@udibo/oauth2 0.18.0 → 0.20.0

package/dist/errors.d.ts

@@ -64,11 +64,11 @@ export declare function isOAuth2Error(value: unknown): value is OAuth2Error;
  * anything else is wrapped in a {@link ServerError} with the original error
  * attached as `cause`.
  *
- * Either way, `type` and `extensions.error_uri` are synced so that if one is
- * set the other is too — **mutating an OAuth2Error input in place**. This lets
- * both the standard OAuth2 error format (which emits `error_uri`) and the
- * RFC 9457 Problem Details format (which emits `type`) carry the same URI
- * without the handler having to set both fields.
+ * An error that sets `extensions.error_uri` but no `type` gets `type` set to
+ * the same URI — **mutating an OAuth2Error input in place** — so the RFC 9457
+ * Problem Details format, which emits `type`, carries it. `type` is never
+ * copied into `extensions.error_uri`, so a problem-details body does not repeat
+ * it; the RFC 6749 error format emits `error_uri` from either field.
  */
 export declare function toOAuth2Error(error: unknown): OAuth2Error;
 /**

package/dist/errors.js

@@ -38,20 +38,17 @@ export function isOAuth2Error(value) {
  * anything else is wrapped in a {@link ServerError} with the original error
  * attached as `cause`.
  *
- * Either way, `type` and `extensions.error_uri` are synced so that if one is
- * set the other is too — **mutating an OAuth2Error input in place**. This lets
- * both the standard OAuth2 error format (which emits `error_uri`) and the
- * RFC 9457 Problem Details format (which emits `type`) carry the same URI
- * without the handler having to set both fields.
+ * An error that sets `extensions.error_uri` but no `type` gets `type` set to
+ * the same URI — **mutating an OAuth2Error input in place** — so the RFC 9457
+ * Problem Details format, which emits `type`, carries it. `type` is never
+ * copied into `extensions.error_uri`, so a problem-details body does not repeat
+ * it; the RFC 6749 error format emits `error_uri` from either field.
  */
 export function toOAuth2Error(error) {
     const oauth2Error = isOAuth2Error(error)
         ? error
         : new ServerError("unexpected error", { cause: error });
-    if (oauth2Error.type && !oauth2Error.extensions.error_uri) {
-        oauth2Error.extensions.error_uri = oauth2Error.type;
-    }
-    else if (oauth2Error.extensions.error_uri && !oauth2Error.type) {
+    if (oauth2Error.extensions.error_uri && !oauth2Error.type) {
         oauth2Error.type = oauth2Error.extensions.error_uri;
     }
     return oauth2Error;

package/dist/server/_challenge.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Character-set rules for `WWW-Authenticate` challenge parameters (RFC 7235
+ * §2.2, RFC 9110 §5.6.4, RFC 6750 §3).
+ *
+ * @module
+ */
+/** Throws `TypeError` unless `realm` is printable ASCII (U+0020–U+007E), the only text every HTTP stack carries in a header unaltered. */
+export declare function assertRealm(realm: string): void;
+/** The `realm` parameter as a quoted-string; `realm` must already satisfy {@linkcode assertRealm}. */
+export declare function quoteRealm(realm: string): string;
+/**
+ * Maps text into the RFC 6750 §3 `error_description` set
+ * (`%x20-21 / %x23-5B / %x5D-7E`): control characters are dropped, `"`
+ * becomes `'`, and every other code point outside the set becomes `?`.
+ */
+export declare function toChallengeDescription(text: string): string;
+/** `scope` with its space-separated tokens rejoined by single spaces, or `undefined` unless every token is an RFC 6750 §3 scope-token. */
+export declare function toChallengeScope(scope: string): string | undefined;

package/dist/server/_challenge.js

@@ -0,0 +1,41 @@
+/**
+ * Character-set rules for `WWW-Authenticate` challenge parameters (RFC 7235
+ * §2.2, RFC 9110 §5.6.4, RFC 6750 §3).
+ *
+ * @module
+ */
+import { NQCHAR } from "../models/scope.js";
+const PRINTABLE_ASCII = /^[\x20-\x7e]*$/;
+// oxlint-disable-next-line no-control-regex
+const CONTROL_CHARACTERS = /[\x00-\x1f\x7f]/g;
+const OUTSIDE_DESCRIPTION_SET = /[^\x20\x21\x23-\x5b\x5d-\x7e]/gu;
+const SCOPE_TOKEN_ONLY = new RegExp(`^${NQCHAR.source}+$`);
+/** Throws `TypeError` unless `realm` is printable ASCII (U+0020–U+007E), the only text every HTTP stack carries in a header unaltered. */
+export function assertRealm(realm) {
+    if (typeof realm !== "string" || !PRINTABLE_ASCII.test(realm)) {
+        throw new TypeError(`realm must contain only printable ASCII characters (U+0020 to U+007E), got ${JSON.stringify(realm)}`);
+    }
+}
+/** The `realm` parameter as a quoted-string; `realm` must already satisfy {@linkcode assertRealm}. */
+export function quoteRealm(realm) {
+    return `"${realm.replace(/["\\]/g, "\\$&")}"`;
+}
+/**
+ * Maps text into the RFC 6750 §3 `error_description` set
+ * (`%x20-21 / %x23-5B / %x5D-7E`): control characters are dropped, `"`
+ * becomes `'`, and every other code point outside the set becomes `?`.
+ */
+export function toChallengeDescription(text) {
+    return text
+        .replace(CONTROL_CHARACTERS, "")
+        .replaceAll('"', "'")
+        .replace(OUTSIDE_DESCRIPTION_SET, "?");
+}
+/** `scope` with its space-separated tokens rejoined by single spaces, or `undefined` unless every token is an RFC 6750 §3 scope-token. */
+export function toChallengeScope(scope) {
+    const tokens = scope.split(" ").filter((token) => token !== "");
+    return tokens.length > 0 &&
+        tokens.every((token) => SCOPE_TOKEN_ONLY.test(token))
+        ? tokens.join(" ")
+        : undefined;
+}

package/dist/server/_error-response.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Serializes OAuth2 errors into responses for the resource and authorization
+ * servers.
+ *
+ * @module
+ */
+import type { OAuth2Error } from "../errors.ts";
+/** Copies the error's headers onto the response, except `Content-Type`, which the serializer owns. */
+export declare function copyErrorHeaders(oauth2Error: OAuth2Error, response: Response): Response;
+/** The RFC 6749 §5.2 error response: `{ error, error_description?, error_uri? }` as `application/json`, carrying the error's headers. */
+export declare function oauth2ErrorResponse(oauth2Error: OAuth2Error): Response;

package/dist/server/_error-response.js

@@ -0,0 +1,33 @@
+/**
+ * Serializes OAuth2 errors into responses for the resource and authorization
+ * servers.
+ *
+ * @module
+ */
+/** Copies the error's headers onto the response, except `Content-Type`, which the serializer owns. */
+export function copyErrorHeaders(oauth2Error, response) {
+    for (const [key, value] of oauth2Error.headers) {
+        if (key.toLowerCase() === "content-type")
+            continue;
+        response.headers.set(key, value);
+    }
+    return response;
+}
+/** The RFC 6749 §5.2 error response: `{ error, error_description?, error_uri? }` as `application/json`, carrying the error's headers. */
+export function oauth2ErrorResponse(oauth2Error) {
+    const body = {
+        error: oauth2Error.extensions.error ?? "server_error",
+    };
+    const description = oauth2Error.extensions.error_description ?? oauth2Error.exposedMessage;
+    if (description) {
+        body.error_description = description;
+    }
+    const errorUri = oauth2Error.extensions.error_uri ?? oauth2Error.type;
+    if (errorUri) {
+        body.error_uri = errorUri;
+    }
+    return copyErrorHeaders(oauth2Error, new Response(JSON.stringify(body), {
+        status: oauth2Error.status,
+        headers: { "Content-Type": "application/json;charset=UTF-8" },
+    }));
+}

package/dist/server/authorization-server.d.ts

@@ -446,6 +446,8 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      * @throws {Error} If `requireOidc` is set without `signingKeys`.
      * @throws {RangeError} If `maxBodyBytes` or `maxTokenBodyBytes` is not a
      *   positive integer.
+     * @throws {TypeError} If `realm` contains a character outside printable
+     *   ASCII.
      */
     constructor(options: AuthorizationServerOptions<Client, User, S>);
     /**

package/dist/server/authorization-server.js

@@ -20,7 +20,7 @@
  * @module
  */
 import { snapshotAuthenticationContext } from "../utils/authentication-context.js";
-import { AccessDeniedError, InvalidRequestError, InvalidTokenError, isOAuth2Error, OAuth2Error, ServerError, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, } from "../errors.js";
+import { AccessDeniedError, InvalidRequestError, InvalidTokenError, isOAuth2Error, OAuth2Error, ServerError, toOAuth2Error, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, } from "../errors.js";
 import { authenticateClientCredentials, extractClientCredentials, } from "./client-authentication.js";
 import { isRedirectUriPattern, matchRedirectUri } from "./redirect-uri.js";
 import { AuthorizationCodeGrant } from "./grants/authorization-code.js";
@@ -28,6 +28,8 @@ import { DeviceAuthorizationGrant } from "./grants/device-authorization.js";
 import { ResourceServer, } from "./resource-server.js";
 import { defaultSubjectOf, signJwt, verifyJwt, } from "./signing-keys.js";
 import { validateCodeChallenge } from "../utils/pkce.js";
+import { oauth2ErrorResponse } from "./_error-response.js";
+import { quoteRealm } from "./_challenge.js";
 import { assertMaxBodyBytes, DEFAULT_MAX_BODY_BYTES, readBoundedBody, } from "../utils/_body.js";
 const ENDPOINTS = {
     authorization: {
@@ -199,6 +201,8 @@ export class AuthorizationServer extends ResourceServer {
      * @throws {Error} If `requireOidc` is set without `signingKeys`.
      * @throws {RangeError} If `maxBodyBytes` or `maxTokenBodyBytes` is not a
      *   positive integer.
+     * @throws {TypeError} If `realm` contains a character outside printable
+     *   ASCII.
      */
     constructor(options) {
         super({
@@ -237,6 +241,13 @@ export class AuthorizationServer extends ResourceServer {
         this.#introspectionClaims = options.introspectionClaims;
         this.#canIntrospectToken = options.canIntrospectToken;
     }
+    #handleEndpointError(error, prepare) {
+        const oauth2Error = toOAuth2Error(error);
+        prepare?.(oauth2Error);
+        if (this.throwOnError)
+            throw oauth2Error;
+        return oauth2ErrorResponse(oauth2Error);
+    }
     /**
      * Whether this instance will actually serve the OIDC surface: `true` once
      * `signingKeys` is set, which is what gates `id_token` issuance and the
@@ -328,7 +339,7 @@ export class AuthorizationServer extends ResourceServer {
         return (error) => {
             this.addCacheHeaders(error);
             if (error.status === 401 && request.headers.get("authorization")) {
-                error.headers.set("WWW-Authenticate", `Basic realm="${this.realm}"`);
+                error.headers.set("WWW-Authenticate", `Basic realm=${quoteRealm(this.realm)}`);
             }
         };
     }
@@ -441,7 +452,7 @@ export class AuthorizationServer extends ResourceServer {
             return await this.createTokenResponse(token, context, grant);
         }
         catch (error) {
-            return this.handleError(error, this.prepareClientAuthError(request));
+            return this.#handleEndpointError(error, this.prepareClientAuthError(request));
         }
     }
     /**
@@ -485,7 +496,7 @@ export class AuthorizationServer extends ResourceServer {
      */
     async handleOidcMetadataRequest(request) {
         if (!this.signingKeys) {
-            return this.handleError(new OAuth2Error(404, "OIDC issuance is not enabled", {
+            return this.#handleEndpointError(new OAuth2Error(404, "OIDC issuance is not enabled", {
                 extensions: { error: "not_found" },
             }));
         }
@@ -497,7 +508,7 @@ export class AuthorizationServer extends ResourceServer {
      */
     async handleJwksRequest(_request) {
         if (!this.signingKeys) {
-            return this.handleError(new OAuth2Error(404, "OIDC issuance is not enabled", {
+            return this.#handleEndpointError(new OAuth2Error(404, "OIDC issuance is not enabled", {
                 extensions: { error: "not_found" },
             }));
         }
@@ -512,7 +523,7 @@ export class AuthorizationServer extends ResourceServer {
             });
         }
         catch (error) {
-            return this.handleError(error);
+            return this.#handleEndpointError(error);
         }
     }
     /**
@@ -626,7 +637,7 @@ export class AuthorizationServer extends ResourceServer {
             return new Response(null, { status: 302, headers });
         }
         catch (error) {
-            return this.handleError(error);
+            return this.#handleEndpointError(error);
         }
     }
     // RP-Initiated Logout §2: parameters come from the GET query or POST body.
@@ -799,7 +810,7 @@ export class AuthorizationServer extends ResourceServer {
     }
     #authorizeErrorResponse(error, redirectUrl) {
         if (!redirectUrl || !(error instanceof Error) || !isOAuth2Error(error)) {
-            return this.handleError(error);
+            return this.#handleEndpointError(error);
         }
         const { searchParams } = redirectUrl;
         searchParams.set("error", error.extensions.error ?? "server_error");
@@ -958,7 +969,7 @@ export class AuthorizationServer extends ResourceServer {
             return new Response(null, { status: 200 });
         }
         catch (error) {
-            return this.handleError(error, this.prepareClientAuthError(request));
+            return this.#handleEndpointError(error, this.prepareClientAuthError(request));
         }
     }
     async #resolveToken(tokenService, value, hint) {
@@ -1086,7 +1097,7 @@ export class AuthorizationServer extends ResourceServer {
             });
         }
         catch (error) {
-            return this.handleError(error, this.prepareClientAuthError(request));
+            return this.#handleEndpointError(error, this.prepareClientAuthError(request));
         }
     }
     /**
@@ -1189,7 +1200,7 @@ export class AuthorizationServer extends ResourceServer {
             });
         }
         catch (error) {
-            return this.handleError(error);
+            return this.#handleEndpointError(error);
         }
     }
     /**
@@ -1244,7 +1255,7 @@ export class AuthorizationServer extends ResourceServer {
             });
         }
         catch (error) {
-            return this.handleError(error, this.prepareClientAuthError(request));
+            return this.#handleEndpointError(error, this.prepareClientAuthError(request));
         }
     }
 }

package/dist/server/resource-server.d.ts

@@ -37,7 +37,14 @@ export interface ResourceServerOptions<Client extends ClientInterface, User, S e
     resolve: (request: Request) => ResourceServerContext<Client, User, S> | Promise<ResourceServerContext<Client, User, S>>;
     /** Scope constructor used to parse and compare scopes. Defaults to {@linkcode BasicScope}. */
     Scope?: ScopeConstructor<S>;
-    /** Protection space named in `WWW-Authenticate` challenges. Defaults to `"Service"`. */
+    /**
+     * Protection space named in `WWW-Authenticate` challenges. Defaults to
+     * `"Service"`. Must be printable ASCII (U+0020 to U+007E); a product name
+     * with other characters needs an ASCII form here.
+     *
+     * @throws {TypeError} From the constructor when it contains any other
+     *   character.
+     */
     realm?: string;
     /**
      * Leeway in seconds applied to the access token's expiry, to absorb clock
@@ -77,12 +84,24 @@ export interface ResourceServerOptions<Client extends ClientInterface, User, S e
      */
     maxTokenBodyBytes?: number;
     /**
-     * Format for error responses.
-     * - `"oauth2"` (default): Standard OAuth2 error format with `error`,
-     *   `error_description`, and `error_uri` fields.
-     * - `"problem-details"`: RFC 9457 Problem Details format with OAuth2
-     *   extensions. `type` and `error_uri` carry the same URI; `detail` and
-     *   `error_description` carry the same message.
+     * Format for protected-resource refusals: the responses from `protect()`,
+     * {@linkcode ResourceServer.handleAuthError} and
+     * {@linkcode ResourceServer.createErrorResponse}, including an
+     * authorization server's own protected resources such as UserInfo.
+     * - `"oauth2"` (default): `{ error, error_description?, error_uri? }` as
+     *   `application/json`.
+     * - `"problem-details"`: RFC 9457 Problem Details as
+     *   `application/problem+json`: `status`, `title`, `detail` (the message),
+     *   `type` when set, the OAuth2 `error` code and any other extension members
+     *   such as `requiredScope`. `error_description` and `error_uri` appear only
+     *   when the error sets them as extensions.
+     *
+     * Either way, a 401 or 403 from `protect()` or `handleAuthError` carries the
+     * `error` code and `error_description` in its `WWW-Authenticate` challenge.
+     *
+     * An authorization server's OAuth endpoints (token, revocation,
+     * introspection, device authorization, authorize, end-session, metadata and
+     * JWKS) ignore it and always answer in the RFC 6749 §5.2 format.
      */
     errorFormat?: "oauth2" | "problem-details";
     /**
@@ -158,14 +177,22 @@ export declare class ResourceServer<Client extends ClientInterface, User, S exte
     #private;
     /** Scope constructor used to parse and compare scopes. */
     Scope: ScopeConstructor<S>;
-    /** Protection space named in `WWW-Authenticate` challenges. */
-    realm: string;
-    /** Body format used for error responses: OAuth2 or RFC 9457 problem details. */
+    /** Body format of protected-resource refusals: OAuth2 or RFC 9457 problem details. See {@linkcode ResourceServerOptions.errorFormat}. */
     errorFormat: "oauth2" | "problem-details";
     /** When true, handler boundaries rethrow {@linkcode OAuth2Error} instead of returning a response. */
     throwOnError: boolean;
     /** Resolves the per-request {@link ResourceServerContext}. */
     protected resolveContext: (request: Request) => ResourceServerContext<Client, User, S> | Promise<ResourceServerContext<Client, User, S>>;
+    /** Protection space named in `WWW-Authenticate` challenges. */
+    get realm(): string;
+    /**
+     * Sets the protection space, preserving the previous value if validation
+     * fails.
+     *
+     * @throws {TypeError} If the value contains a character outside printable
+     *   ASCII (U+0020 to U+007E).
+     */
+    set realm(value: string);
     /**
      * Leeway in seconds applied to the access token's expiry. Defaults to `0`.
      * May be reassigned to any non-negative finite number with a finite
@@ -185,6 +212,8 @@ export declare class ResourceServer<Client extends ClientInterface, User, S exte
      * @throws {RangeError} If `clockSkewSeconds` is negative, non-finite, or
      *   overflows when converted to milliseconds, or if `maxTokenBodyBytes` is
      *   not a positive integer.
+     * @throws {TypeError} If `realm` contains a character outside printable
+     *   ASCII.
      */
     constructor(options: ResourceServerOptions<Client, User, S>);
     /**
@@ -205,6 +234,14 @@ export declare class ResourceServer<Client extends ClientInterface, User, S exte
      * {@linkcode InsufficientScopeError} is the one that tells it "your token is
      * fine, it just lacks scope" rather than sending it off to refresh.
      *
+     * The result is always printable ASCII, so it never makes `Headers` throw.
+     * `error_description` is the same text the oauth2 response body uses (the
+     * `error_description` extension, else the error's exposed message, so an
+     * unexposed message stays out of both), narrowed to the RFC 6750 character
+     * set: control characters are dropped, `"` becomes `'`, and any other
+     * character outside the set becomes `?`. `scope` is omitted entirely when
+     * any of its tokens falls outside the RFC 6750 set.
+     *
      * @see https://datatracker.ietf.org/doc/html/rfc6750#section-3
      */
     buildWwwAuthenticate(error?: OAuth2Error, requiredScope?: string): string;

package/dist/server/resource-server.js

@@ -9,7 +9,9 @@
 import { BasicScope } from "../models/scope.js";
 import { AccessDeniedError, InsufficientPermissionsError, InsufficientScopeError, InvalidTokenError, toOAuth2Error, } from "../errors.js";
 import { authorizationFromClaims, } from "../models/authorization.js";
+import { copyErrorHeaders, oauth2ErrorResponse } from "./_error-response.js";
 import { assertClockSkewSeconds } from "./_clock-skew.js";
+import { assertRealm, quoteRealm, toChallengeDescription, toChallengeScope, } from "./_challenge.js";
 import { assertMaxBodyBytes, DEFAULT_MAX_TOKEN_BODY_BYTES, peekBoundedBody, } from "../utils/_body.js";
 /** Bearer token regex pattern. */
 export const BEARER_TOKEN = /^ *(?:[Bb][Ee][Aa][Rr][Ee][Rr]) +([\w-.~+/]+=*) *$/;
@@ -72,9 +74,7 @@ const CHALLENGE_ERROR_CODES = new Set([
 export class ResourceServer {
     /** Scope constructor used to parse and compare scopes. */
     Scope;
-    /** Protection space named in `WWW-Authenticate` challenges. */
-    realm;
-    /** Body format used for error responses: OAuth2 or RFC 9457 problem details. */
+    /** Body format of protected-resource refusals: OAuth2 or RFC 9457 problem details. See {@linkcode ResourceServerOptions.errorFormat}. */
     errorFormat;
     /** When true, handler boundaries rethrow {@linkcode OAuth2Error} instead of returning a response. */
     throwOnError;
@@ -82,6 +82,22 @@ export class ResourceServer {
     resolveContext;
     #clockSkewSeconds = 0;
     #maxTokenBodyBytes;
+    #realm = "Service";
+    /** Protection space named in `WWW-Authenticate` challenges. */
+    get realm() {
+        return this.#realm;
+    }
+    /**
+     * Sets the protection space, preserving the previous value if validation
+     * fails.
+     *
+     * @throws {TypeError} If the value contains a character outside printable
+     *   ASCII (U+0020 to U+007E).
+     */
+    set realm(value) {
+        assertRealm(value);
+        this.#realm = value;
+    }
     /**
      * Leeway in seconds applied to the access token's expiry. Defaults to `0`.
      * May be reassigned to any non-negative finite number with a finite
@@ -106,6 +122,8 @@ export class ResourceServer {
      * @throws {RangeError} If `clockSkewSeconds` is negative, non-finite, or
      *   overflows when converted to milliseconds, or if `maxTokenBodyBytes` is
      *   not a positive integer.
+     * @throws {TypeError} If `realm` contains a character outside printable
+     *   ASCII.
      */
     constructor(options) {
         this.Scope =
@@ -137,31 +155,33 @@ export class ResourceServer {
      * {@linkcode InsufficientScopeError} is the one that tells it "your token is
      * fine, it just lacks scope" rather than sending it off to refresh.
      *
+     * The result is always printable ASCII, so it never makes `Headers` throw.
+     * `error_description` is the same text the oauth2 response body uses (the
+     * `error_description` extension, else the error's exposed message, so an
+     * unexposed message stays out of both), narrowed to the RFC 6750 character
+     * set: control characters are dropped, `"` becomes `'`, and any other
+     * character outside the set becomes `?`. `scope` is omitted entirely when
+     * any of its tokens falls outside the RFC 6750 set.
+     *
      * @see https://datatracker.ietf.org/doc/html/rfc6750#section-3
      */
     buildWwwAuthenticate(error, requiredScope) {
-        const quote = (value) => value
-            // oxlint-disable-next-line no-control-regex
-            .replace(/[\x00-\x1f\x7f]/g, "")
-            .replace(/\\/g, "\\\\")
-            .replace(/"/g, '\\"');
-        const parts = [`realm="${quote(this.realm)}"`];
+        const parts = [`realm=${quoteRealm(this.realm)}`];
         const code = error?.extensions.error;
         if (error && code && CHALLENGE_ERROR_CODES.has(code)) {
-            parts.push(`error="${quote(code)}"`);
-            if (error.message) {
-                parts.push(`error_description="${quote(error.message)}"`);
+            parts.push(`error="${code}"`);
+            const description = toChallengeDescription(error.extensions.error_description ?? error.exposedMessage);
+            if (description) {
+                parts.push(`error_description="${description}"`);
             }
         }
-        if (requiredScope) {
-            parts.push(`scope="${quote(requiredScope)}"`);
-        }
-        else if (error instanceof InsufficientScopeError) {
-            const scope = error.extensions
-                .requiredScope;
-            if (scope) {
-                parts.push(`scope="${quote(scope)}"`);
-            }
+        const scope = requiredScope ||
+            (error instanceof InsufficientScopeError
+                ? error.extensions.requiredScope
+                : undefined);
+        const challengeScope = scope ? toChallengeScope(scope) : undefined;
+        if (challengeScope) {
+            parts.push(`scope="${challengeScope}"`);
         }
         return `Bearer ${parts.join(", ")}`;
     }
@@ -179,32 +199,10 @@ export class ResourceServer {
      */
     createErrorResponse(error) {
         const oauth2Error = toOAuth2Error(error);
-        const response = this.errorFormat === "problem-details"
-            ? oauth2Error.getResponse()
-            : this.#createOAuth2ErrorResponse(oauth2Error);
-        for (const [key, value] of oauth2Error.headers) {
-            if (key.toLowerCase() === "content-type")
-                continue;
-            response.headers.set(key, value);
-        }
-        return response;
-    }
-    #createOAuth2ErrorResponse(oauth2Error) {
-        const body = {
-            error: oauth2Error.extensions.error ?? "server_error",
-        };
-        const description = oauth2Error.extensions.error_description ?? oauth2Error.exposedMessage;
-        if (description) {
-            body.error_description = description;
+        if (this.errorFormat !== "problem-details") {
+            return oauth2ErrorResponse(oauth2Error);
         }
-        const errorUri = oauth2Error.extensions.error_uri ?? oauth2Error.type;
-        if (errorUri) {
-            body.error_uri = errorUri;
-        }
-        return new Response(JSON.stringify(body), {
-            status: oauth2Error.status,
-            headers: { "Content-Type": "application/json;charset=UTF-8" },
-        });
+        return copyErrorHeaders(oauth2Error, oauth2Error.getResponse());
     }
     /**
      * Normalizes an error at a handler boundary and either rethrows it (when

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",