@udibo/oauth2 0.15.1 → 0.16.0

package/dist/adapters/hono/bff/auth-request-store.d.ts

@@ -96,7 +96,11 @@ export interface EncryptedCookieAuthRequestStorageOptions {
     /**
      * How many pending requests the cookie carries at once. A second sign-in
      * started in another tab would otherwise evict the first, so its callback
-     * would fail. Defaults to 3; the oldest is dropped beyond that.
+     * would fail. Defaults to 3; the oldest is dropped beyond that, and also
+     * whenever keeping it would push the sealed cookie past what every browser
+     * stores (about 4 KB), since a browser silently drops an oversized cookie
+     * and every pending sign-in in it with it. The sign-in being started is
+     * never the one dropped. Must be a positive integer.
      */
     maxPending?: number;
 }
@@ -146,6 +150,9 @@ export declare class EncryptedCookieAuthRequestStorage implements AuthRequestSto
      * carries a `__Host-`/`__Secure-` prefix the other cookie options contradict,
      * or when {@link AuthRequestCookieOptions.sameSite} is `"None"` without
      * {@link AuthRequestCookieOptions.secure}.
+     * @throws {RangeError} When
+     * {@link EncryptedCookieAuthRequestStorageOptions.maxPending} is not a
+     * positive integer.
      */
     constructor(options: EncryptedCookieAuthRequestStorageOptions);
     /** Returns the storage bound to `c`, for the duration of that request. */

package/dist/adapters/hono/bff/auth-request-store.js

@@ -32,6 +32,8 @@ import { resolveCookieName, resolvePrefixConstrainedAttributes, } from "./cookie
 const BASE_NAME = "oauth2_auth_request";
 const DEFAULT_TTL_MS = 10 * 60 * 1000;
 const DEFAULT_MAX_PENDING = 3;
+// RFC 6265 §6.1 only guarantees 4096 bytes per cookie, attributes included.
+const MAX_COOKIE_NAME_VALUE_BYTES = 3900;
 function cookieAttributes(options, maxAgeSeconds) {
     const { secure, path, domain } = resolvePrefixConstrainedAttributes(options);
     return {
@@ -81,6 +83,9 @@ export class EncryptedCookieAuthRequestStorage {
      * carries a `__Host-`/`__Secure-` prefix the other cookie options contradict,
      * or when {@link AuthRequestCookieOptions.sameSite} is `"None"` without
      * {@link AuthRequestCookieOptions.secure}.
+     * @throws {RangeError} When
+     * {@link EncryptedCookieAuthRequestStorageOptions.maxPending} is not a
+     * positive integer.
      */
     constructor(options) {
         this.#cookie = options.cookie;
@@ -94,6 +99,10 @@ export class EncryptedCookieAuthRequestStorage {
         });
         this.#ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
         this.#maxPending = options.maxPending ?? DEFAULT_MAX_PENDING;
+        if (!(Number.isInteger(this.#maxPending) && this.#maxPending > 0)) {
+            throw new RangeError("EncryptedCookieAuthRequestStorage maxPending must be a positive " +
+                `integer, got ${this.#maxPending}.`);
+        }
     }
     #key() {
         return (this.#keyPromise ??= deriveAesKey(this.#secret));
@@ -108,15 +117,23 @@ export class EncryptedCookieAuthRequestStorage {
         const cutoff = Date.now() - this.#ttlMs;
         return Object.fromEntries(Object.entries(pending).filter(([, record]) => record.createdAt > cutoff));
     }
-    async #write(c, pending) {
+    async #write(c, pending, keep) {
         const entries = Object.entries(pending)
-            .sort(([, a], [, b]) => b.createdAt - a.createdAt)
+            .sort(([stateA, a], [stateB, b]) => Number(stateB === keep) - Number(stateA === keep) ||
+            b.createdAt - a.createdAt)
             .slice(0, this.#maxPending);
         if (entries.length === 0) {
             this.#clear(c);
             return;
         }
-        setCookie(c, this.#name, await sealJson(await this.#key(), Object.fromEntries(entries)), cookieAttributes(this.#cookie, Math.ceil(this.#ttlMs / 1000)));
+        const key = await this.#key();
+        let sealed = await sealJson(key, Object.fromEntries(entries));
+        while (entries.length > 1 &&
+            this.#name.length + 1 + sealed.length > MAX_COOKIE_NAME_VALUE_BYTES) {
+            entries.pop();
+            sealed = await sealJson(key, Object.fromEntries(entries));
+        }
+        setCookie(c, this.#name, sealed, cookieAttributes(this.#cookie, Math.ceil(this.#ttlMs / 1000)));
     }
     #clear(c) {
         deleteCookie(c, this.#name, cookieAttributes(this.#cookie));
@@ -128,7 +145,7 @@ export class EncryptedCookieAuthRequestStorage {
             set: async (state, value) => {
                 const pending = await this.#read(c);
                 pending[state] = value;
-                await this.#write(c, pending);
+                await this.#write(c, pending, state);
             },
             delete: async (state) => {
                 const pending = await this.#read(c);

package/dist/adapters/hono/bff/bff.d.ts

@@ -162,6 +162,9 @@ export interface HonoBffCookieOptions {
  * header, so it is guarded instead by a same-origin check that reads
  * `Sec-Fetch-Site` (accepting only `same-origin` and `none`) and falls back to
  * comparing `Origin`, else `Referer`, for clients that send no fetch metadata.
+ * That comparison accepts the request's own origin and the application's
+ * (see {@link HonoBffOptions.rpInitiatedLogout}), so the fallback still passes
+ * behind a TLS-terminating proxy that hands the BFF a plain-HTTP request.
  * `same-site` is rejected along with `cross-site`, so a `GET` logout link
  * followed from a sibling subdomain does not pass. That check **fails closed**:
  * a request carrying none of the three signals is rejected. Two residuals come
@@ -425,10 +428,18 @@ export interface HonoBffOptions {
      * `/auth/logout` — after destroying the local session — additionally
      * redirects the browser to the OP's `end_session_endpoint` with
      * `id_token_hint` (the session's id_token, if any), `client_id`, and a
-     * `post_logout_redirect_uri` built from the resolved origin + the
+     * `post_logout_redirect_uri` built from the application's origin + the
      * open-redirect-guarded `return_to`. This ends the upstream IDP SSO session,
      * not just the local BFF session.
      *
+     * The application's origin is {@link resolveOrigin}'s, else the configured
+     * client `redirectUri`'s, else the request's — the last only when no
+     * `redirectUri` is configured or {@link deriveRedirectUri} is on, matching
+     * the origin sign-in sends. Behind a TLS-terminating proxy the request
+     * reports `http:`, so a deployment that derives its redirect URI there sets
+     * {@link resolveOrigin}; otherwise the URI would miss the registered
+     * `https:` one.
+     *
      * Defaults to `false` (local logout only): not every IDP supports it, and it
      * adds a redirect hop. When enabled but no end-session endpoint is known,
      * logout falls back to the plain local redirect and warns once via
@@ -558,6 +569,14 @@ export interface HonoBffOptions {
     forwardedParams?: readonly string[];
     /** Default `return_to` applied when the browser doesn't pass one. */
     defaultReturnTo?: string;
+    /**
+     * Longest `return_to` accepted, in characters. `/auth/login` stores the
+     * value with the pending sign-in before any authentication, so a longer one
+     * is replaced by {@link defaultReturnTo} rather than kept — at login,
+     * callback, logout and in {@link HonoBff.loginContinuation}. Defaults to
+     * 2048; `Infinity` accepts any length.
+     */
+    maxReturnToLength?: number;
     /**
      * Optional hook run after the authorization code is exchanged. Lets
      * apps enrich the session with database-backed user info before the
@@ -638,7 +657,9 @@ export declare class HonoBff {
      * {@linkcode HonoBffOptions.sessionMaxAgeMs}), when `sessionMaxAgeMs` or a
      * numeric `cookie.maxAge` is not positive or exceeds 400 days, when
      * {@linkcode HonoBffBackchannelOptions.maxBodyBytes} is not a positive
-     * integer (a `RangeError`), or when
+     * integer (a `RangeError`), when
+     * {@linkcode HonoBffOptions.maxReturnToLength} is neither a positive
+     * integer nor `Infinity` (a `RangeError`), or when
      * {@linkcode HonoBffOptions.extraParams} or
      * {@linkcode HonoBffOptions.forwardedParams} names a reserved authorize
      * parameter, gives one a name that is empty or not equal to its trimmed

package/dist/adapters/hono/bff/bff.js

@@ -56,7 +56,7 @@ import { inboundRequestWithHeaders } from "../../../utils/_inbound-request.js";
 import { timingSafeMatchIndex } from "../../../utils/_timing-safe.js";
 import { sha256Hash } from "../../../server/utils/hash.js";
 import { OAUTH2_CONTEXT_KEY } from "../_common.js";
-import { loginContinuation as computeLoginContinuation, safeReturnTo, } from "../../../utils/url.js";
+import { DEFAULT_MAX_RETURN_TO_LENGTH, loginContinuation as computeLoginContinuation, safeReturnTo, } from "../../../utils/url.js";
 import { resolveCookieName, resolvePrefixConstrainedAttributes, } from "./cookie-prefix.js";
 import { DEFAULT_SESSION_MAX_AGE_MS, MemorySessionStore, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.js";
 import { buildDownstreamHeaders, buildUpstreamHeaders, isInvalidTokenChallenge, resolveForwardHeaders, resolveProxyUrl, } from "./proxy.js";
@@ -289,6 +289,7 @@ export class HonoBff {
     #sessionMode;
     #csrf;
     #extraAuthorizeParams;
+    #maxReturnToLength;
     #refreshes = new Map();
     /**
      * Defaults are applied for the session store ({@linkcode MemorySessionStore}),
@@ -307,7 +308,9 @@ export class HonoBff {
      * {@linkcode HonoBffOptions.sessionMaxAgeMs}), when `sessionMaxAgeMs` or a
      * numeric `cookie.maxAge` is not positive or exceeds 400 days, when
      * {@linkcode HonoBffBackchannelOptions.maxBodyBytes} is not a positive
-     * integer (a `RangeError`), or when
+     * integer (a `RangeError`), when
+     * {@linkcode HonoBffOptions.maxReturnToLength} is neither a positive
+     * integer nor `Infinity` (a `RangeError`), or when
      * {@linkcode HonoBffOptions.extraParams} or
      * {@linkcode HonoBffOptions.forwardedParams} names a reserved authorize
      * parameter, gives one a name that is empty or not equal to its trimmed
@@ -330,6 +333,13 @@ export class HonoBff {
         this.#sessionMode = options.sessionMode ?? "own";
         this.#csrf = resolveCsrf(options.csrf);
         this.#extraAuthorizeParams = resolveExtraAuthorizeParams(options);
+        this.#maxReturnToLength =
+            options.maxReturnToLength ?? DEFAULT_MAX_RETURN_TO_LENGTH;
+        if (this.#maxReturnToLength !== Infinity &&
+            !(Number.isInteger(this.#maxReturnToLength) && this.#maxReturnToLength > 0)) {
+            throw new RangeError("HonoBff maxReturnToLength must be a positive integer or Infinity, " +
+                `got ${this.#maxReturnToLength}.`);
+        }
         const sessionMaxAgeMs = positiveMs(options.sessionMaxAgeMs ?? DEFAULT_SESSION_MAX_AGE_MS, "sessionMaxAgeMs");
         this.#sessionMaxAgeMs = sessionMaxAgeMs;
         if (this.#sessionMode === "shared") {
@@ -454,6 +464,20 @@ export class HonoBff {
         }
         setCookie(c, this.#loginStateCookieName, hashes.slice(-MAX_PENDING_LOGIN_STATES).join(LOGIN_STATE_SEPARATOR), loginStateCookieOpts(this.#options.cookie, Math.ceil(this.#loginStateTtlMs / 1000)));
     }
+    #safeReturnTo(value) {
+        return safeReturnTo(value, this.#options.defaultReturnTo ?? "/", {
+            maxLength: this.#maxReturnToLength,
+        });
+    }
+    #appOrigin(c) {
+        const resolved = this.#options.resolveOrigin?.(c);
+        if (resolved !== undefined)
+            return resolved;
+        const configured = this.#options.deriveRedirectUri
+            ? undefined
+            : this.#client.redirectUri;
+        return new URL(configured ?? c.req.url).origin;
+    }
     #derivedRedirectUri(c, origin) {
         if (!this.#options.deriveRedirectUri)
             return undefined;
@@ -473,12 +497,12 @@ export class HonoBff {
         const fetchSite = c.req.header("sec-fetch-site");
         if (fetchSite)
             return fetchSite === "same-origin" || fetchSite === "none";
-        const target = new URL(c.req.url).origin;
+        const targets = [new URL(c.req.url).origin, this.#appOrigin(c)];
         const check = (val) => {
             if (!val)
                 return undefined;
             try {
-                return new URL(val).origin === target;
+                return targets.includes(new URL(val).origin);
             }
             catch {
                 return false;
@@ -555,6 +579,7 @@ export class HonoBff {
             authorizeEndpoint: this.#client.authorizationEndpoint,
             loginPath: this.#paths.login,
             defaultReturnTo: this.#options.defaultReturnTo,
+            maxReturnToLength: this.#maxReturnToLength,
         });
     }
     #pathsRelative() {
@@ -583,7 +608,7 @@ export class HonoBff {
     loginHandler() {
         return async (c) => {
             this.#noStore(c);
-            const returnTo = safeReturnTo(c.req.query("return_to"), this.#options.defaultReturnTo ?? "/");
+            const returnTo = this.#safeReturnTo(c.req.query("return_to"));
             const origin = this.#options.resolveOrigin?.(c);
             const requested = authorizeParamsForRequest(this.#extraAuthorizeParams, new URL(c.req.url).searchParams);
             const { url, state } = await this.#client.login({
@@ -683,7 +708,7 @@ export class HonoBff {
                 if (cookieValue !== existing) {
                     setCookie(c, this.#cookieName, cookieValue, this.#cookieOptions());
                 }
-                return c.redirect(safeReturnTo(returnTo, this.#options.defaultReturnTo ?? "/"));
+                return c.redirect(this.#safeReturnTo(returnTo));
             }
             catch (cause) {
                 return await fail({
@@ -723,11 +748,11 @@ export class HonoBff {
                 await this.#store.destroy(cookieValue);
                 deleteCookie(c, this.#cookieName, this.#cookieOptions());
             }
-            const returnTo = safeReturnTo(c.req.query("return_to"), this.#options.defaultReturnTo ?? "/");
+            const returnTo = this.#safeReturnTo(c.req.query("return_to"));
             if (this.#options.rpInitiatedLogout) {
                 const endSession = this.#client.endSessionEndpoint;
                 if (endSession) {
-                    const origin = this.#options.resolveOrigin?.(c) ?? new URL(c.req.url).origin;
+                    const origin = this.#appOrigin(c);
                     const url = new URL(endSession, origin);
                     if (idToken)
                         url.searchParams.set("id_token_hint", idToken);

package/dist/adapters/hono/identity.d.ts

@@ -88,6 +88,23 @@ export interface HonoIdentityOptions<User extends IdentityUser> {
      * outer middleware already terminates CSRF.
      */
     csrf?: HonoIdentityCsrfOptions | false;
+    /**
+     * The most bytes a route reads from a request body. Every route reads its
+     * body before anyone is authenticated, so the cap bounds what an anonymous
+     * request can make the server buffer. Bytes are counted as they arrive, so a
+     * chunked body or an understated `Content-Length` cannot get past it. A
+     * larger body is refused with `413` `{ error: "invalid_request" }` before
+     * the service is called.
+     *
+     * When a middleware mounted before these routes has already read the body
+     * (for example with `c.req.parseBody()`), the routes read Hono's parsed copy
+     * and the cap does not apply, so that middleware needs its own limit.
+     *
+     * @default 65536
+     * @throws {RangeError} From {@linkcode honoIdentityRoutes} when it is not a
+     *   positive integer.
+     */
+    maxBodyBytes?: number;
     /**
      * Called after `signup`/`signin` authenticates a user. Your app owns what
      * happens next — create your session and return a `Response` (e.g. a redirect
@@ -112,7 +129,12 @@ export interface HonoIdentityOptions<User extends IdentityUser> {
  * Every mounted route sits behind the same-origin guard described in
  * {@link HonoIdentityOptions.csrf}, which is on unless you pass `csrf: false`.
  *
+ * Every route reads at most {@link HonoIdentityOptions.maxBodyBytes} of its
+ * body and answers a larger one with `413`.
+ *
  * Passwordless, MFA, and social are intentionally not mounted — see the module
  * doc for why and where to hand-wire each.
+ *
+ * @throws {RangeError} If `maxBodyBytes` is not a positive integer.
  */
 export declare function honoIdentityRoutes<User extends IdentityUser>(service: IdentityService<User>, options?: HonoIdentityOptions<User>): Hono;

package/dist/adapters/hono/identity.js

@@ -41,12 +41,16 @@
  */
 import { Hono } from "hono";
 import { identityErrorStatus, isIdentityError, } from "../../identity/errors.js";
+import { assertMaxBodyBytes, DEFAULT_MAX_BODY_BYTES, readBoundedBody, } from "../../utils/_body.js";
 function handle(fn) {
     return async (c) => {
         try {
             return await fn(c);
         }
         catch (error) {
+            if (error instanceof BodyTooLargeError) {
+                return c.json({ error: "invalid_request" }, 413);
+            }
             if (!isIdentityError(error))
                 throw error;
             if (error.retryAfterMs !== undefined) {
@@ -57,11 +61,24 @@ function handle(fn) {
     };
 }
 const STRING_FIELDS = new Set(["password", "identifier", "email", "token"]);
-async function readBody(c) {
+class BodyTooLargeError extends Error {
+}
+async function boundedBody(c, maxBytes) {
+    if (c.req.raw.bodyUsed)
+        return c.req;
+    const bytes = await readBoundedBody(c.req.raw, maxBytes).catch(() => new Uint8Array());
+    if (!bytes)
+        throw new BodyTooLargeError();
+    return new Response(bytes, {
+        headers: { "content-type": c.req.header("content-type") ?? "" },
+    });
+}
+async function readBody(c, maxBytes) {
     const contentType = c.req.header("content-type") ?? "";
+    const source = await boundedBody(c, maxBytes);
     if (contentType.includes("application/json")) {
         try {
-            const body = await c.req.json();
+            const body = await source.json();
             if (typeof body !== "object" || body === null || Array.isArray(body)) {
                 return {};
             }
@@ -79,7 +96,7 @@ async function readBody(c) {
         }
     }
     try {
-        const form = await c.req.formData();
+        const form = await source.formData();
         const out = {};
         for (const [key, value] of form)
             out[key] = String(value);
@@ -135,10 +152,17 @@ function sameOriginGuard(options) {
  * Every mounted route sits behind the same-origin guard described in
  * {@link HonoIdentityOptions.csrf}, which is on unless you pass `csrf: false`.
  *
+ * Every route reads at most {@link HonoIdentityOptions.maxBodyBytes} of its
+ * body and answers a larger one with `413`.
+ *
  * Passwordless, MFA, and social are intentionally not mounted — see the module
  * doc for why and where to hand-wire each.
+ *
+ * @throws {RangeError} If `maxBodyBytes` is not a positive integer.
  */
 export function honoIdentityRoutes(service, options = {}) {
+    const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    assertMaxBodyBytes(maxBodyBytes, "maxBodyBytes");
     const app = new Hono();
     const paths = {
         signUp: "/signup",
@@ -154,7 +178,7 @@ export function honoIdentityRoutes(service, options = {}) {
     }
     if (onAuthenticated) {
         app.post(paths.signUp, handle(async (c) => {
-            const { password, ...profile } = await readBody(c);
+            const { password, ...profile } = await readBody(c, maxBodyBytes);
             if (typeof password !== "string" || !password) {
                 return c.json({ error: "invalid_request" }, 400);
             }
@@ -162,7 +186,7 @@ export function honoIdentityRoutes(service, options = {}) {
             return await onAuthenticated(c, user, "signUp");
         }));
         app.post(paths.signIn, handle(async (c) => {
-            const body = await readBody(c);
+            const body = await readBody(c, maxBodyBytes);
             const user = await service.signIn({
                 identifier: String(body.identifier ?? ""),
                 password: String(body.password ?? ""),
@@ -173,12 +197,12 @@ export function honoIdentityRoutes(service, options = {}) {
         }));
     }
     app.post(paths.requestPasswordReset, handle(async (c) => {
-        const body = await readBody(c);
+        const body = await readBody(c, maxBodyBytes);
         await service.requestPasswordReset(String(body.email ?? ""));
         return c.json({ ok: true });
     }));
     app.post(paths.resetPassword, handle(async (c) => {
-        const body = await readBody(c);
+        const body = await readBody(c, maxBodyBytes);
         const result = await service.resetPassword({
             token: String(body.token ?? ""),
             password: String(body.password ?? ""),
@@ -188,7 +212,7 @@ export function honoIdentityRoutes(service, options = {}) {
             : c.json({ error: "invalid_token" }, 400);
     }));
     app.post(paths.verifyEmail, handle(async (c) => {
-        const body = await readBody(c);
+        const body = await readBody(c, maxBodyBytes);
         const result = await service.verifyEmail(String(body.token ?? ""));
         if (result.status === "success") {
             return c.json({ ok: true, userId: result.userId });

package/dist/client/direct-client.d.ts

@@ -342,6 +342,15 @@ export declare class DirectClient extends OAuth2ClientBase {
      * available. It is a public identifier, never a credential.
      */
     get clientId(): string;
+    /**
+     * The configured `redirect_uri`, or `undefined` when none was given.
+     *
+     * Exposed so a Backend-for-Frontend behind a TLS-terminating proxy can
+     * take the application's public origin from configuration rather than from
+     * a request URL that reports the proxy's plain-HTTP hop. See
+     * `HonoBffOptions.rpInitiatedLogout`.
+     */
+    get redirectUri(): string | undefined;
     /**
      * Builds the PKCE-protected authorize URL and persists the verifier under
      * the returned `state`. Navigate the browser to `url`; the callback route

package/dist/client/direct-client.js

@@ -280,6 +280,17 @@ export class DirectClient extends OAuth2ClientBase {
     get clientId() {
         return this.#clientId;
     }
+    /**
+     * The configured `redirect_uri`, or `undefined` when none was given.
+     *
+     * Exposed so a Backend-for-Frontend behind a TLS-terminating proxy can
+     * take the application's public origin from configuration rather than from
+     * a request URL that reports the proxy's plain-HTTP hop. See
+     * `HonoBffOptions.rpInitiatedLogout`.
+     */
+    get redirectUri() {
+        return this.#redirectUri;
+    }
     async #endpoint(key) {
         if (this.#issuer && !this.#hasFreshMetadata())
             await this.discover();

package/dist/client/storage.d.ts

@@ -135,17 +135,35 @@ export interface MemoryAuthRequestStorageOptions {
      * in ms. Defaults to 10 minutes; `Infinity` never prunes.
      */
     ttlMs?: number;
+    /**
+     * Most records held at once. A write beyond it evicts the oldest-written
+     * record, so a flood of sign-in starts that never reach the callback cannot
+     * grow the process without bound — at the cost of failing each evicted
+     * sign-in with an unknown `state`. Defaults to 1000; `Infinity` never
+     * evicts by count.
+     */
+    maxEntries?: number;
 }
 /**
  * In-memory {@link AuthRequestStorage}, `DirectClient`'s default outside a
  * browser document. Data is lost when the process exits. Every write prunes
- * records older than {@link MemoryAuthRequestStorageOptions.ttlMs}, so logins
- * that never return to the callback do not accumulate in a long-running
- * server.
+ * records older than {@link MemoryAuthRequestStorageOptions.ttlMs}, then
+ * evicts the oldest-written records beyond
+ * {@link MemoryAuthRequestStorageOptions.maxEntries}, so neither logins that
+ * never return to the callback nor an anonymous burst of sign-in starts can
+ * grow a long-running server without bound. A deployment with more than one
+ * instance, or more pending sign-ins than the cap, needs storage every
+ * instance shares instead.
  */
 export declare class MemoryAuthRequestStorage implements AuthRequestStorage {
     #private;
-    /** Configures the pruning TTL, 10 minutes by default. */
+    /**
+     * Configures the pruning TTL (10 minutes by default) and the record cap
+     * (1000 by default).
+     *
+     * @throws {RangeError} When `maxEntries` is neither a positive integer nor
+     * `Infinity`.
+     */
     constructor(options?: MemoryAuthRequestStorageOptions);
     /** Returns the record for {@linkcode state}, or `null` if none is stored. */
     get(state: string): AuthRequestRecord | null;
@@ -153,7 +171,8 @@ export declare class MemoryAuthRequestStorage implements AuthRequestStorage {
     take(state: string): AuthRequestRecord | null;
     /**
      * Stores {@linkcode value} under {@linkcode state}, first pruning records
-     * past the TTL. Pruning walks records oldest-write-first and stops at the
+     * past the TTL, then evicting the oldest-written records beyond
+     * `maxEntries`. Pruning walks records oldest-write-first and stops at the
      * first one inside the TTL, so it assumes each `createdAt` is the time of
      * its write, as `DirectClient.login` sets it.
      */

package/dist/client/storage.js

@@ -53,19 +53,37 @@ export class MemoryRefreshTokenStorage {
         this.#token = null;
     }
 }
+const DEFAULT_MAX_AUTH_REQUESTS = 1000;
 /**
  * In-memory {@link AuthRequestStorage}, `DirectClient`'s default outside a
  * browser document. Data is lost when the process exits. Every write prunes
- * records older than {@link MemoryAuthRequestStorageOptions.ttlMs}, so logins
- * that never return to the callback do not accumulate in a long-running
- * server.
+ * records older than {@link MemoryAuthRequestStorageOptions.ttlMs}, then
+ * evicts the oldest-written records beyond
+ * {@link MemoryAuthRequestStorageOptions.maxEntries}, so neither logins that
+ * never return to the callback nor an anonymous burst of sign-in starts can
+ * grow a long-running server without bound. A deployment with more than one
+ * instance, or more pending sign-ins than the cap, needs storage every
+ * instance shares instead.
  */
 export class MemoryAuthRequestStorage {
     #records = new Map();
     #ttlMs;
-    /** Configures the pruning TTL, 10 minutes by default. */
+    #maxEntries;
+    /**
+     * Configures the pruning TTL (10 minutes by default) and the record cap
+     * (1000 by default).
+     *
+     * @throws {RangeError} When `maxEntries` is neither a positive integer nor
+     * `Infinity`.
+     */
     constructor(options = {}) {
         this.#ttlMs = options.ttlMs ?? 10 * 60 * 1000;
+        this.#maxEntries = options.maxEntries ?? DEFAULT_MAX_AUTH_REQUESTS;
+        if (this.#maxEntries !== Infinity &&
+            !(Number.isInteger(this.#maxEntries) && this.#maxEntries > 0)) {
+            throw new RangeError("MemoryAuthRequestStorage maxEntries must be a positive integer or " +
+                `Infinity, got ${this.#maxEntries}.`);
+        }
     }
     /** Returns the record for {@linkcode state}, or `null` if none is stored. */
     get(state) {
@@ -79,7 +97,8 @@ export class MemoryAuthRequestStorage {
     }
     /**
      * Stores {@linkcode value} under {@linkcode state}, first pruning records
-     * past the TTL. Pruning walks records oldest-write-first and stops at the
+     * past the TTL, then evicting the oldest-written records beyond
+     * `maxEntries`. Pruning walks records oldest-write-first and stops at the
      * first one inside the TTL, so it assumes each `createdAt` is the time of
      * its write, as `DirectClient.login` sets it.
      */
@@ -87,6 +106,7 @@ export class MemoryAuthRequestStorage {
         this.#pruneExpired();
         this.#records.delete(state);
         this.#records.set(state, value);
+        this.#evictOverflow();
     }
     /** Removes the record for {@linkcode state}. */
     delete(state) {
@@ -96,6 +116,13 @@ export class MemoryAuthRequestStorage {
     clear() {
         this.#records.clear();
     }
+    #evictOverflow() {
+        for (const state of this.#records.keys()) {
+            if (this.#records.size <= this.#maxEntries)
+                return;
+            this.#records.delete(state);
+        }
+    }
     #pruneExpired() {
         if (this.#ttlMs === Infinity)
             return;

package/dist/server/authorization-server.d.ts

@@ -444,7 +444,8 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      *
      * @throws {Error} If any grant's map key does not equal its `grantType`.
      * @throws {Error} If `requireOidc` is set without `signingKeys`.
-     * @throws {RangeError} If `maxBodyBytes` is not a positive integer.
+     * @throws {RangeError} If `maxBodyBytes` or `maxTokenBodyBytes` is not a
+     *   positive integer.
      */
     constructor(options: AuthorizationServerOptions<Client, User, S>);
     /**

package/dist/server/authorization-server.js

@@ -197,7 +197,8 @@ export class AuthorizationServer extends ResourceServer {
      *
      * @throws {Error} If any grant's map key does not equal its `grantType`.
      * @throws {Error} If `requireOidc` is set without `signingKeys`.
-     * @throws {RangeError} If `maxBodyBytes` is not a positive integer.
+     * @throws {RangeError} If `maxBodyBytes` or `maxTokenBodyBytes` is not a
+     *   positive integer.
      */
     constructor(options) {
         super({
@@ -205,6 +206,7 @@ export class AuthorizationServer extends ResourceServer {
             Scope: options.Scope,
             realm: options.realm,
             clockSkewSeconds: options.clockSkewSeconds,
+            maxTokenBodyBytes: options.maxTokenBodyBytes,
             errorFormat: options.errorFormat,
             throwOnError: options.throwOnError,
         });

package/dist/server/resource-server.d.ts

@@ -55,6 +55,27 @@ export interface ResourceServerOptions<Client extends ClientInterface, User, S e
      * matter which reader is in play.
      */
     clockSkewSeconds?: number;
+    /**
+     * The most bytes {@linkcode ResourceServer.getAccessToken} reads from a
+     * form-encoded `POST` body while looking for an RFC 6750 §2.2
+     * `access_token`, which it does only when no bearer `Authorization` header
+     * is sent. That read happens before the caller is authenticated, so the cap
+     * bounds what an anonymous request can make the server buffer, including
+     * through `protect()` middleware mounted ahead of a route's own body limit.
+     * Bytes are counted as they arrive, so a chunked body or an understated
+     * `Content-Length` cannot get past it.
+     *
+     * A larger body is not searched: the request is treated as carrying no
+     * token (`authenticate` throws {@linkcode AccessDeniedError}, a `401`), and
+     * the body is left for the route. A client that sends a bigger form body
+     * should send its token in the `Authorization` header instead, as RFC 6750
+     * §2.1 recommends.
+     *
+     * @default 16384
+     * @throws {RangeError} From the constructor when it is not a positive
+     *   integer.
+     */
+    maxTokenBodyBytes?: number;
     /**
      * Format for error responses.
      * - `"oauth2"` (default): Standard OAuth2 error format with `error`,
@@ -162,7 +183,8 @@ export declare class ResourceServer<Client extends ClientInterface, User, S exte
      * Creates a resource server from the given {@linkcode ResourceServerOptions}.
      *
      * @throws {RangeError} If `clockSkewSeconds` is negative, non-finite, or
-     *   overflows when converted to milliseconds.
+     *   overflows when converted to milliseconds, or if `maxTokenBodyBytes` is
+     *   not a positive integer.
      */
     constructor(options: ResourceServerOptions<Client, User, S>);
     /**
@@ -239,8 +261,11 @@ export declare class ResourceServer<Client extends ClientInterface, User, S exte
     handleAuthError(error: unknown): Response;
     /**
      * Extracts an access token from a request.
-     * Looks in the Authorization header (Bearer token) first,
-     * then in the request body for form-encoded requests.
+     * Looks in the Authorization header (Bearer token) first, then in the body
+     * of a form-encoded `POST` (RFC 6750 §2.2), read from a clone so the
+     * original body stays readable. A body over
+     * {@linkcode ResourceServerOptions.maxTokenBodyBytes} is not searched, and
+     * no more of it is read than the cap.
      */
     getAccessToken(request: Request): Promise<string | null>;
     /**

package/dist/server/resource-server.js

@@ -10,6 +10,7 @@ import { BasicScope } from "../models/scope.js";
 import { AccessDeniedError, InsufficientPermissionsError, InsufficientScopeError, InvalidTokenError, toOAuth2Error, } from "../errors.js";
 import { authorizationFromClaims, } from "../models/authorization.js";
 import { assertClockSkewSeconds } from "./_clock-skew.js";
+import { assertMaxBodyBytes, DEFAULT_MAX_TOKEN_BODY_BYTES, peekBoundedBody, } from "../utils/_body.js";
 /** Bearer token regex pattern. */
 export const BEARER_TOKEN = /^ *(?:[Bb][Ee][Aa][Rr][Ee][Rr]) +([\w-.~+/]+=*) *$/;
 const FAILURE_LABELS = {
@@ -80,6 +81,7 @@ export class ResourceServer {
     /** Resolves the per-request {@link ResourceServerContext}. */
     resolveContext;
     #clockSkewSeconds = 0;
+    #maxTokenBodyBytes;
     /**
      * Leeway in seconds applied to the access token's expiry. Defaults to `0`.
      * May be reassigned to any non-negative finite number with a finite
@@ -102,13 +104,17 @@ export class ResourceServer {
      * Creates a resource server from the given {@linkcode ResourceServerOptions}.
      *
      * @throws {RangeError} If `clockSkewSeconds` is negative, non-finite, or
-     *   overflows when converted to milliseconds.
+     *   overflows when converted to milliseconds, or if `maxTokenBodyBytes` is
+     *   not a positive integer.
      */
     constructor(options) {
         this.Scope =
             options.Scope ?? BasicScope;
         this.realm = options.realm ?? "Service";
         this.clockSkewSeconds = options.clockSkewSeconds ?? 0;
+        this.#maxTokenBodyBytes =
+            options.maxTokenBodyBytes ?? DEFAULT_MAX_TOKEN_BODY_BYTES;
+        assertMaxBodyBytes(this.#maxTokenBodyBytes, "maxTokenBodyBytes");
         this.errorFormat = options.errorFormat ?? "oauth2";
         this.throwOnError = options.throwOnError ?? false;
         this.resolveContext = options.resolve;
@@ -252,8 +258,11 @@ export class ResourceServer {
     }
     /**
      * Extracts an access token from a request.
-     * Looks in the Authorization header (Bearer token) first,
-     * then in the request body for form-encoded requests.
+     * Looks in the Authorization header (Bearer token) first, then in the body
+     * of a form-encoded `POST` (RFC 6750 §2.2), read from a clone so the
+     * original body stays readable. A body over
+     * {@linkcode ResourceServerOptions.maxTokenBodyBytes} is not searched, and
+     * no more of it is read than the cap.
      */
     async getAccessToken(request) {
         const authorization = request.headers.get("authorization");
@@ -266,13 +275,18 @@ export class ResourceServer {
         if (request.method === "POST" &&
             contentType?.includes("application/x-www-form-urlencoded")) {
             try {
-                const body = await request.clone().formData();
+                const bytes = await peekBoundedBody(request, this.#maxTokenBodyBytes);
+                if (!bytes)
+                    return null;
+                const body = await new Response(bytes, {
+                    headers: { "content-type": contentType },
+                }).formData();
                 const accessToken = body.get("access_token");
                 if (typeof accessToken === "string")
                     return accessToken;
             }
             catch {
-                // ignore
+                return null;
             }
         }
         return null;

package/dist/utils/_body.d.ts

@@ -11,6 +11,12 @@
  * the 8–16 KiB header limits common to servers and proxies.
  */
 export declare const DEFAULT_MAX_BODY_BYTES: number;
+/**
+ * The default cap on a form body searched for an RFC 6750 §2.2
+ * `access_token`: 16 KiB, Node's default limit on a request's whole header
+ * block, so any token a client could send as `Authorization: Bearer` fits.
+ */
+export declare const DEFAULT_MAX_TOKEN_BODY_BYTES: number;
 /**
  * Throws a `RangeError` naming `option` unless `maxBodyBytes` is a positive
  * safe integer.
@@ -27,3 +33,12 @@ export declare function assertMaxBodyBytes(maxBodyBytes: number, option: string)
 export declare function readBoundedBody(request: Request, maxBytes: number, options?: {
     keepReadable?: boolean;
 }): Promise<Uint8Array<ArrayBuffer> | null>;
+/**
+ * Reads at most `maxBytes` of `request`'s body from a clone and returns
+ * `null` once it exceeds `maxBytes`, cancelling only the clone. The original
+ * stays readable either way, holding no more than what the clone pulled, so
+ * the caller's own handling of the body — or of its absence — is unchanged.
+ * A `Content-Length` over the cap returns `null` without reading. Rejects if
+ * the body was already read.
+ */
+export declare function peekBoundedBody(request: Request, maxBytes: number): Promise<Uint8Array<ArrayBuffer> | null>;

package/dist/utils/_body.js

@@ -11,6 +11,12 @@
  * the 8–16 KiB header limits common to servers and proxies.
  */
 export const DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+/**
+ * The default cap on a form body searched for an RFC 6750 §2.2
+ * `access_token`: 16 KiB, Node's default limit on a request's whole header
+ * block, so any token a client could send as `Authorization: Bearer` fits.
+ */
+export const DEFAULT_MAX_TOKEN_BODY_BYTES = 16 * 1024;
 /**
  * Throws a `RangeError` naming `option` unless `maxBodyBytes` is a positive
  * safe integer.
@@ -41,6 +47,21 @@ export async function readBoundedBody(request, maxBytes, options = {}) {
         request.body.cancel().catch(() => { });
     return bytes;
 }
+/**
+ * Reads at most `maxBytes` of `request`'s body from a clone and returns
+ * `null` once it exceeds `maxBytes`, cancelling only the clone. The original
+ * stays readable either way, holding no more than what the clone pulled, so
+ * the caller's own handling of the body — or of its absence — is unchanged.
+ * A `Content-Length` over the cap returns `null` without reading. Rejects if
+ * the body was already read.
+ */
+export async function peekBoundedBody(request, maxBytes) {
+    if (!request.body)
+        return new Uint8Array();
+    if (Number(request.headers.get("content-length")) > maxBytes)
+        return null;
+    return await readUpTo(request.clone().body, maxBytes);
+}
 async function readUpTo(body, maxBytes) {
     const reader = body.getReader();
     const chunks = [];

package/dist/utils/url.d.ts

@@ -3,6 +3,17 @@
  *
  * @module
  */
+/** {@link SafeReturnToOptions.maxLength}'s default, in UTF-16 code units. */
+export declare const DEFAULT_MAX_RETURN_TO_LENGTH = 2048;
+/** Options for {@link safeReturnTo}. */
+export interface SafeReturnToOptions {
+    /**
+     * Longest value accepted, in UTF-16 code units (`String.length`), not
+     * bytes; a longer one collapses to the fallback. Defaults to {@link DEFAULT_MAX_RETURN_TO_LENGTH} (2048).
+     * `Infinity` accepts any length.
+     */
+    maxLength?: number;
+}
 /**
  * Open-redirect guard for a `return_to` / redirect target.
  *
@@ -19,6 +30,11 @@
  * Percent-encoded control characters (`/%09/x`) are safe and pass through: a
  * browser does not decode them before parsing, so they stay on the origin.
  *
+ * A value longer than {@link SafeReturnToOptions.maxLength} (2048 characters
+ * by default) also collapses to `fallback`, so a caller that stores the
+ * result — a pending sign-in, a session — cannot be made to hold an
+ * arbitrarily large string per anonymous request.
+ *
  * Use this anywhere a user-influenced value — a `return_to` / `redirect` query
  * param or form field — is fed into a redirect `Location`, so a crafted
  * absolute target can't turn the (often post-authentication) redirect into an
@@ -32,9 +48,10 @@
  * safeReturnTo("/\\evil.com");       // → "/"
  * safeReturnTo("/\t/evil.com");      // → "/"
  * safeReturnTo(undefined, "/home");  // → "/home"
+ * safeReturnTo("/a-long-path", "/", { maxLength: 8 }); // → "/"
  * ```
  */
-export declare function safeReturnTo(value: string | null | undefined, fallback?: string): string;
+export declare function safeReturnTo(value: string | null | undefined, fallback?: string, options?: SafeReturnToOptions): string;
 /** Trusted application configuration for {@link loginContinuation}. */
 export interface LoginContinuationOptions {
     /**
@@ -47,6 +64,11 @@ export interface LoginContinuationOptions {
     loginPath?: string;
     /** Trusted fallback for missing/unsafe `returnTo`. Defaults to `"/"`. */
     defaultReturnTo?: string;
+    /**
+     * Longest `returnTo` accepted, in characters; a longer one falls back to
+     * {@link defaultReturnTo}. Defaults to 2048 ({@link safeReturnTo}'s cap).
+     */
+    maxReturnToLength?: number;
 }
 /**
  * The URL that (re)starts sign-in toward `returnTo`, for an app that owns its

package/dist/utils/url.js

@@ -4,6 +4,8 @@
  * @module
  */
 const RESOLUTION_ORIGIN = "http://safe-return-to.invalid";
+/** {@link SafeReturnToOptions.maxLength}'s default, in UTF-16 code units. */
+export const DEFAULT_MAX_RETURN_TO_LENGTH = 2048;
 function hasControlCharacter(value) {
     for (let index = 0; index < value.length; index++) {
         const code = value.charCodeAt(index);
@@ -28,6 +30,11 @@ function hasControlCharacter(value) {
  * Percent-encoded control characters (`/%09/x`) are safe and pass through: a
  * browser does not decode them before parsing, so they stay on the origin.
  *
+ * A value longer than {@link SafeReturnToOptions.maxLength} (2048 characters
+ * by default) also collapses to `fallback`, so a caller that stores the
+ * result — a pending sign-in, a session — cannot be made to hold an
+ * arbitrarily large string per anonymous request.
+ *
  * Use this anywhere a user-influenced value — a `return_to` / `redirect` query
  * param or form field — is fed into a redirect `Location`, so a crafted
  * absolute target can't turn the (often post-authentication) redirect into an
@@ -41,11 +48,15 @@ function hasControlCharacter(value) {
  * safeReturnTo("/\\evil.com");       // → "/"
  * safeReturnTo("/\t/evil.com");      // → "/"
  * safeReturnTo(undefined, "/home");  // → "/home"
+ * safeReturnTo("/a-long-path", "/", { maxLength: 8 }); // → "/"
  * ```
  */
-export function safeReturnTo(value, fallback = "/") {
+export function safeReturnTo(value, fallback = "/", options = {}) {
     if (!value || !value.startsWith("/"))
         return fallback;
+    if (value.length > (options.maxLength ?? DEFAULT_MAX_RETURN_TO_LENGTH)) {
+        return fallback;
+    }
     if (hasControlCharacter(value))
         return fallback;
     let resolved;
@@ -79,7 +90,9 @@ export function safeReturnTo(value, fallback = "/") {
  * endpoint and login path are trusted application configuration.
  */
 export function loginContinuation(returnTo, options = {}) {
-    const safe = safeReturnTo(returnTo, options.defaultReturnTo ?? "/");
+    const safe = safeReturnTo(returnTo, options.defaultReturnTo ?? "/", {
+        maxLength: options.maxReturnToLength,
+    });
     if (options.authorizeEndpoint) {
         const base = "http://login.continuation.local";
         const authorizePath = new URL(options.authorizeEndpoint, base).pathname;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",