@udibo/oauth2 0.15.2 → 0.17.0

package/dist/adapters/hono/bff/auth-request-store.d.ts

@@ -1,13 +1,14 @@
 /**
- * Stateless {@link AuthRequestStorage} for {@link HonoBff}.
+ * {@link AuthRequestStorageFactory} implementations for {@link HonoBff}.
  *
  * The pending authorization request — the `state`, its PKCE code verifier, and
  * where to return afterwards — has to survive the round trip to the identity
- * provider. The client's default {@link MemoryAuthRequestStorage} keeps it in
- * the process that started the flow, which breaks on any platform that spreads
- * requests across isolates or instances: `/auth/login` stores the record on one
- * and `/auth/callback` looks for it on another, so sign-in fails intermittently
- * with `unknown state parameter`.
+ * provider. {@link MemoryAuthRequestStorageFactory} keeps it in the process
+ * that started the flow, which breaks on any platform that spreads requests
+ * across isolates or instances: `/auth/login` stores the record on one and
+ * `/auth/callback` looks for it on another, so sign-in fails intermittently
+ * with `unknown state parameter`. `HonoBff` therefore has no default; the
+ * caller chooses.
  *
  * {@link EncryptedCookieAuthRequestStorage} carries the record in an encrypted
  * cookie instead (AES-GCM under a server-held secret, the same construction
@@ -18,7 +19,7 @@
  * **Which storage you pick is a reliability decision, not a security one.**
  * Server-side storage on its own says a `state` is pending somewhere — never
  * that *this* browser is the one that started it, so a process-wide store like
- * the memory default would otherwise let anyone's browser complete anyone
+ * {@link MemoryAuthRequestStorageFactory} would otherwise let anyone's browser complete anyone
  * else's pending sign-in (login CSRF). {@link HonoBff} closes that separately
  * and unconditionally: `/auth/login` also binds the `state` to the browser in
  * a short-lived cookie that `/auth/callback` requires, whichever storage is
@@ -27,7 +28,7 @@
  * @module
  */
 import type { Context } from "hono";
-import type { AuthRequestStorage } from "../../../client/mod.ts";
+import { type AuthRequestStorage, type MemoryAuthRequestStorageOptions } from "../../../client/mod.ts";
 /**
  * Cookie attributes for the pending-authorization cookie.
  *
@@ -96,7 +97,11 @@ export interface EncryptedCookieAuthRequestStorageOptions {
     /**
      * How many pending requests the cookie carries at once. A second sign-in
      * started in another tab would otherwise evict the first, so its callback
-     * would fail. Defaults to 3; the oldest is dropped beyond that.
+     * would fail. Defaults to 3; the oldest is dropped beyond that, and also
+     * whenever keeping it would push the sealed cookie past what every browser
+     * stores (about 4 KB), since a browser silently drops an oversized cookie
+     * and every pending sign-in in it with it. The sign-in being started is
+     * never the one dropped. Must be a positive integer.
      */
     maxPending?: number;
 }
@@ -106,8 +111,10 @@ export interface EncryptedCookieAuthRequestStorageOptions {
  * {@link HonoBffOptions.authRequestStorage} takes one of these rather than a
  * bare storage because a cookie-backed store can only read and write through
  * the request's {@link Context}. Pass an
- * {@link EncryptedCookieAuthRequestStorage}, or implement `forRequest` over
- * storage of your own.
+ * {@link EncryptedCookieAuthRequestStorage}, a
+ * {@link MemoryAuthRequestStorageFactory} for a single process, or implement
+ * `forRequest` over storage every instance shares. A storage that needs no
+ * request context is wrapped as `{ forRequest: () => storage }`.
  */
 export interface AuthRequestStorageFactory {
     /** Returns the storage bound to `c`, for the duration of that request. */
@@ -119,7 +126,7 @@ export interface AuthRequestStorageFactory {
  * `/auth/callback` need not be served by the same instance.
  *
  * Reach for it whenever the BFF runs on more than one isolate or instance —
- * the client's default in-memory storage fails those deployments with
+ * {@link MemoryAuthRequestStorageFactory} fails those deployments with
  * `unknown state parameter`. The AES key is derived on first use and shared by
  * every later request.
  *
@@ -146,6 +153,9 @@ export declare class EncryptedCookieAuthRequestStorage implements AuthRequestSto
      * carries a `__Host-`/`__Secure-` prefix the other cookie options contradict,
      * or when {@link AuthRequestCookieOptions.sameSite} is `"None"` without
      * {@link AuthRequestCookieOptions.secure}.
+     * @throws {RangeError} When
+     * {@link EncryptedCookieAuthRequestStorageOptions.maxPending} is not a
+     * positive integer.
      */
     constructor(options: EncryptedCookieAuthRequestStorageOptions);
     /** Returns the storage bound to `c`, for the duration of that request. */
@@ -166,3 +176,46 @@ export declare class EncryptedCookieAuthRequestStorage implements AuthRequestSto
  * ```
  */
 export declare function encryptedCookieAuthRequestStorage(options: EncryptedCookieAuthRequestStorageOptions): EncryptedCookieAuthRequestStorage;
+/**
+ * In-process {@link AuthRequestStorageFactory}: every request shares one
+ * {@link MemoryAuthRequestStorage}, so a sign-in completes only on the process
+ * that started it.
+ *
+ * Pass it explicitly for a single long-lived process, tests and local
+ * development. A deployment that can serve `/auth/login` and `/auth/callback`
+ * from different instances or isolates fails sign-in with it, intermittently,
+ * with an unknown `state`; use {@link EncryptedCookieAuthRequestStorage} or a
+ * factory over shared storage there. The options are
+ * {@link MemoryAuthRequestStorage}'s: records older than `ttlMs` (10 minutes
+ * by default) are pruned and at most `maxEntries` (1000 by default) are held.
+ *
+ * @example
+ * ```ts
+ * import {
+ *   HonoBff,
+ *   MemoryAuthRequestStorageFactory,
+ *   MemorySessionStore,
+ * } from "@udibo/oauth2/hono/bff";
+ * import { DirectClient } from "@udibo/oauth2/client";
+ *
+ * const bff = new HonoBff({
+ *   client: new DirectClient({
+ *     clientId: "local-app",
+ *     clientSecret: "dev-secret",
+ *     issuer: "http://localhost:8000",
+ *   }),
+ *   sessionStore: new MemorySessionStore(),
+ *   authRequestStorage: new MemoryAuthRequestStorageFactory(),
+ * });
+ * ```
+ */
+export declare class MemoryAuthRequestStorageFactory implements AuthRequestStorageFactory {
+    #private;
+    /**
+     * @throws {RangeError} When `maxEntries` is neither a positive integer nor
+     * `Infinity`.
+     */
+    constructor(options?: MemoryAuthRequestStorageOptions);
+    /** Returns the process-wide storage; `c` is not consulted. */
+    forRequest(_c: Context): AuthRequestStorage;
+}

package/dist/adapters/hono/bff/auth-request-store.js

@@ -1,13 +1,14 @@
 /**
- * Stateless {@link AuthRequestStorage} for {@link HonoBff}.
+ * {@link AuthRequestStorageFactory} implementations for {@link HonoBff}.
  *
  * The pending authorization request — the `state`, its PKCE code verifier, and
  * where to return afterwards — has to survive the round trip to the identity
- * provider. The client's default {@link MemoryAuthRequestStorage} keeps it in
- * the process that started the flow, which breaks on any platform that spreads
- * requests across isolates or instances: `/auth/login` stores the record on one
- * and `/auth/callback` looks for it on another, so sign-in fails intermittently
- * with `unknown state parameter`.
+ * provider. {@link MemoryAuthRequestStorageFactory} keeps it in the process
+ * that started the flow, which breaks on any platform that spreads requests
+ * across isolates or instances: `/auth/login` stores the record on one and
+ * `/auth/callback` looks for it on another, so sign-in fails intermittently
+ * with `unknown state parameter`. `HonoBff` therefore has no default; the
+ * caller chooses.
  *
  * {@link EncryptedCookieAuthRequestStorage} carries the record in an encrypted
  * cookie instead (AES-GCM under a server-held secret, the same construction
@@ -18,7 +19,7 @@
  * **Which storage you pick is a reliability decision, not a security one.**
  * Server-side storage on its own says a `state` is pending somewhere — never
  * that *this* browser is the one that started it, so a process-wide store like
- * the memory default would otherwise let anyone's browser complete anyone
+ * {@link MemoryAuthRequestStorageFactory} would otherwise let anyone's browser complete anyone
  * else's pending sign-in (login CSRF). {@link HonoBff} closes that separately
  * and unconditionally: `/auth/login` also binds the `state` to the browser in
  * a short-lived cookie that `/auth/callback` requires, whichever storage is
@@ -27,11 +28,14 @@
  * @module
  */
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { MemoryAuthRequestStorage, } from "../../../client/mod.js";
 import { deriveAesKey, sealJson, unsealJson } from "../../../utils/crypto.js";
 import { resolveCookieName, resolvePrefixConstrainedAttributes, } from "./cookie-prefix.js";
 const BASE_NAME = "oauth2_auth_request";
 const DEFAULT_TTL_MS = 10 * 60 * 1000;
 const DEFAULT_MAX_PENDING = 3;
+// RFC 6265 §6.1 only guarantees 4096 bytes per cookie, attributes included.
+const MAX_COOKIE_NAME_VALUE_BYTES = 3900;
 function cookieAttributes(options, maxAgeSeconds) {
     const { secure, path, domain } = resolvePrefixConstrainedAttributes(options);
     return {
@@ -49,7 +53,7 @@ function cookieAttributes(options, maxAgeSeconds) {
  * `/auth/callback` need not be served by the same instance.
  *
  * Reach for it whenever the BFF runs on more than one isolate or instance —
- * the client's default in-memory storage fails those deployments with
+ * {@link MemoryAuthRequestStorageFactory} fails those deployments with
  * `unknown state parameter`. The AES key is derived on first use and shared by
  * every later request.
  *
@@ -81,6 +85,9 @@ export class EncryptedCookieAuthRequestStorage {
      * carries a `__Host-`/`__Secure-` prefix the other cookie options contradict,
      * or when {@link AuthRequestCookieOptions.sameSite} is `"None"` without
      * {@link AuthRequestCookieOptions.secure}.
+     * @throws {RangeError} When
+     * {@link EncryptedCookieAuthRequestStorageOptions.maxPending} is not a
+     * positive integer.
      */
     constructor(options) {
         this.#cookie = options.cookie;
@@ -94,6 +101,10 @@ export class EncryptedCookieAuthRequestStorage {
         });
         this.#ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
         this.#maxPending = options.maxPending ?? DEFAULT_MAX_PENDING;
+        if (!(Number.isInteger(this.#maxPending) && this.#maxPending > 0)) {
+            throw new RangeError("EncryptedCookieAuthRequestStorage maxPending must be a positive " +
+                `integer, got ${this.#maxPending}.`);
+        }
     }
     #key() {
         return (this.#keyPromise ??= deriveAesKey(this.#secret));
@@ -108,15 +119,23 @@ export class EncryptedCookieAuthRequestStorage {
         const cutoff = Date.now() - this.#ttlMs;
         return Object.fromEntries(Object.entries(pending).filter(([, record]) => record.createdAt > cutoff));
     }
-    async #write(c, pending) {
+    async #write(c, pending, keep) {
         const entries = Object.entries(pending)
-            .sort(([, a], [, b]) => b.createdAt - a.createdAt)
+            .sort(([stateA, a], [stateB, b]) => Number(stateB === keep) - Number(stateA === keep) ||
+            b.createdAt - a.createdAt)
             .slice(0, this.#maxPending);
         if (entries.length === 0) {
             this.#clear(c);
             return;
         }
-        setCookie(c, this.#name, await sealJson(await this.#key(), Object.fromEntries(entries)), cookieAttributes(this.#cookie, Math.ceil(this.#ttlMs / 1000)));
+        const key = await this.#key();
+        let sealed = await sealJson(key, Object.fromEntries(entries));
+        while (entries.length > 1 &&
+            this.#name.length + 1 + sealed.length > MAX_COOKIE_NAME_VALUE_BYTES) {
+            entries.pop();
+            sealed = await sealJson(key, Object.fromEntries(entries));
+        }
+        setCookie(c, this.#name, sealed, cookieAttributes(this.#cookie, Math.ceil(this.#ttlMs / 1000)));
     }
     #clear(c) {
         deleteCookie(c, this.#name, cookieAttributes(this.#cookie));
@@ -128,7 +147,7 @@ export class EncryptedCookieAuthRequestStorage {
             set: async (state, value) => {
                 const pending = await this.#read(c);
                 pending[state] = value;
-                await this.#write(c, pending);
+                await this.#write(c, pending, state);
             },
             delete: async (state) => {
                 const pending = await this.#read(c);
@@ -156,3 +175,50 @@ export class EncryptedCookieAuthRequestStorage {
 export function encryptedCookieAuthRequestStorage(options) {
     return new EncryptedCookieAuthRequestStorage(options);
 }
+/**
+ * In-process {@link AuthRequestStorageFactory}: every request shares one
+ * {@link MemoryAuthRequestStorage}, so a sign-in completes only on the process
+ * that started it.
+ *
+ * Pass it explicitly for a single long-lived process, tests and local
+ * development. A deployment that can serve `/auth/login` and `/auth/callback`
+ * from different instances or isolates fails sign-in with it, intermittently,
+ * with an unknown `state`; use {@link EncryptedCookieAuthRequestStorage} or a
+ * factory over shared storage there. The options are
+ * {@link MemoryAuthRequestStorage}'s: records older than `ttlMs` (10 minutes
+ * by default) are pruned and at most `maxEntries` (1000 by default) are held.
+ *
+ * @example
+ * ```ts
+ * import {
+ *   HonoBff,
+ *   MemoryAuthRequestStorageFactory,
+ *   MemorySessionStore,
+ * } from "@udibo/oauth2/hono/bff";
+ * import { DirectClient } from "@udibo/oauth2/client";
+ *
+ * const bff = new HonoBff({
+ *   client: new DirectClient({
+ *     clientId: "local-app",
+ *     clientSecret: "dev-secret",
+ *     issuer: "http://localhost:8000",
+ *   }),
+ *   sessionStore: new MemorySessionStore(),
+ *   authRequestStorage: new MemoryAuthRequestStorageFactory(),
+ * });
+ * ```
+ */
+export class MemoryAuthRequestStorageFactory {
+    #storage;
+    /**
+     * @throws {RangeError} When `maxEntries` is neither a positive integer nor
+     * `Infinity`.
+     */
+    constructor(options = {}) {
+        this.#storage = new MemoryAuthRequestStorage(options);
+    }
+    /** Returns the process-wide storage; `c` is not consulted. */
+    forRequest(_c) {
+        return this.#storage;
+    }
+}

package/dist/adapters/hono/bff/bff.d.ts

@@ -162,6 +162,9 @@ export interface HonoBffCookieOptions {
  * header, so it is guarded instead by a same-origin check that reads
  * `Sec-Fetch-Site` (accepting only `same-origin` and `none`) and falls back to
  * comparing `Origin`, else `Referer`, for clients that send no fetch metadata.
+ * That comparison accepts the request's own origin and the application's
+ * (see {@link HonoBffOptions.rpInitiatedLogout}), so the fallback still passes
+ * behind a TLS-terminating proxy that hands the BFF a plain-HTTP request.
  * `same-site` is rejected along with `cross-site`, so a `GET` logout link
  * followed from a sibling subdomain does not pass. That check **fails closed**:
  * a request carrying none of the three signals is rejected. Two residuals come
@@ -308,10 +311,23 @@ export interface HonoBffOptions {
      */
     client: DirectClient;
     /**
-     * Where session data lives. Defaults to {@link MemorySessionStore},
-     * which is fine for dev and tests but must be replaced for production.
+     * Where session data lives. Required, because the right store depends on
+     * how many instances serve the app:
+     *
+     * - {@link EncryptedCookieSessionStore} keeps the session in an encrypted
+     *   cookie, so every instance that shares its secret can read it and no
+     *   server-side store is needed. It cannot list sessions, so it does not
+     *   support {@link HonoBffOptions.backchannelLogout}, and sign-out cannot
+     *   invalidate a copied cookie: it stays valid until its `maxAgeMs`. Use a
+     *   shared {@link SessionStore} when you need revocation.
+     * - A {@link SessionStore} over a database or cache every instance shares,
+     *   for server-side revocation and back-channel logout. Check it with
+     *   `runSessionStoreContractTests`.
+     * - {@link MemorySessionStore} for a single process, tests and local
+     *   development. A session it holds is unknown to every other instance, so
+     *   behind a load balancer the user appears signed out.
      */
-    sessionStore?: SessionStore;
+    sessionStore: SessionStore;
     /**
      * How long a BFF session is meant to live, in milliseconds. Defaults to 14
      * days ({@link DEFAULT_SESSION_MAX_AGE_MS}). Milliseconds match the store's
@@ -343,19 +359,25 @@ export interface HonoBffOptions {
     sessionMaxAgeMs?: number;
     /**
      * Where the pending authorization request (`state` → PKCE verifier,
-     * return-to) lives, resolved per request. Defaults to the client's
-     * configured `authRequestStorage`, which is in-memory unless the client was
-     * given something else — fine for a single long-lived process, wrong for any
-     * platform that can serve `/auth/login` and `/auth/callback` from different
-     * isolates. Pass an {@link EncryptedCookieAuthRequestStorage} to carry the
-     * record in an encrypted cookie instead, or implement
-     * {@link AuthRequestStorageFactory} over storage of your own.
+     * return-to) lives, resolved per request. Required, because `/auth/login`
+     * and `/auth/callback` can be served by different instances or isolates.
+     * The BFF always uses this, never the client's own `authRequestStorage`.
+     *
+     * - {@link EncryptedCookieAuthRequestStorage} carries the record in an
+     *   encrypted cookie, so any instance sharing its secret completes the
+     *   sign-in with no server-side store.
+     * - An {@link AuthRequestStorageFactory} over storage every instance shares;
+     *   wrap a context-free `AuthRequestStorage` as
+     *   `{ forRequest: () => storage }`.
+     * - {@link MemoryAuthRequestStorageFactory} for a single process, tests and
+     *   local development. A callback that reaches another instance fails with
+     *   an unknown `state`.
      *
      * Whatever this resolves to, the pending request is **also** bound to the
      * browser that started it by the login-state cookie, which no option turns
      * off. See {@link loginStateTtlMs}.
      */
-    authRequestStorage?: AuthRequestStorageFactory;
+    authRequestStorage: AuthRequestStorageFactory;
     /**
      * How long, in ms, the browser keeps the login-state cookie `/auth/login`
      * sets and `/auth/callback` requires — the `Max-Age` on that cookie, and so
@@ -425,10 +447,18 @@ export interface HonoBffOptions {
      * `/auth/logout` — after destroying the local session — additionally
      * redirects the browser to the OP's `end_session_endpoint` with
      * `id_token_hint` (the session's id_token, if any), `client_id`, and a
-     * `post_logout_redirect_uri` built from the resolved origin + the
+     * `post_logout_redirect_uri` built from the application's origin + the
      * open-redirect-guarded `return_to`. This ends the upstream IDP SSO session,
      * not just the local BFF session.
      *
+     * The application's origin is {@link resolveOrigin}'s, else the configured
+     * client `redirectUri`'s, else the request's — the last only when no
+     * `redirectUri` is configured or {@link deriveRedirectUri} is on, matching
+     * the origin sign-in sends. Behind a TLS-terminating proxy the request
+     * reports `http:`, so a deployment that derives its redirect URI there sets
+     * {@link resolveOrigin}; otherwise the URI would miss the registered
+     * `https:` one.
+     *
      * Defaults to `false` (local logout only): not every IDP supports it, and it
      * adds a redirect hop. When enabled but no end-session endpoint is known,
      * logout falls back to the plain local redirect and warns once via
@@ -481,8 +511,16 @@ export interface HonoBffOptions {
      * @example Pin every sign-in to one organization
      * ```ts
      * declare const client: DirectClient;
-     *
-     * const bff = new HonoBff({ client, extraParams: { organization: "acme" } });
+     * declare const stores: Pick<
+     *   HonoBffOptions,
+     *   "sessionStore" | "authRequestStorage"
+     * >;
+     *
+     * const bff = new HonoBff({
+     *   client,
+     *   ...stores,
+     *   extraParams: { organization: "acme" },
+     * });
      * ```
      */
     extraParams?: Record<string, string>;
@@ -548,8 +586,16 @@ export interface HonoBffOptions {
      * @example Let a sign-in link choose the organization
      * ```ts
      * declare const client: DirectClient;
-     *
-     * const bff = new HonoBff({ client, forwardedParams: ["organization"] });
+     * declare const stores: Pick<
+     *   HonoBffOptions,
+     *   "sessionStore" | "authRequestStorage"
+     * >;
+     *
+     * const bff = new HonoBff({
+     *   client,
+     *   ...stores,
+     *   forwardedParams: ["organization"],
+     * });
      * ```
      *
      * A link to `/auth/login?organization=acme&return_to=/dashboard` then
@@ -558,6 +604,14 @@ export interface HonoBffOptions {
     forwardedParams?: readonly string[];
     /** Default `return_to` applied when the browser doesn't pass one. */
     defaultReturnTo?: string;
+    /**
+     * Longest `return_to` accepted, in characters. `/auth/login` stores the
+     * value with the pending sign-in before any authentication, so a longer one
+     * is replaced by {@link defaultReturnTo} rather than kept — at login,
+     * callback, logout and in {@link HonoBff.loginContinuation}. Defaults to
+     * 2048; `Infinity` accepts any length.
+     */
+    maxReturnToLength?: number;
     /**
      * Optional hook run after the authorization code is exchanged. Lets
      * apps enrich the session with database-backed user info before the
@@ -622,9 +676,12 @@ export interface HonoBffOptions {
 export declare class HonoBff {
     #private;
     /**
-     * Defaults are applied for the session store ({@linkcode MemorySessionStore}),
-     * session mode (`"own"`), cookie name, and CSRF.
+     * Defaults are applied for session mode (`"own"`), cookie name, and CSRF.
+     * The session store and auth-request storage have no default.
      *
+     * @throws {TypeError} When {@linkcode HonoBffOptions.sessionStore} or
+     * {@linkcode HonoBffOptions.authRequestStorage} is missing, or when
+     * `authRequestStorage` has no `forRequest` method.
      * @throws {Error} When {@linkcode HonoBffOptions.backchannelLogout} is
      * configured against a store that cannot enumerate sessions (e.g.
      * {@linkcode EncryptedCookieSessionStore}), when an explicit
@@ -638,7 +695,9 @@ export declare class HonoBff {
      * {@linkcode HonoBffOptions.sessionMaxAgeMs}), when `sessionMaxAgeMs` or a
      * numeric `cookie.maxAge` is not positive or exceeds 400 days, when
      * {@linkcode HonoBffBackchannelOptions.maxBodyBytes} is not a positive
-     * integer (a `RangeError`), or when
+     * integer (a `RangeError`), when
+     * {@linkcode HonoBffOptions.maxReturnToLength} is neither a positive
+     * integer nor `Infinity` (a `RangeError`), or when
      * {@linkcode HonoBffOptions.extraParams} or
      * {@linkcode HonoBffOptions.forwardedParams} names a reserved authorize
      * parameter, gives one a name that is empty or not equal to its trimmed

package/dist/adapters/hono/bff/bff.js

@@ -56,9 +56,9 @@ import { inboundRequestWithHeaders } from "../../../utils/_inbound-request.js";
 import { timingSafeMatchIndex } from "../../../utils/_timing-safe.js";
 import { sha256Hash } from "../../../server/utils/hash.js";
 import { OAUTH2_CONTEXT_KEY } from "../_common.js";
-import { loginContinuation as computeLoginContinuation, safeReturnTo, } from "../../../utils/url.js";
+import { DEFAULT_MAX_RETURN_TO_LENGTH, loginContinuation as computeLoginContinuation, safeReturnTo, } from "../../../utils/url.js";
 import { resolveCookieName, resolvePrefixConstrainedAttributes, } from "./cookie-prefix.js";
-import { DEFAULT_SESSION_MAX_AGE_MS, MemorySessionStore, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.js";
+import { DEFAULT_SESSION_MAX_AGE_MS, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.js";
 import { buildDownstreamHeaders, buildUpstreamHeaders, isInvalidTokenChallenge, resolveForwardHeaders, resolveProxyUrl, } from "./proxy.js";
 function isRevokedGrant(error) {
     if (!isOAuth2Error(error))
@@ -268,6 +268,30 @@ function loginStateCookieOpts(opts, maxAgeSeconds) {
         ...(maxAgeSeconds === undefined ? {} : { maxAge: maxAgeSeconds }),
     };
 }
+const MISSING_SESSION_STORE = "HonoBff requires options.sessionStore. Pass EncryptedCookieSessionStore " +
+    "to keep sessions in an encrypted cookie any instance can read (sign-out " +
+    "cannot revoke a copied cookie), a " +
+    "SessionStore over a database or cache every instance shares, or " +
+    "MemorySessionStore for a single process, tests and local development.";
+const MISSING_AUTH_REQUEST_STORAGE = "HonoBff requires options.authRequestStorage. Pass " +
+    "EncryptedCookieAuthRequestStorage to keep pending sign-ins in an " +
+    "encrypted cookie any instance can read, an AuthRequestStorageFactory " +
+    "over storage every instance shares, or MemoryAuthRequestStorageFactory " +
+    "for a single process, tests and local development.";
+function assertStoresConfigured(options) {
+    const missing = [
+        ...(options.sessionStore ? [] : [MISSING_SESSION_STORE]),
+        ...(options.authRequestStorage ? [] : [MISSING_AUTH_REQUEST_STORAGE]),
+    ];
+    if (missing.length > 0)
+        throw new TypeError(missing.join(" "));
+    if (typeof options.authRequestStorage?.forRequest !== "function") {
+        throw new TypeError("HonoBff options.authRequestStorage must be an " +
+            "AuthRequestStorageFactory, an object whose forRequest(c) returns the " +
+            "storage for that request. Wrap an AuthRequestStorage that needs no " +
+            "request context as { forRequest: () => storage }.");
+    }
+}
 /**
  * Backend-for-Frontend adapter for Hono. Construct once per app, mount
  * `routes()` under `/auth`, and use `attachToken()` as middleware on
@@ -289,11 +313,15 @@ export class HonoBff {
     #sessionMode;
     #csrf;
     #extraAuthorizeParams;
+    #maxReturnToLength;
     #refreshes = new Map();
     /**
-     * Defaults are applied for the session store ({@linkcode MemorySessionStore}),
-     * session mode (`"own"`), cookie name, and CSRF.
+     * Defaults are applied for session mode (`"own"`), cookie name, and CSRF.
+     * The session store and auth-request storage have no default.
      *
+     * @throws {TypeError} When {@linkcode HonoBffOptions.sessionStore} or
+     * {@linkcode HonoBffOptions.authRequestStorage} is missing, or when
+     * `authRequestStorage` has no `forRequest` method.
      * @throws {Error} When {@linkcode HonoBffOptions.backchannelLogout} is
      * configured against a store that cannot enumerate sessions (e.g.
      * {@linkcode EncryptedCookieSessionStore}), when an explicit
@@ -307,7 +335,9 @@ export class HonoBff {
      * {@linkcode HonoBffOptions.sessionMaxAgeMs}), when `sessionMaxAgeMs` or a
      * numeric `cookie.maxAge` is not positive or exceeds 400 days, when
      * {@linkcode HonoBffBackchannelOptions.maxBodyBytes} is not a positive
-     * integer (a `RangeError`), or when
+     * integer (a `RangeError`), when
+     * {@linkcode HonoBffOptions.maxReturnToLength} is neither a positive
+     * integer nor `Infinity` (a `RangeError`), or when
      * {@linkcode HonoBffOptions.extraParams} or
      * {@linkcode HonoBffOptions.forwardedParams} names a reserved authorize
      * parameter, gives one a name that is empty or not equal to its trimmed
@@ -317,9 +347,10 @@ export class HonoBff {
      * {@linkcode HonoBffOptions.scope} is also set.
      */
     constructor(options) {
+        assertStoresConfigured(options);
         this.#options = options;
         this.#client = options.client;
-        this.#store = options.sessionStore ?? new MemorySessionStore();
+        this.#store = options.sessionStore;
         this.#paths = resolvePaths(options.paths, {
             backchannelMounted: options.backchannelLogout !== undefined,
         });
@@ -330,6 +361,13 @@ export class HonoBff {
         this.#sessionMode = options.sessionMode ?? "own";
         this.#csrf = resolveCsrf(options.csrf);
         this.#extraAuthorizeParams = resolveExtraAuthorizeParams(options);
+        this.#maxReturnToLength =
+            options.maxReturnToLength ?? DEFAULT_MAX_RETURN_TO_LENGTH;
+        if (this.#maxReturnToLength !== Infinity &&
+            !(Number.isInteger(this.#maxReturnToLength) && this.#maxReturnToLength > 0)) {
+            throw new RangeError("HonoBff maxReturnToLength must be a positive integer or Infinity, " +
+                `got ${this.#maxReturnToLength}.`);
+        }
         const sessionMaxAgeMs = positiveMs(options.sessionMaxAgeMs ?? DEFAULT_SESSION_MAX_AGE_MS, "sessionMaxAgeMs");
         this.#sessionMaxAgeMs = sessionMaxAgeMs;
         if (this.#sessionMode === "shared") {
@@ -437,6 +475,13 @@ export class HonoBff {
         deleteCookie(c, this.#cookieName, this.#cookieOptions());
         return null;
     }
+    #authRequestStorage(c) {
+        const storage = this.#options.authRequestStorage.forRequest(c);
+        if (!storage) {
+            throw new TypeError("HonoBff options.authRequestStorage.forRequest(c) returned no storage.");
+        }
+        return storage;
+    }
     #noStore(c) {
         c.header("Cache-Control", "no-store");
         c.header("Vary", "Cookie");
@@ -454,6 +499,20 @@ export class HonoBff {
         }
         setCookie(c, this.#loginStateCookieName, hashes.slice(-MAX_PENDING_LOGIN_STATES).join(LOGIN_STATE_SEPARATOR), loginStateCookieOpts(this.#options.cookie, Math.ceil(this.#loginStateTtlMs / 1000)));
     }
+    #safeReturnTo(value) {
+        return safeReturnTo(value, this.#options.defaultReturnTo ?? "/", {
+            maxLength: this.#maxReturnToLength,
+        });
+    }
+    #appOrigin(c) {
+        const resolved = this.#options.resolveOrigin?.(c);
+        if (resolved !== undefined)
+            return resolved;
+        const configured = this.#options.deriveRedirectUri
+            ? undefined
+            : this.#client.redirectUri;
+        return new URL(configured ?? c.req.url).origin;
+    }
     #derivedRedirectUri(c, origin) {
         if (!this.#options.deriveRedirectUri)
             return undefined;
@@ -473,12 +532,12 @@ export class HonoBff {
         const fetchSite = c.req.header("sec-fetch-site");
         if (fetchSite)
             return fetchSite === "same-origin" || fetchSite === "none";
-        const target = new URL(c.req.url).origin;
+        const targets = [new URL(c.req.url).origin, this.#appOrigin(c)];
         const check = (val) => {
             if (!val)
                 return undefined;
             try {
-                return new URL(val).origin === target;
+                return targets.includes(new URL(val).origin);
             }
             catch {
                 return false;
@@ -555,6 +614,7 @@ export class HonoBff {
             authorizeEndpoint: this.#client.authorizationEndpoint,
             loginPath: this.#paths.login,
             defaultReturnTo: this.#options.defaultReturnTo,
+            maxReturnToLength: this.#maxReturnToLength,
         });
     }
     #pathsRelative() {
@@ -583,7 +643,7 @@ export class HonoBff {
     loginHandler() {
         return async (c) => {
             this.#noStore(c);
-            const returnTo = safeReturnTo(c.req.query("return_to"), this.#options.defaultReturnTo ?? "/");
+            const returnTo = this.#safeReturnTo(c.req.query("return_to"));
             const origin = this.#options.resolveOrigin?.(c);
             const requested = authorizeParamsForRequest(this.#extraAuthorizeParams, new URL(c.req.url).searchParams);
             const { url, state } = await this.#client.login({
@@ -593,7 +653,7 @@ export class HonoBff {
                 prompt: requested.prompt,
                 extraParams: requested.extraParams,
                 redirectUri: this.#derivedRedirectUri(c, origin),
-                authRequestStorage: this.#options.authRequestStorage?.forRequest(c),
+                authRequestStorage: this.#authRequestStorage(c),
             });
             this.#writeLoginStateHashes(c, [
                 ...this.#loginStateHashes(c),
@@ -644,7 +704,7 @@ export class HonoBff {
                 const { tokens, refreshToken, returnTo, raw } = await this.#client.exchangeAuthorizationCode(code, state, {
                     origin,
                     redirectUri: this.#derivedRedirectUri(c, origin),
-                    authRequestStorage: this.#options.authRequestStorage?.forRequest(c),
+                    authRequestStorage: this.#authRequestStorage(c),
                 });
                 let user = null;
                 let sid;
@@ -683,7 +743,7 @@ export class HonoBff {
                 if (cookieValue !== existing) {
                     setCookie(c, this.#cookieName, cookieValue, this.#cookieOptions());
                 }
-                return c.redirect(safeReturnTo(returnTo, this.#options.defaultReturnTo ?? "/"));
+                return c.redirect(this.#safeReturnTo(returnTo));
             }
             catch (cause) {
                 return await fail({
@@ -723,11 +783,11 @@ export class HonoBff {
                 await this.#store.destroy(cookieValue);
                 deleteCookie(c, this.#cookieName, this.#cookieOptions());
             }
-            const returnTo = safeReturnTo(c.req.query("return_to"), this.#options.defaultReturnTo ?? "/");
+            const returnTo = this.#safeReturnTo(c.req.query("return_to"));
             if (this.#options.rpInitiatedLogout) {
                 const endSession = this.#client.endSessionEndpoint;
                 if (endSession) {
-                    const origin = this.#options.resolveOrigin?.(c) ?? new URL(c.req.url).origin;
+                    const origin = this.#appOrigin(c);
                     const url = new URL(endSession, origin);
                     if (idToken)
                         url.searchParams.set("id_token_hint", idToken);

package/dist/adapters/hono/bff/mod.d.ts

@@ -4,7 +4,12 @@
  * Exposes a {@link HonoBff} class that wraps an
  * `DirectClient` constructed with a client secret, plus the
  * {@link SessionStore} contract and two ready-to-use implementations
- * ({@link MemorySessionStore}, {@link EncryptedCookieSessionStore}).
+ * ({@link MemorySessionStore}, {@link EncryptedCookieSessionStore}), and the
+ * {@link AuthRequestStorageFactory} contract with two of its own
+ * ({@link MemoryAuthRequestStorageFactory},
+ * {@link EncryptedCookieAuthRequestStorage}). `HonoBff` requires one of each:
+ * the encrypted-cookie pair works across instances with no shared server, and
+ * the memory pair serves a single process, tests and local development.
  *
  * Need a server-side store (Postgres, Redis, …)? Implement the
  * {@link SessionStore} interface and verify it with
@@ -13,6 +18,6 @@
  * @module
  */
 export { type BackchannelLogoutSubject, type BffCallbackError, HonoBff, type HonoBffBackchannelOptions, type HonoBffCookieOptions, type HonoBffCsrfOptions, type HonoBffOptions, type HonoBffPaths, type HonoBffResourceServer, } from "./bff.ts";
-export { type AuthRequestCookieOptions, type AuthRequestStorageFactory, EncryptedCookieAuthRequestStorage, encryptedCookieAuthRequestStorage, type EncryptedCookieAuthRequestStorageOptions, } from "./auth-request-store.ts";
+export { type AuthRequestCookieOptions, type AuthRequestStorageFactory, EncryptedCookieAuthRequestStorage, encryptedCookieAuthRequestStorage, type EncryptedCookieAuthRequestStorageOptions, MemoryAuthRequestStorageFactory, } from "./auth-request-store.ts";
 export { DEFAULT_PROXY_FORWARD_HEADERS, type HonoBffProxyOptions, } from "./proxy.ts";
 export { type BackchannelLogoutStore, type BoundedSessionStore, DEFAULT_SESSION_MAX_AGE_MS, EncryptedCookieSessionStore, type EncryptedCookieSessionStoreOptions, MemorySessionStore, type SessionData, type SessionStore, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.ts";

package/dist/adapters/hono/bff/mod.js

@@ -4,7 +4,12 @@
  * Exposes a {@link HonoBff} class that wraps an
  * `DirectClient` constructed with a client secret, plus the
  * {@link SessionStore} contract and two ready-to-use implementations
- * ({@link MemorySessionStore}, {@link EncryptedCookieSessionStore}).
+ * ({@link MemorySessionStore}, {@link EncryptedCookieSessionStore}), and the
+ * {@link AuthRequestStorageFactory} contract with two of its own
+ * ({@link MemoryAuthRequestStorageFactory},
+ * {@link EncryptedCookieAuthRequestStorage}). `HonoBff` requires one of each:
+ * the encrypted-cookie pair works across instances with no shared server, and
+ * the memory pair serves a single process, tests and local development.
  *
  * Need a server-side store (Postgres, Redis, …)? Implement the
  * {@link SessionStore} interface and verify it with
@@ -13,6 +18,6 @@
  * @module
  */
 export { HonoBff, } from "./bff.js";
-export { EncryptedCookieAuthRequestStorage, encryptedCookieAuthRequestStorage, } from "./auth-request-store.js";
+export { EncryptedCookieAuthRequestStorage, encryptedCookieAuthRequestStorage, MemoryAuthRequestStorageFactory, } from "./auth-request-store.js";
 export { DEFAULT_PROXY_FORWARD_HEADERS, } from "./proxy.js";
 export { DEFAULT_SESSION_MAX_AGE_MS, EncryptedCookieSessionStore, MemorySessionStore, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.js";

package/dist/client/direct-client.d.ts

@@ -342,6 +342,15 @@ export declare class DirectClient extends OAuth2ClientBase {
      * available. It is a public identifier, never a credential.
      */
     get clientId(): string;
+    /**
+     * The configured `redirect_uri`, or `undefined` when none was given.
+     *
+     * Exposed so a Backend-for-Frontend behind a TLS-terminating proxy can
+     * take the application's public origin from configuration rather than from
+     * a request URL that reports the proxy's plain-HTTP hop. See
+     * `HonoBffOptions.rpInitiatedLogout`.
+     */
+    get redirectUri(): string | undefined;
     /**
      * Builds the PKCE-protected authorize URL and persists the verifier under
      * the returned `state`. Navigate the browser to `url`; the callback route

package/dist/client/direct-client.js

@@ -280,6 +280,17 @@ export class DirectClient extends OAuth2ClientBase {
     get clientId() {
         return this.#clientId;
     }
+    /**
+     * The configured `redirect_uri`, or `undefined` when none was given.
+     *
+     * Exposed so a Backend-for-Frontend behind a TLS-terminating proxy can
+     * take the application's public origin from configuration rather than from
+     * a request URL that reports the proxy's plain-HTTP hop. See
+     * `HonoBffOptions.rpInitiatedLogout`.
+     */
+    get redirectUri() {
+        return this.#redirectUri;
+    }
     async #endpoint(key) {
         if (this.#issuer && !this.#hasFreshMetadata())
             await this.discover();

package/dist/client/storage.d.ts

@@ -135,17 +135,35 @@ export interface MemoryAuthRequestStorageOptions {
      * in ms. Defaults to 10 minutes; `Infinity` never prunes.
      */
     ttlMs?: number;
+    /**
+     * Most records held at once. A write beyond it evicts the oldest-written
+     * record, so a flood of sign-in starts that never reach the callback cannot
+     * grow the process without bound — at the cost of failing each evicted
+     * sign-in with an unknown `state`. Defaults to 1000; `Infinity` never
+     * evicts by count.
+     */
+    maxEntries?: number;
 }
 /**
  * In-memory {@link AuthRequestStorage}, `DirectClient`'s default outside a
  * browser document. Data is lost when the process exits. Every write prunes
- * records older than {@link MemoryAuthRequestStorageOptions.ttlMs}, so logins
- * that never return to the callback do not accumulate in a long-running
- * server.
+ * records older than {@link MemoryAuthRequestStorageOptions.ttlMs}, then
+ * evicts the oldest-written records beyond
+ * {@link MemoryAuthRequestStorageOptions.maxEntries}, so neither logins that
+ * never return to the callback nor an anonymous burst of sign-in starts can
+ * grow a long-running server without bound. A deployment with more than one
+ * instance, or more pending sign-ins than the cap, needs storage every
+ * instance shares instead.
  */
 export declare class MemoryAuthRequestStorage implements AuthRequestStorage {
     #private;
-    /** Configures the pruning TTL, 10 minutes by default. */
+    /**
+     * Configures the pruning TTL (10 minutes by default) and the record cap
+     * (1000 by default).
+     *
+     * @throws {RangeError} When `maxEntries` is neither a positive integer nor
+     * `Infinity`.
+     */
     constructor(options?: MemoryAuthRequestStorageOptions);
     /** Returns the record for {@linkcode state}, or `null` if none is stored. */
     get(state: string): AuthRequestRecord | null;
@@ -153,7 +171,8 @@ export declare class MemoryAuthRequestStorage implements AuthRequestStorage {
     take(state: string): AuthRequestRecord | null;
     /**
      * Stores {@linkcode value} under {@linkcode state}, first pruning records
-     * past the TTL. Pruning walks records oldest-write-first and stops at the
+     * past the TTL, then evicting the oldest-written records beyond
+     * `maxEntries`. Pruning walks records oldest-write-first and stops at the
      * first one inside the TTL, so it assumes each `createdAt` is the time of
      * its write, as `DirectClient.login` sets it.
      */

package/dist/client/storage.js

@@ -53,19 +53,37 @@ export class MemoryRefreshTokenStorage {
         this.#token = null;
     }
 }
+const DEFAULT_MAX_AUTH_REQUESTS = 1000;
 /**
  * In-memory {@link AuthRequestStorage}, `DirectClient`'s default outside a
  * browser document. Data is lost when the process exits. Every write prunes
- * records older than {@link MemoryAuthRequestStorageOptions.ttlMs}, so logins
- * that never return to the callback do not accumulate in a long-running
- * server.
+ * records older than {@link MemoryAuthRequestStorageOptions.ttlMs}, then
+ * evicts the oldest-written records beyond
+ * {@link MemoryAuthRequestStorageOptions.maxEntries}, so neither logins that
+ * never return to the callback nor an anonymous burst of sign-in starts can
+ * grow a long-running server without bound. A deployment with more than one
+ * instance, or more pending sign-ins than the cap, needs storage every
+ * instance shares instead.
  */
 export class MemoryAuthRequestStorage {
     #records = new Map();
     #ttlMs;
-    /** Configures the pruning TTL, 10 minutes by default. */
+    #maxEntries;
+    /**
+     * Configures the pruning TTL (10 minutes by default) and the record cap
+     * (1000 by default).
+     *
+     * @throws {RangeError} When `maxEntries` is neither a positive integer nor
+     * `Infinity`.
+     */
     constructor(options = {}) {
         this.#ttlMs = options.ttlMs ?? 10 * 60 * 1000;
+        this.#maxEntries = options.maxEntries ?? DEFAULT_MAX_AUTH_REQUESTS;
+        if (this.#maxEntries !== Infinity &&
+            !(Number.isInteger(this.#maxEntries) && this.#maxEntries > 0)) {
+            throw new RangeError("MemoryAuthRequestStorage maxEntries must be a positive integer or " +
+                `Infinity, got ${this.#maxEntries}.`);
+        }
     }
     /** Returns the record for {@linkcode state}, or `null` if none is stored. */
     get(state) {
@@ -79,7 +97,8 @@ export class MemoryAuthRequestStorage {
     }
     /**
      * Stores {@linkcode value} under {@linkcode state}, first pruning records
-     * past the TTL. Pruning walks records oldest-write-first and stops at the
+     * past the TTL, then evicting the oldest-written records beyond
+     * `maxEntries`. Pruning walks records oldest-write-first and stops at the
      * first one inside the TTL, so it assumes each `createdAt` is the time of
      * its write, as `DirectClient.login` sets it.
      */
@@ -87,6 +106,7 @@ export class MemoryAuthRequestStorage {
         this.#pruneExpired();
         this.#records.delete(state);
         this.#records.set(state, value);
+        this.#evictOverflow();
     }
     /** Removes the record for {@linkcode state}. */
     delete(state) {
@@ -96,6 +116,13 @@ export class MemoryAuthRequestStorage {
     clear() {
         this.#records.clear();
     }
+    #evictOverflow() {
+        for (const state of this.#records.keys()) {
+            if (this.#records.size <= this.#maxEntries)
+                return;
+            this.#records.delete(state);
+        }
+    }
     #pruneExpired() {
         if (this.#ttlMs === Infinity)
             return;

package/dist/utils/url.d.ts

@@ -3,6 +3,17 @@
  *
  * @module
  */
+/** {@link SafeReturnToOptions.maxLength}'s default, in UTF-16 code units. */
+export declare const DEFAULT_MAX_RETURN_TO_LENGTH = 2048;
+/** Options for {@link safeReturnTo}. */
+export interface SafeReturnToOptions {
+    /**
+     * Longest value accepted, in UTF-16 code units (`String.length`), not
+     * bytes; a longer one collapses to the fallback. Defaults to {@link DEFAULT_MAX_RETURN_TO_LENGTH} (2048).
+     * `Infinity` accepts any length.
+     */
+    maxLength?: number;
+}
 /**
  * Open-redirect guard for a `return_to` / redirect target.
  *
@@ -19,6 +30,11 @@
  * Percent-encoded control characters (`/%09/x`) are safe and pass through: a
  * browser does not decode them before parsing, so they stay on the origin.
  *
+ * A value longer than {@link SafeReturnToOptions.maxLength} (2048 characters
+ * by default) also collapses to `fallback`, so a caller that stores the
+ * result — a pending sign-in, a session — cannot be made to hold an
+ * arbitrarily large string per anonymous request.
+ *
  * Use this anywhere a user-influenced value — a `return_to` / `redirect` query
  * param or form field — is fed into a redirect `Location`, so a crafted
  * absolute target can't turn the (often post-authentication) redirect into an
@@ -32,9 +48,10 @@
  * safeReturnTo("/\\evil.com");       // → "/"
  * safeReturnTo("/\t/evil.com");      // → "/"
  * safeReturnTo(undefined, "/home");  // → "/home"
+ * safeReturnTo("/a-long-path", "/", { maxLength: 8 }); // → "/"
  * ```
  */
-export declare function safeReturnTo(value: string | null | undefined, fallback?: string): string;
+export declare function safeReturnTo(value: string | null | undefined, fallback?: string, options?: SafeReturnToOptions): string;
 /** Trusted application configuration for {@link loginContinuation}. */
 export interface LoginContinuationOptions {
     /**
@@ -47,6 +64,11 @@ export interface LoginContinuationOptions {
     loginPath?: string;
     /** Trusted fallback for missing/unsafe `returnTo`. Defaults to `"/"`. */
     defaultReturnTo?: string;
+    /**
+     * Longest `returnTo` accepted, in characters; a longer one falls back to
+     * {@link defaultReturnTo}. Defaults to 2048 ({@link safeReturnTo}'s cap).
+     */
+    maxReturnToLength?: number;
 }
 /**
  * The URL that (re)starts sign-in toward `returnTo`, for an app that owns its

package/dist/utils/url.js

@@ -4,6 +4,8 @@
  * @module
  */
 const RESOLUTION_ORIGIN = "http://safe-return-to.invalid";
+/** {@link SafeReturnToOptions.maxLength}'s default, in UTF-16 code units. */
+export const DEFAULT_MAX_RETURN_TO_LENGTH = 2048;
 function hasControlCharacter(value) {
     for (let index = 0; index < value.length; index++) {
         const code = value.charCodeAt(index);
@@ -28,6 +30,11 @@ function hasControlCharacter(value) {
  * Percent-encoded control characters (`/%09/x`) are safe and pass through: a
  * browser does not decode them before parsing, so they stay on the origin.
  *
+ * A value longer than {@link SafeReturnToOptions.maxLength} (2048 characters
+ * by default) also collapses to `fallback`, so a caller that stores the
+ * result — a pending sign-in, a session — cannot be made to hold an
+ * arbitrarily large string per anonymous request.
+ *
  * Use this anywhere a user-influenced value — a `return_to` / `redirect` query
  * param or form field — is fed into a redirect `Location`, so a crafted
  * absolute target can't turn the (often post-authentication) redirect into an
@@ -41,11 +48,15 @@ function hasControlCharacter(value) {
  * safeReturnTo("/\\evil.com");       // → "/"
  * safeReturnTo("/\t/evil.com");      // → "/"
  * safeReturnTo(undefined, "/home");  // → "/home"
+ * safeReturnTo("/a-long-path", "/", { maxLength: 8 }); // → "/"
  * ```
  */
-export function safeReturnTo(value, fallback = "/") {
+export function safeReturnTo(value, fallback = "/", options = {}) {
     if (!value || !value.startsWith("/"))
         return fallback;
+    if (value.length > (options.maxLength ?? DEFAULT_MAX_RETURN_TO_LENGTH)) {
+        return fallback;
+    }
     if (hasControlCharacter(value))
         return fallback;
     let resolved;
@@ -79,7 +90,9 @@ export function safeReturnTo(value, fallback = "/") {
  * endpoint and login path are trusted application configuration.
  */
 export function loginContinuation(returnTo, options = {}) {
-    const safe = safeReturnTo(returnTo, options.defaultReturnTo ?? "/");
+    const safe = safeReturnTo(returnTo, options.defaultReturnTo ?? "/", {
+        maxLength: options.maxReturnToLength,
+    });
     if (options.authorizeEndpoint) {
         const base = "http://login.continuation.local";
         const authorizePath = new URL(options.authorizeEndpoint, base).pathname;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.15.2",
+  "version": "0.17.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",