@versini/auth0-react-thin 2.22.1 → 2.23.0

package/dist/with-authentication-required.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-authentication-required.d.ts","sourceRoot":"","sources":["../src/with-authentication-required.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,aAAa,EAAa,EAAE,EAAE,MAAM,OAAO,CAAC;AAE5D,OAAqB,EACnB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,iBAAiB,CAAC;AAkBzB;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACnC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;IACxC;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC;;;;OAIG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,QAAA,MAAM,0BAA0B,GAAI,CAAC,SAAS,MAAM,EAClD,WAAW,aAAa,CAAC,CAAC,CAAC,EAC3B,UAAS,iCAAsC,KAC9C,EAAE,CAAC,CAAC,CAuCN,CAAC;AAEF,eAAe,0BAA0B,CAAC"}
+{"version":3,"file":"with-authentication-required.d.ts","sourceRoot":"","sources":["../src/with-authentication-required.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,aAAa,EAAa,EAAE,EAAE,MAAM,OAAO,CAAC;AAE5D,OAAqB,EACnB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,iBAAiB,CAAC;AAwBzB;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACnC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;IACxC;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC;;;;OAIG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,QAAA,MAAM,0BAA0B,GAAI,CAAC,SAAS,MAAM,EAClD,WAAW,aAAa,CAAC,CAAC,CAAC,EAC3B,UAAS,iCAAsC,KAC9C,EAAE,CAAC,CAAC,CAuCN,CAAC;AAEF,eAAe,0BAA0B,CAAC"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "author": "Auth0",
   "name": "@versini/auth0-react-thin",
-  "version": "2.22.1",
-  "description": "Unofficial slim fork of @auth0/auth0-react@2.22.1 — bundle-size build, not affiliated with Auth0/Okta. See @versini/auth0-thin.",
+  "version": "2.23.0",
+  "description": "Unofficial slim fork of @auth0/auth0-react@2.23.0 — bundle-size build, not affiliated with Auth0/Okta. See @versini/auth0-thin.",
   "keywords": [
     "auth0",
     "fork",
@@ -34,7 +34,7 @@
   "dependencies": {
     "@auth0/auth0-spa-js": "^2.24.1"
   },
-  "forkedFrom": "@auth0/auth0-react@2.22.1",
+  "forkedFrom": "@auth0/auth0-react@2.23.0",
   "publishConfig": {
     "access": "public"
   }

package/src/auth0-provider.tsx

@@ -168,6 +168,11 @@ const defaultOnRedirectCallback = (appState?: AppState): void => {
  * ```
  *
  * Provides the Auth0Context to its child components.
+ *
+ * The SDK is a client-only module (its published ESM and CommonJS bundles ship the
+ * `'use client'` directive), so in a Next.js App Router app you can import and render
+ * `Auth0Provider` directly from a Server Component such as `app/layout.tsx`.
+ * Components that call hooks like `useAuth0` must still be Client Components.
  */
 const Auth0Provider = <TUser extends User = User>(opts: Auth0ProviderOptions<TUser>) => {
   const {

package/src/with-authentication-required.tsx

@@ -18,8 +18,14 @@ const defaultOnBeforeAuthentication = async (): Promise<void> => {/* noop */ };
 /**
  * @ignore
  */
-const defaultReturnTo = (): string =>
-  `${window.location.pathname}${window.location.search}`;
+const defaultReturnTo = (): string => {
+  // Normalize the pathname to prevent protocol-relative open redirects.
+  // A URL like https://app.example.com//evil.com produces a pathname of
+  // //evil.com, which routers (react-router, next.js, gatsby) interpret as a
+  // protocol-relative URL and redirect the user to an external host.
+  const pathname = window.location.pathname.replace(/^\/\/+/, '/');
+  return `${pathname}${window.location.search}`;
+};
 
 /**
  * Options for the withAuthenticationRequired Higher Order Component