@vardario/cognito-client 4.0.6 → 4.0.7

package/lib/browser.js

@@ -1111,15 +1111,17 @@ var CognitoClient = class {
    *
    * @throws {Error}
    */
-  async handleCodeFlow(returnUrl, pkce) {
+  async handleCodeFlow(returnUrl, pkce, state) {
     if (this.oAuth === void 0) {
       throw Error("You have to define oAuth options to use handleCodeFlow");
     }
     const url = new URL(returnUrl);
     const code = url.searchParams.get("code");
-    const state = url.searchParams.get("state");
-    if (code === null || state === null) {
-      throw Error("code or state parameter is missing from return url.");
+    if (code === null) {
+      throw Error("code parameter is missing from return url.");
+    }
+    if (url.searchParams.get("state") !== state) {
+      throw Error("State parameter does not match.");
     }
     const urlParams = new URLSearchParams();
     urlParams.append("grant_type", "authorization_code");

package/lib/cognito-client.d.ts

@@ -452,7 +452,7 @@ export declare class CognitoClient {
      *
      * @throws {Error}
      */
-    handleCodeFlow(returnUrl: string, pkce: string): Promise<Session>;
+    handleCodeFlow(returnUrl: string, pkce: string, state: string): Promise<Session>;
     /**
      * Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call this operation when your user signs out of your app. This results in the following behavior.
      * @param accessToken Access token of the current user.

package/lib/cognito-client.js

@@ -408,15 +408,17 @@ export class CognitoClient {
      *
      * @throws {Error}
      */
-    async handleCodeFlow(returnUrl, pkce) {
+    async handleCodeFlow(returnUrl, pkce, state) {
         if (this.oAuth === undefined) {
             throw Error('You have to define oAuth options to use handleCodeFlow');
         }
         const url = new URL(returnUrl);
         const code = url.searchParams.get('code');
-        const state = url.searchParams.get('state');
-        if (code === null || state === null) {
-            throw Error('code or state parameter is missing from return url.');
+        if (code === null) {
+            throw Error('code parameter is missing from return url.');
+        }
+        if (url.searchParams.get('state') !== state) {
+            throw Error('State parameter does not match.');
         }
         const urlParams = new URLSearchParams();
         urlParams.append('grant_type', 'authorization_code');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vardario/cognito-client",
-  "version": "4.0.6",
+  "version": "4.0.7",
   "description": "",
   "license": "MIT",
   "author": "Sahin Vardar",
@@ -27,6 +27,7 @@
   "devDependencies": {
     "@aws-sdk/client-cognito-identity-provider": "^3.465.0",
     "@types/jsdom": "^21.1.5",
+    "@types/node": "^20",
     "@typescript-eslint/eslint-plugin": "^6.11.0",
     "@typescript-eslint/parser": "^6.11.0",
     "esbuild": "^0.20.2",