@udibo/oauth2 0.20.0 → 0.21.0

package/dist/cli/idp/server.js

@@ -23,6 +23,7 @@ import { PasswordGrant } from "../../server/grants/password.js";
 import { RefreshTokenGrant } from "../../server/grants/refresh-token.js";
 import { StaticSigningKeyProvider, } from "../../server/signing-keys.js";
 import { generateCodeChallenge, generateCodeVerifier, generateState, } from "../../utils/pkce.js";
+import { DEFAULT_MAX_BODY_BYTES, readBoundedBody } from "../../utils/_body.js";
 import { timingSafeEqualString } from "../../utils/crypto.js";
 import { safeReturnTo } from "../../utils/url.js";
 import { MemoryAuthorizationCodeService, MemoryClientService, MemoryTokenService, MemoryUserService, } from "../../testing/services.js";
@@ -218,8 +219,22 @@ function handleConsentFor(state, request) {
         }));
     };
 }
+class BodyTooLargeError extends Error {
+}
+async function readBody(request) {
+    const bytes = await readBoundedBody(request, DEFAULT_MAX_BODY_BYTES);
+    if (!bytes) {
+        throw new BodyTooLargeError(`request body exceeds ${DEFAULT_MAX_BODY_BYTES} bytes`);
+    }
+    return bytes;
+}
+async function readFormBody(request) {
+    return await new Response(await readBody(request), {
+        headers: { "content-type": request.headers.get("content-type") ?? "" },
+    }).formData();
+}
 async function handleLoginSubmission(state, config, request) {
-    const form = await request.formData();
+    const form = await readFormBody(request);
     const returnTo = safeReturnTo(formValue(form, "return_to"));
     const quickSignIn = formValue(form, "as");
     let user;
@@ -252,7 +267,7 @@ async function handleConsentSubmission(state, request) {
     const user = await currentUser(state, request);
     if (!user)
         return redirect("/login");
-    const form = await request.formData();
+    const form = await readFormBody(request);
     const returnTo = safeReturnTo(formValue(form, "return_to"));
     const target = new URL(returnTo, request.url);
     const clientId = target.searchParams.get("client_id");
@@ -294,7 +309,7 @@ function handleLogout(state, config, request) {
     });
 }
 async function readJsonBody(request) {
-    const text = await request.text();
+    const text = new TextDecoder().decode(await readBody(request));
     if (text.trim().length === 0)
         return {};
     const parsed = JSON.parse(text);
@@ -522,7 +537,7 @@ export async function startDevIdentityProvider(options) {
             }
         }
         catch (error) {
-            return jsonError(400, error instanceof Error ? error.message : String(error));
+            return jsonError(error instanceof BodyTooLargeError ? 413 : 400, error instanceof Error ? error.message : String(error));
         }
     };
     const server = serveNode({

package/dist/identity/external/_shared.d.ts

@@ -24,10 +24,25 @@ export declare const ID_TOKEN_EXPIRY_LEEWAY_SECONDS = 120;
  * OAuth2 error carries a description the provider wrote.
  */
 export declare function describeError(error: unknown): string;
+/**
+ * Response bytes a connector reads from a provider endpoint — token, profile,
+ * UserInfo, or key set — before refusing the response.
+ */
+export declare const MAX_PROVIDER_RESPONSE_BYTES: number;
+/**
+ * Reads `res`'s body as text, stopping and cancelling it past
+ * {@link MAX_PROVIDER_RESPONSE_BYTES}. `source` names the endpoint in the
+ * error message, e.g. `"the Acme profile endpoint"`.
+ *
+ * @throws {ExternalAuthError} `provider_error` when the body is larger than
+ *   the cap or stops arriving.
+ */
+export declare function readProviderText(res: Response, provider: string, source: string): Promise<string>;
 /**
  * Reads a failed response's body into a bounded, single-line `": <text>"`
- * suffix to append to an error message, or `""` when the body is empty or
- * unreadable. Consumes the body, so the caller must not read it again.
+ * suffix to append to an error message, or `""` when the body is empty,
+ * unreadable, or larger than {@link MAX_PROVIDER_RESPONSE_BYTES}. Consumes
+ * the body, so the caller must not read it again.
  */
 export declare function readErrorBody(res: Response): Promise<string>;
 /**

package/dist/identity/external/_shared.js

@@ -9,6 +9,7 @@
  * @module
  */
 import { isOAuth2Error } from "../../errors.js";
+import { readBoundedBody } from "../../utils/_body.js";
 import { timingSafeEqualString } from "../../utils/crypto.js";
 import { PROVIDER_TEXT_MAX_LENGTH, sanitizeProviderText, } from "../../utils/text.js";
 import { ExternalAuthError } from "./errors.js";
@@ -36,14 +37,45 @@ export function describeError(error) {
     }
     return sanitizeProviderText(error instanceof Error ? error.message : String(error));
 }
+/**
+ * Response bytes a connector reads from a provider endpoint — token, profile,
+ * UserInfo, or key set — before refusing the response.
+ */
+export const MAX_PROVIDER_RESPONSE_BYTES = 64 * 1024;
+/**
+ * Reads `res`'s body as text, stopping and cancelling it past
+ * {@link MAX_PROVIDER_RESPONSE_BYTES}. `source` names the endpoint in the
+ * error message, e.g. `"the Acme profile endpoint"`.
+ *
+ * @throws {ExternalAuthError} `provider_error` when the body is larger than
+ *   the cap or stops arriving.
+ */
+export async function readProviderText(res, provider, source) {
+    let bytes;
+    try {
+        bytes = await readBoundedBody(res, MAX_PROVIDER_RESPONSE_BYTES);
+    }
+    catch (error) {
+        throw new ExternalAuthError(provider, "provider_error", `${source} response could not be read (${describeError(error)}).`, { cause: error });
+    }
+    if (!bytes) {
+        throw new ExternalAuthError(provider, "provider_error", `${source} response exceeded ${MAX_PROVIDER_RESPONSE_BYTES} bytes — ` +
+            `refusing to parse a response this large.`);
+    }
+    return new TextDecoder().decode(bytes);
+}
 /**
  * Reads a failed response's body into a bounded, single-line `": <text>"`
- * suffix to append to an error message, or `""` when the body is empty or
- * unreadable. Consumes the body, so the caller must not read it again.
+ * suffix to append to an error message, or `""` when the body is empty,
+ * unreadable, or larger than {@link MAX_PROVIDER_RESPONSE_BYTES}. Consumes
+ * the body, so the caller must not read it again.
  */
 export async function readErrorBody(res) {
     try {
-        const snippet = sanitizeProviderText(await res.text());
+        const bytes = await readBoundedBody(res, MAX_PROVIDER_RESPONSE_BYTES);
+        if (!bytes)
+            return "";
+        const snippet = sanitizeProviderText(new TextDecoder().decode(bytes));
         return snippet ? `: ${snippet}` : "";
     }
     catch {

package/dist/identity/external/_token-exchange.js

@@ -9,10 +9,10 @@
  * @module
  */
 import { packageDeadlineSignal } from "../../utils/_default-fetch.js";
-import { describeError, sanitizeProviderText } from "./_shared.js";
+import { describeError, MAX_PROVIDER_RESPONSE_BYTES, sanitizeProviderText, } from "./_shared.js";
 import { ExternalAuthError } from "./errors.js";
 /** Response bytes accepted from a token endpoint before the exchange is refused. */
-export const MAX_TOKEN_RESPONSE_BYTES = 64 * 1024;
+export const MAX_TOKEN_RESPONSE_BYTES = MAX_PROVIDER_RESPONSE_BYTES;
 /** Wall-clock budget for the exchange, covering the connect and the body read. */
 export const TOKEN_EXCHANGE_TIMEOUT_MS = 10_000;
 /**

package/dist/identity/external/apple.js

@@ -18,7 +18,7 @@
 import { toArrayBuffer } from "../../utils/_buffer.js";
 import { base64urlDecode } from "../../utils/crypto.js";
 import { defaultFetch } from "../../utils/_default-fetch.js";
-import { assertIdTokenClaims, describeError } from "./_shared.js";
+import { assertIdTokenClaims, describeError, readProviderText, } from "./_shared.js";
 import { runTokenExchange } from "./_token-exchange.js";
 import { createAppleClientSecretFactory, } from "./apple-client-secret.js";
 import { ExternalAuthError } from "./errors.js";
@@ -110,9 +110,10 @@ export function appleProvider(options) {
             await res.body?.cancel();
             throw new ExternalAuthError(id, "provider_error", `Apple's JWKS endpoint responded with HTTP ${res.status}.`);
         }
+        const text = await readProviderText(res, id, "Apple's JWKS endpoint");
         let doc;
         try {
-            doc = (await res.json());
+            doc = JSON.parse(text);
         }
         catch (error) {
             throw new ExternalAuthError(id, "provider_error", `Apple's JWKS endpoint returned invalid JSON (${describeError(error)}).`, { cause: error });

package/dist/identity/external/github.js

@@ -5,7 +5,7 @@
  * @module
  */
 import { defaultFetch } from "../../utils/_default-fetch.js";
-import { describeError } from "./_shared.js";
+import { describeError, readProviderText } from "./_shared.js";
 import { runTokenExchange } from "./_token-exchange.js";
 import { ExternalAuthError } from "./errors.js";
 const GITHUB_AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
@@ -74,8 +74,9 @@ export function githubProvider(options) {
             await res.body?.cancel();
             return null;
         }
+        const text = await readProviderText(res, id, url);
         try {
-            return await res.json();
+            return JSON.parse(text);
         }
         catch (error) {
             throw new ExternalAuthError(id, "provider_error", `${url} returned a response that was not valid JSON ` +

package/dist/identity/external/oauth2.js

@@ -9,7 +9,7 @@
  */
 import { defaultFetch } from "../../utils/_default-fetch.js";
 import { generateCodeChallenge } from "../../utils/pkce.js";
-import { describeError, readErrorBody } from "./_shared.js";
+import { describeError, readErrorBody, readProviderText } from "./_shared.js";
 import { runTokenExchange } from "./_token-exchange.js";
 import { ExternalAuthError } from "./errors.js";
 /**
@@ -85,8 +85,9 @@ export function oauth2Provider(options) {
                 `access token was issued but lacks profile access — ensure the ` +
                 `identity scope is requested.`);
         }
+        const text = await readProviderText(res, id, `the ${options.displayName} profile endpoint`);
         try {
-            return (await res.json());
+            return JSON.parse(text);
         }
         catch (error) {
             throw new ExternalAuthError(id, "provider_error", `the ${options.displayName} profile endpoint returned a response ` +

package/dist/identity/external/oidc.js

@@ -9,7 +9,7 @@ import { MemoryAuthRequestStorage } from "../../client/storage.js";
 import { isOAuth2Error } from "../../errors.js";
 import { defaultFetch } from "../../utils/_default-fetch.js";
 import { generateCodeChallenge } from "../../utils/pkce.js";
-import { assertIdTokenClaims, describeError, stripTrailingSlash, } from "./_shared.js";
+import { assertIdTokenClaims, describeError, readProviderText, stripTrailingSlash, } from "./_shared.js";
 import { ExternalAuthError } from "./errors.js";
 /**
  * Creates a connector for any spec-compliant OpenID Connect provider.
@@ -153,7 +153,7 @@ export function oidcProvider(options) {
                 await res.body?.cancel();
                 return null;
             }
-            const info = (await res.json());
+            const info = JSON.parse(await readProviderText(res, id, "the UserInfo endpoint"));
             return info.sub === idTokenSub ? info : null;
         }
         catch {

package/dist/identity/hibp.d.ts

@@ -32,6 +32,14 @@ export interface BreachedPasswordOptions {
     failOpen?: boolean;
     /** Abort the range request after this many ms. Defaults to 3000. */
     timeoutMs?: number;
+    /**
+     * Largest range response, in bytes, the check reads. Defaults to 1048576
+     * (1 MiB), about ten times a padded range. The read counts bytes as they
+     * arrive and cancels the response at the cap, whether or not it has a
+     * `Content-Length`; a larger response counts as the range API being
+     * unavailable, so `failOpen` decides the outcome.
+     */
+    maxResponseBytes?: number;
     /** Fetch implementation — inject for tests. Defaults to `globalThis.fetch`. */
     fetch?: typeof fetch;
     /** Range API base URL. Defaults to `https://api.pwnedpasswords.com/range/`. */
@@ -56,6 +64,8 @@ export declare function sha1Hex(input: string): Promise<string>;
  * Build a {@link PasswordPolicy} validator that rejects passwords found in the
  * HIBP breach corpus.
  *
+ * @throws {RangeError} If `maxResponseBytes` is not a positive integer.
+ *
  * @example
  * ```ts
  * const policy: PasswordPolicy = {

package/dist/identity/hibp.js

@@ -17,10 +17,12 @@
  *
  * @module
  */
+import { assertMaxBodyBytes, readBoundedBody } from "../utils/_body.js";
 import { encodeHex } from "../utils/_encoding.js";
 import { defaultFetch, packageDeadlineSignal, } from "../utils/_default-fetch.js";
 import { dispatchIdentityEvent } from "./events.js";
 const DEFAULT_BASE_URL = "https://api.pwnedpasswords.com/range/";
+const DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;
 const VALIDATOR_NAME = "breached_password";
 const BREACHED_MESSAGE = "This password has appeared in a data breach; choose a different one.";
 const UNAVAILABLE_MESSAGE = "The password couldn't be checked against known breaches; try again.";
@@ -33,6 +35,8 @@ export async function sha1Hex(input) {
  * Build a {@link PasswordPolicy} validator that rejects passwords found in the
  * HIBP breach corpus.
  *
+ * @throws {RangeError} If `maxResponseBytes` is not a positive integer.
+ *
  * @example
  * ```ts
  * const policy: PasswordPolicy = {
@@ -45,6 +49,8 @@ export function breachedPasswordValidator(options = {}) {
     const threshold = options.threshold ?? 1;
     const failOpen = options.failOpen ?? true;
     const timeoutMs = options.timeoutMs ?? 3000;
+    const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+    assertMaxBodyBytes(maxResponseBytes, "maxResponseBytes");
     const fetchImpl = options.fetch ?? defaultFetch;
     const baseUrl = options.baseUrl ?? DEFAULT_BASE_URL;
     const onEvent = options.onEvent;
@@ -61,7 +67,11 @@ export function breachedPasswordValidator(options = {}) {
                 await response.body?.cancel();
                 throw new Error(`range API responded ${response.status}`);
             }
-            const body = await response.text();
+            const bytes = await readBoundedBody(response, maxResponseBytes);
+            if (!bytes) {
+                throw new Error(`range API response exceeded ${maxResponseBytes} bytes`);
+            }
+            const body = new TextDecoder().decode(bytes);
             for (const line of body.split("\n")) {
                 const [lineSuffix, countText] = line.trim().split(":");
                 if (lineSuffix === suffix && Number(countText) >= threshold) {

package/dist/server/_response-json.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Not part of the public API. The bounded JSON read the token readers apply
+ * to the responses of the authorization server they call.
+ *
+ * @module
+ */
+/**
+ * Parses `response`'s body as JSON, reading at most `maxBytes`. `label`
+ * names the response in error messages.
+ *
+ * @throws {ServerError} When the body exceeds `maxBytes` (the read stops and
+ *   the body is cancelled) or is not JSON.
+ * @throws {TemporarilyUnavailableError} When the body stops arriving before it
+ *   is complete: the deadline fired or the connection dropped mid-body.
+ */
+export declare function readResponseJson(response: Response, maxBytes: number, label: string): Promise<unknown>;

package/dist/server/_response-json.js

@@ -0,0 +1,35 @@
+/**
+ * Not part of the public API. The bounded JSON read the token readers apply
+ * to the responses of the authorization server they call.
+ *
+ * @module
+ */
+import { ServerError, TemporarilyUnavailableError } from "../errors.js";
+import { readBoundedBody } from "../utils/_body.js";
+/**
+ * Parses `response`'s body as JSON, reading at most `maxBytes`. `label`
+ * names the response in error messages.
+ *
+ * @throws {ServerError} When the body exceeds `maxBytes` (the read stops and
+ *   the body is cancelled) or is not JSON.
+ * @throws {TemporarilyUnavailableError} When the body stops arriving before it
+ *   is complete: the deadline fired or the connection dropped mid-body.
+ */
+export async function readResponseJson(response, maxBytes, label) {
+    let bytes;
+    try {
+        bytes = await readBoundedBody(response, maxBytes);
+    }
+    catch (cause) {
+        throw new TemporarilyUnavailableError(`${label} request failed`, { cause });
+    }
+    if (!bytes) {
+        throw new ServerError(`${label} response exceeded ${maxBytes} bytes`);
+    }
+    try {
+        return JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch (cause) {
+        throw new ServerError(`${label} response was not JSON`, { cause });
+    }
+}

package/dist/server/introspection-token-reader.d.ts

@@ -67,6 +67,13 @@ export interface IntrospectionTokenReaderOptions<Client extends ClientInterface,
      * {@linkcode fetch} that doesn't honour `AbortSignal`.
      */
     fetchTimeoutMs?: number;
+    /**
+     * Largest introspection response, in bytes, the reader accepts. Defaults to
+     * 65536 (64 KiB). The read counts bytes as they arrive and cancels the
+     * response at the cap, whether or not it has a `Content-Length`; a larger
+     * response throws {@linkcode ServerError}.
+     */
+    maxResponseBytes?: number;
     /**
      * `fetch` implementation used to call the introspection endpoint. Defaults
      * to the global `fetch`. Inject it to route through a custom client (mTLS,
@@ -127,10 +134,14 @@ export declare class IntrospectionTokenReader<Client extends ClientInterface, Us
     private getClient;
     private getUser?;
     private fetchTimeoutMs;
+    private maxResponseBytes;
     private customFetch?;
     /**
-     * `Scope` defaults to {@linkcode BasicScope}, `fetchTimeoutMs` to 5000, and
-     * `fetch` to the global `fetch` when omitted from `options`.
+     * `Scope` defaults to {@linkcode BasicScope}, `fetchTimeoutMs` to 5000,
+     * `maxResponseBytes` to 65536, and `fetch` to the global `fetch` when
+     * omitted from `options`.
+     *
+     * @throws {RangeError} If `maxResponseBytes` is not a positive integer.
      */
     constructor(options: IntrospectionTokenReaderOptions<Client, User, S>);
     /**
@@ -149,9 +160,10 @@ export declare class IntrospectionTokenReader<Client extends ClientInterface, Us
      *   a genuinely invalid token (which is `undefined` → `invalid_token`), not
      *   collapsed into it.
      * @throws {ServerError} If the endpoint returns any other non-2xx status
-     *   (e.g. the reader's own introspection credentials are rejected) or a body
-     *   that is not JSON — a misconfiguration, not a verdict on the caller's
-     *   token.
+     *   (e.g. the reader's own introspection credentials are rejected), a body
+     *   that is not JSON, or one larger than
+     *   {@linkcode IntrospectionTokenReaderOptions.maxResponseBytes} — a
+     *   misconfiguration, not a verdict on the caller's token.
      *
      * An active response is only accepted when its `token_type` names a bearer
      * token. RFC 7662 answers for refresh tokens too, and a refresh token's

package/dist/server/introspection-token-reader.js

@@ -12,6 +12,8 @@
 import { ServerError, TemporarilyUnavailableError } from "../errors.js";
 import { BasicScope } from "../models/scope.js";
 import { encodeBasicAuth } from "../utils/basic-auth.js";
+import { assertMaxBodyBytes, DEFAULT_MAX_RESPONSE_BYTES, } from "../utils/_body.js";
+import { readResponseJson } from "./_response-json.js";
 import { defaultFetch, packageDeadlineSignal, } from "../utils/_default-fetch.js";
 /**
  * Validates tokens by calling an OAuth2 introspection endpoint (RFC 7662).
@@ -62,10 +64,14 @@ export class IntrospectionTokenReader {
     getClient;
     getUser;
     fetchTimeoutMs;
+    maxResponseBytes;
     customFetch;
     /**
-     * `Scope` defaults to {@linkcode BasicScope}, `fetchTimeoutMs` to 5000, and
-     * `fetch` to the global `fetch` when omitted from `options`.
+     * `Scope` defaults to {@linkcode BasicScope}, `fetchTimeoutMs` to 5000,
+     * `maxResponseBytes` to 65536, and `fetch` to the global `fetch` when
+     * omitted from `options`.
+     *
+     * @throws {RangeError} If `maxResponseBytes` is not a positive integer.
      */
     constructor(options) {
         this.introspectionEndpoint = options.introspectionEndpoint;
@@ -76,6 +82,9 @@ export class IntrospectionTokenReader {
         this.getClient = options.getClient;
         this.getUser = options.getUser;
         this.fetchTimeoutMs = options.fetchTimeoutMs ?? 5_000;
+        this.maxResponseBytes =
+            options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+        assertMaxBodyBytes(this.maxResponseBytes, "maxResponseBytes");
         this.customFetch = options.fetch;
     }
     /**
@@ -94,9 +103,10 @@ export class IntrospectionTokenReader {
      *   a genuinely invalid token (which is `undefined` → `invalid_token`), not
      *   collapsed into it.
      * @throws {ServerError} If the endpoint returns any other non-2xx status
-     *   (e.g. the reader's own introspection credentials are rejected) or a body
-     *   that is not JSON — a misconfiguration, not a verdict on the caller's
-     *   token.
+     *   (e.g. the reader's own introspection credentials are rejected), a body
+     *   that is not JSON, or one larger than
+     *   {@linkcode IntrospectionTokenReaderOptions.maxResponseBytes} — a
+     *   misconfiguration, not a verdict on the caller's token.
      *
      * An active response is only accepted when its `token_type` names a bearer
      * token. RFC 7662 answers for refresh tokens too, and a refresh token's
@@ -153,16 +163,7 @@ export class IntrospectionTokenReader {
                     ? new TemporarilyUnavailableError(`token introspection failed (HTTP ${response.status})`)
                     : new ServerError(`token introspection failed (HTTP ${response.status})`);
             }
-            try {
-                return (await response.json());
-            }
-            catch (cause) {
-                throw controller.signal.aborted
-                    ? new TemporarilyUnavailableError("token introspection request failed", { cause })
-                    : new ServerError("token introspection response was not JSON", {
-                        cause,
-                    });
-            }
+            return (await readResponseJson(response, this.maxResponseBytes, "token introspection"));
         }
         finally {
             clearTimeout(deadline);

package/dist/server/jwks-token-reader.d.ts

@@ -146,6 +146,14 @@ export interface JwksTokenReaderOptions<Client extends ClientInterface, User, S
      * {@linkcode fetch} that doesn't honour `AbortSignal`.
      */
     fetchTimeoutMs?: number;
+    /**
+     * Largest discovery document or JWKS, in bytes, the reader accepts.
+     * Defaults to 262144 (256 KiB). The read counts bytes as they arrive and
+     * cancels the response at the cap, whether or not it has a
+     * `Content-Length`; a larger response fails the refresh with a
+     * {@linkcode ServerError}, as a malformed one does.
+     */
+    maxResponseBytes?: number;
     /** Optional scope constructor for parsing scope strings. Defaults to BasicScope. */
     Scope?: ScopeConstructor<S>;
     /**
@@ -233,14 +241,15 @@ export declare class JwksTokenReader<Client extends ClientInterface, User, S ext
      * Defaults: every Web Crypto asymmetric algorithm accepted, `at+jwt`
      * required as `typ`, `client_id` as the required client-id claim, 30
      * seconds of clock skew, a 10-minute cache with a 30-second minimum
-     * between fetches, a 5-second request deadline, {@linkcode BasicScope},
-     * and the global `fetch`.
+     * between fetches, a 5-second request deadline, a 256 KiB response cap,
+     * {@linkcode BasicScope}, and the global `fetch`.
      *
      * @throws {TypeError} If `issuer` is not an absolute URL, `audience` is
      *   empty, or `algorithms` names an algorithm this package cannot verify
      *   (a silently ignored entry would read as a policy that isn't enforced).
      * @throws {RangeError} If `clockSkewSeconds` is negative, non-finite, or
-     *   overflows when converted to milliseconds.
+     *   overflows when converted to milliseconds, or `maxResponseBytes` is not
+     *   a positive integer.
      */
     constructor(options: JwksTokenReaderOptions<Client, User, S>);
     /**
@@ -263,8 +272,10 @@ export declare class JwksTokenReader<Client extends ClientInterface, User, S ext
      *   invalid token, not collapsed into it. Once keys are cached, a failed
      *   refresh is absorbed and the cached keys keep serving.
      * @throws {ServerError} If, with no keys cached, the JWKS endpoint returns
-     *   a 4xx or a body that is not a JWKS, or discovery reports no `jwks_uri`
-     *   — a misconfiguration, not a verdict on the caller's token.
+     *   a 4xx or a body that is not a JWKS, either document exceeds
+     *   {@linkcode JwksTokenReaderOptions.maxResponseBytes}, or discovery
+     *   reports no `jwks_uri` — a misconfiguration, not a verdict on the
+     *   caller's token.
      */
     getToken(accessToken: string): Promise<Token<Client, User, S> | undefined>;
 }

package/dist/server/jwks-token-reader.js

@@ -14,10 +14,12 @@
  */
 import { ServerError, TemporarilyUnavailableError } from "../errors.js";
 import { BasicScope } from "../models/scope.js";
+import { assertMaxBodyBytes, DEFAULT_MAX_KEY_SET_BYTES, } from "../utils/_body.js";
 import { toArrayBuffer } from "../utils/_buffer.js";
 import { base64urlDecode } from "../utils/crypto.js";
 import { defaultFetch, packageDeadlineSignal, } from "../utils/_default-fetch.js";
 import { assertClockSkewSeconds } from "./_clock-skew.js";
+import { readResponseJson } from "./_response-json.js";
 const ALGORITHMS = {
     ES256: {
         kty: "EC",
@@ -210,6 +212,7 @@ export class JwksTokenReader {
     #cacheMaxAgeMs;
     #minFetchIntervalMs;
     #fetchTimeoutMs;
+    #maxResponseBytes;
     #metadataUrls;
     #Scope;
     #getClient;
@@ -224,14 +227,15 @@ export class JwksTokenReader {
      * Defaults: every Web Crypto asymmetric algorithm accepted, `at+jwt`
      * required as `typ`, `client_id` as the required client-id claim, 30
      * seconds of clock skew, a 10-minute cache with a 30-second minimum
-     * between fetches, a 5-second request deadline, {@linkcode BasicScope},
-     * and the global `fetch`.
+     * between fetches, a 5-second request deadline, a 256 KiB response cap,
+     * {@linkcode BasicScope}, and the global `fetch`.
      *
      * @throws {TypeError} If `issuer` is not an absolute URL, `audience` is
      *   empty, or `algorithms` names an algorithm this package cannot verify
      *   (a silently ignored entry would read as a policy that isn't enforced).
      * @throws {RangeError} If `clockSkewSeconds` is negative, non-finite, or
-     *   overflows when converted to milliseconds.
+     *   overflows when converted to milliseconds, or `maxResponseBytes` is not
+     *   a positive integer.
      */
     constructor(options) {
         this.#issuer = options.issuer;
@@ -255,6 +259,9 @@ export class JwksTokenReader {
         this.#cacheMaxAgeMs = options.cacheMaxAgeMs ?? 600_000;
         this.#minFetchIntervalMs = options.minFetchIntervalMs ?? 30_000;
         this.#fetchTimeoutMs = options.fetchTimeoutMs ?? 5_000;
+        this.#maxResponseBytes =
+            options.maxResponseBytes ?? DEFAULT_MAX_KEY_SET_BYTES;
+        assertMaxBodyBytes(this.#maxResponseBytes, "maxResponseBytes");
         this.#Scope =
             options.Scope ?? BasicScope;
         this.#getClient = options.getClient;
@@ -282,8 +289,10 @@ export class JwksTokenReader {
      *   invalid token, not collapsed into it. Once keys are cached, a failed
      *   refresh is absorbed and the cached keys keep serving.
      * @throws {ServerError} If, with no keys cached, the JWKS endpoint returns
-     *   a 4xx or a body that is not a JWKS, or discovery reports no `jwks_uri`
-     *   — a misconfiguration, not a verdict on the caller's token.
+     *   a 4xx or a body that is not a JWKS, either document exceeds
+     *   {@linkcode JwksTokenReaderOptions.maxResponseBytes}, or discovery
+     *   reports no `jwks_uri` — a misconfiguration, not a verdict on the
+     *   caller's token.
      */
     async getToken(accessToken) {
         const parsed = parseJws(accessToken);
@@ -499,12 +508,7 @@ export class JwksTokenReader {
                     ? new TemporarilyUnavailableError(`${label} request failed (HTTP ${response.status})`)
                     : new ServerError(`${label} request failed (HTTP ${response.status})`);
             }
-            try {
-                return await response.json();
-            }
-            catch (cause) {
-                throw new ServerError(`${label} response was not JSON`, { cause });
-            }
+            return await readResponseJson(response, this.#maxResponseBytes, label);
         }
         finally {
             clearTimeout(deadline);

package/dist/utils/_body.d.ts

@@ -1,6 +1,7 @@
 /**
- * Internal bounded request-body reader for the endpoints that parse a body
- * before they have authenticated the caller.
+ * Internal bounded body reader for the request bodies the endpoints parse
+ * before they have authenticated the caller, and for the responses the
+ * package reads from the servers it calls.
  *
  * @module
  */
@@ -17,20 +18,30 @@ export declare const DEFAULT_MAX_BODY_BYTES: number;
  * block, so any token a client could send as `Authorization: Bearer` fits.
  */
 export declare const DEFAULT_MAX_TOKEN_BODY_BYTES: number;
+/**
+ * The default cap on an introspection response: 64 KiB, the same cap the
+ * clients apply to every authorization-server response.
+ */
+export declare const DEFAULT_MAX_RESPONSE_BYTES: number;
+/**
+ * The default cap on a discovery document or JWKS: 256 KiB, room for dozens
+ * of RSA keys that each carry an X.509 certificate chain.
+ */
+export declare const DEFAULT_MAX_KEY_SET_BYTES: number;
 /**
  * Throws a `RangeError` naming `option` unless `maxBodyBytes` is a positive
  * safe integer.
  */
 export declare function assertMaxBodyBytes(maxBodyBytes: number, option: string): void;
 /**
- * Reads `request`'s body, counting bytes as they arrive, and returns `null`
- * once it exceeds `maxBytes` — cancelling the stream rather than draining it.
- * A `Content-Length` over the cap is refused without reading; one under it is
- * not trusted. Consumes the body unless `keepReadable` is set, which reads a
- * clone and leaves the original readable (a refusal cancels both). Rejects if
- * the stream errors or was already read.
+ * Reads `request`'s body — or a response's — counting bytes as they arrive,
+ * and returns `null` once it exceeds `maxBytes`, cancelling the stream rather
+ * than draining it. A `Content-Length` over the cap is refused without
+ * reading; one under it is not trusted. Consumes the body unless
+ * `keepReadable` is set, which reads a clone and leaves the original readable
+ * (a refusal cancels both). Rejects if the stream errors or was already read.
  */
-export declare function readBoundedBody(request: Request, maxBytes: number, options?: {
+export declare function readBoundedBody(request: Request | Response, maxBytes: number, options?: {
     keepReadable?: boolean;
 }): Promise<Uint8Array<ArrayBuffer> | null>;
 /**

package/dist/utils/_body.js

@@ -1,6 +1,7 @@
 /**
- * Internal bounded request-body reader for the endpoints that parse a body
- * before they have authenticated the caller.
+ * Internal bounded body reader for the request bodies the endpoints parse
+ * before they have authenticated the caller, and for the responses the
+ * package reads from the servers it calls.
  *
  * @module
  */
@@ -17,6 +18,16 @@ export const DEFAULT_MAX_BODY_BYTES = 64 * 1024;
  * block, so any token a client could send as `Authorization: Bearer` fits.
  */
 export const DEFAULT_MAX_TOKEN_BODY_BYTES = 16 * 1024;
+/**
+ * The default cap on an introspection response: 64 KiB, the same cap the
+ * clients apply to every authorization-server response.
+ */
+export const DEFAULT_MAX_RESPONSE_BYTES = 64 * 1024;
+/**
+ * The default cap on a discovery document or JWKS: 256 KiB, room for dozens
+ * of RSA keys that each carry an X.509 certificate chain.
+ */
+export const DEFAULT_MAX_KEY_SET_BYTES = 256 * 1024;
 /**
  * Throws a `RangeError` naming `option` unless `maxBodyBytes` is a positive
  * safe integer.
@@ -27,12 +38,12 @@ export function assertMaxBodyBytes(maxBodyBytes, option) {
     }
 }
 /**
- * Reads `request`'s body, counting bytes as they arrive, and returns `null`
- * once it exceeds `maxBytes` — cancelling the stream rather than draining it.
- * A `Content-Length` over the cap is refused without reading; one under it is
- * not trusted. Consumes the body unless `keepReadable` is set, which reads a
- * clone and leaves the original readable (a refusal cancels both). Rejects if
- * the stream errors or was already read.
+ * Reads `request`'s body — or a response's — counting bytes as they arrive,
+ * and returns `null` once it exceeds `maxBytes`, cancelling the stream rather
+ * than draining it. A `Content-Length` over the cap is refused without
+ * reading; one under it is not trusted. Consumes the body unless
+ * `keepReadable` is set, which reads a clone and leaves the original readable
+ * (a refusal cancels both). Rejects if the stream errors or was already read.
  */
 export async function readBoundedBody(request, maxBytes, options = {}) {
     if (!request.body)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",