, then in the body
+     * of a form-encoded `POST` (RFC 6750 §2.2), read from a clone so the
+     * original body stays readable. A body over
+     * {@linkcode ResourceServerOptions.maxTokenBodyBytes} is not searched, and
+     * no more of it is read than the cap.
      */
     getAccessToken(request: Request): Promise<string | null>;
     /**

package/dist/server/resource-server.js

@@ -10,6 +10,7 @@ import { BasicScope } from "../models/scope.js";
 import { AccessDeniedError, InsufficientPermissionsError, InsufficientScopeError, InvalidTokenError, toOAuth2Error, } from "../errors.js";
 import { authorizationFromClaims, } from "../models/authorization.js";
 import { assertClockSkewSeconds } from "./_clock-skew.js";
+import { assertMaxBodyBytes, DEFAULT_MAX_TOKEN_BODY_BYTES, peekBoundedBody, } from "../utils/_body.js";
 /** Bearer token regex pattern. */
 export const BEARER_TOKEN = /^ *(?:[Bb][Ee][Aa][Rr][Ee][Rr]) +([\w-.~+/]+=*) *$/;
 const FAILURE_LABELS = {
@@ -80,6 +81,7 @@ export class ResourceServer {
     /** Resolves the per-request {@link ResourceServerContext}. */
     resolveContext;
     #clockSkewSeconds = 0;
+    #maxTokenBodyBytes;
     /**
      * Leeway in seconds applied to the access token's expiry. Defaults to `0`.
      * May be reassigned to any non-negative finite number with a finite
@@ -102,13 +104,17 @@ export class ResourceServer {
      * Creates a resource server from the given {@linkcode ResourceServerOptions}.
      *
      * @throws {RangeError} If `clockSkewSeconds` is negative, non-finite, or
-     *   overflows when converted to milliseconds.
+     *   overflows when converted to milliseconds, or if `maxTokenBodyBytes` is
+     *   not a positive integer.
      */
     constructor(options) {
         this.Scope =
             options.Scope ?? BasicScope;
         this.realm = options.realm ?? "Service";
         this.clockSkewSeconds = options.clockSkewSeconds ?? 0;
+        this.#maxTokenBodyBytes =
+            options.maxTokenBodyBytes ?? DEFAULT_MAX_TOKEN_BODY_BYTES;
+        assertMaxBodyBytes(this.#maxTokenBodyBytes, "maxTokenBodyBytes");
         this.errorFormat = options.errorFormat ?? "oauth2";
         this.throwOnError = options.throwOnError ?? false;
         this.resolveContext = options.resolve;
@@ -252,8 +258,11 @@ export class ResourceServer {
     }
     /**
      * Extracts an access token from a request.
-     * Looks in the Authorization header (Bearer token) first,
-     * then in the request body for form-encoded requests.
+     * Looks in the Authorization header (Bearer token) first, then in the body
+     * of a form-encoded `POST` (RFC 6750 §2.2), read from a clone so the
+     * original body stays readable. A body over
+     * {@linkcode ResourceServerOptions.maxTokenBodyBytes} is not searched, and
+     * no more of it is read than the cap.
      */
     async getAccessToken(request) {
         const authorization = request.headers.get("authorization");
@@ -266,13 +275,18 @@ export class ResourceServer {
         if (request.method === "POST" &&
             contentType?.includes("application/x-www-form-urlencoded")) {
             try {
-                const body = await request.clone().formData();
+                const bytes = await peekBoundedBody(request, this.#maxTokenBodyBytes);
+                if (!bytes)
+                    return null;
+                const body = await new Response(bytes, {
+                    headers: { "content-type": contentType },
+                }).formData();
                 const accessToken = body.get("access_token");
                 if (typeof accessToken === "string")
                     return accessToken;
             }
             catch {
-                // ignore
+                return null;
             }
         }
         return null;

package/dist/utils/_body.d.ts

@@ -11,6 +11,12 @@
  * the 8–16 KiB header limits common to servers and proxies.
  */
 export declare const DEFAULT_MAX_BODY_BYTES: number;
+/**
+ * The default cap on a form body searched for an RFC 6750 §2.2
+ * `access_token`: 16 KiB, Node's default limit on a request's whole header
+ * block, so any token a client could send as `Authorization: Bearer` fits.
+ */
+export declare const DEFAULT_MAX_TOKEN_BODY_BYTES: number;
 /**
  * Throws a `RangeError` naming `option` unless `maxBodyBytes` is a positive
  * safe integer.
@@ -27,3 +33,12 @@ export declare function assertMaxBodyBytes(maxBodyBytes: number, option: string)
 export declare function readBoundedBody(request: Request, maxBytes: number, options?: {
     keepReadable?: boolean;
 }): Promise<Uint8Array<ArrayBuffer> | null>;
+/**
+ * Reads at most `maxBytes` of `request`'s body from a clone and returns
+ * `null` once it exceeds `maxBytes`, cancelling only the clone. The original
+ * stays readable either way, holding no more than what the clone pulled, so
+ * the caller's own handling of the body — or of its absence — is unchanged.
+ * A `Content-Length` over the cap returns `null` without reading. Rejects if
+ * the body was already read.
+ */
+export declare function peekBoundedBody(request: Request, maxBytes: number): Promise<Uint8Array<ArrayBuffer> | null>;

package/dist/utils/_body.js

@@ -11,6 +11,12 @@
  * the 8–16 KiB header limits common to servers and proxies.
  */
 export const DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+/**
+ * The default cap on a form body searched for an RFC 6750 §2.2
+ * `access_token`: 16 KiB, Node's default limit on a request's whole header
+ * block, so any token a client could send as `Authorization: Bearer` fits.
+ */
+export const DEFAULT_MAX_TOKEN_BODY_BYTES = 16 * 1024;
 /**
  * Throws a `RangeError` naming `option` unless `maxBodyBytes` is a positive
  * safe integer.
@@ -41,6 +47,21 @@ export async function readBoundedBody(request, maxBytes, options = {}) {
         request.body.cancel().catch(() => { });
     return bytes;
 }
+/**
+ * Reads at most `maxBytes` of `request`'s body from a clone and returns
+ * `null` once it exceeds `maxBytes`, cancelling only the clone. The original
+ * stays readable either way, holding no more than what the clone pulled, so
+ * the caller's own handling of the body — or of its absence — is unchanged.
+ * A `Content-Length` over the cap returns `null` without reading. Rejects if
+ * the body was already read.
+ */
+export async function peekBoundedBody(request, maxBytes) {
+    if (!request.body)
+        return new Uint8Array();
+    if (Number(request.headers.get("content-length")) > maxBytes)
+        return null;
+    return await readUpTo(request.clone().body, maxBytes);
+}
 async function readUpTo(body, maxBytes) {
     const reader = body.getReader();
     const chunks = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.15.1",
+  "version": "0.15.2",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",