@wbce-d9/api 10.3.0 → 10.3.1

package/dist/auth/drivers/ldap.js

@@ -1,9 +1,10 @@
 import { Router } from 'express';
 import Joi from 'joi';
 import ldap from 'ldapjs';
-import { GET_SET_HEADER } from '../../constants.js';
+import { ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
 import getDatabase from '../../database/index.js';
 import emitter from '../../emitter.js';
+import env from '../../env.js';
 import { RecordNotUniqueException } from '../../exceptions/database/record-not-unique.js';
 import { InvalidConfigException, InvalidCredentialsException, InvalidPayloadException, InvalidProviderException, ServiceUnavailableException, UnexpectedResponseException, } from '../../exceptions/index.js';
 import logger from '../../logger.js';
@@ -314,7 +315,8 @@ export function createLDAPAuthRouter(provider) {
             payload['data']['refresh_token'] = refreshToken;
         }
         if (mode === 'cookie') {
-            res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
+            res?.cookie(env['ACCESS_TOKEN_COOKIE_NAME'], accessToken, ACCESS_COOKIE_OPTIONS);
+            res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, REFRESH_COOKIE_OPTIONS);
         }
         res.locals['payload'] = payload;
         return next();

package/dist/auth/drivers/local.js

@@ -2,7 +2,7 @@ import argon2 from 'argon2';
 import { Router } from 'express';
 import Joi from 'joi';
 import { performance } from 'perf_hooks';
-import { GET_SET_HEADER } from '../../constants.js';
+import { ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
 import env from '../../env.js';
 import { InvalidCredentialsException, InvalidPayloadException } from '../../exceptions/index.js';
 import { respond } from '../../middleware/respond.js';
@@ -74,7 +74,8 @@ export function createLocalAuthRouter(provider) {
             payload['data']['refresh_token'] = refreshToken;
         }
         if (mode === 'cookie') {
-            res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
+            res?.cookie(env['ACCESS_TOKEN_COOKIE_NAME'], accessToken, ACCESS_COOKIE_OPTIONS);
+            res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, REFRESH_COOKIE_OPTIONS);
         }
         res.locals['payload'] = payload;
         return next();

package/dist/auth/drivers/oauth2.js

@@ -2,11 +2,11 @@ import { BaseException } from '@wbce-d9/exceptions';
 import express, { Router } from 'express';
 import flatten from 'flat';
 import jwt from 'jsonwebtoken';
-import { generators, Issuer } from 'openid-client';
+import { Issuer, generators } from 'openid-client';
 import { getAuthProvider } from '../../auth.js';
-import { GET_SET_HEADER } from '../../constants.js';
+import { ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
 import env from '../../env.js';
-import { InvalidConfigException, InvalidCredentialsException, InvalidTokenException } from '../../exceptions/index.js';
+import { InvalidConfigException, InvalidCredentialsException, InvalidTokenException, InvalidPayloadException, } from '../../exceptions/index.js';
 import logger from '../../logger.js';
 import { respond } from '../../middleware/respond.js';
 import { AuthenticationService } from '../../services/authentication.js';
@@ -16,6 +16,7 @@ import { getConfigFromEnv } from '../../utils/get-config-from-env.js';
 import { getIPFromReq } from '../../utils/get-ip-from-req.js';
 import { Url } from '../../utils/url.js';
 import { BaseOAuthDriver } from './baseoauth.js';
+import { isRedirectAllowedOnLogin } from '../../utils/is-redirect-allowed-on-login.js';
 export class OAuth2AuthDriver extends BaseOAuthDriver {
     client;
     redirectUrl;
@@ -118,7 +119,11 @@ export function createOAuth2AuthRouter(providerName) {
         const provider = getAuthProvider(providerName);
         const codeVerifier = provider.generateCodeVerifier();
         const prompt = !!req.query['prompt'];
-        const token = jwt.sign({ verifier: codeVerifier, redirect: req.query['redirect'], prompt }, env['SECRET'], {
+        const redirect = req.query['redirect'];
+        if (isRedirectAllowedOnLogin(redirect, providerName) === false) {
+            throw new InvalidPayloadException(`URL "${redirect}" can't be used to redirect after login`);
+        }
+        const token = jwt.sign({ verifier: codeVerifier, redirect, prompt }, env['SECRET'], {
             expiresIn: '5m',
             issuer: 'directus',
         });
@@ -186,7 +191,8 @@ export function createOAuth2AuthRouter(providerName) {
         }
         const { accessToken, refreshToken, expires } = authResponse;
         if (redirect) {
-            res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
+            res?.cookie(env['ACCESS_TOKEN_COOKIE_NAME'], accessToken, ACCESS_COOKIE_OPTIONS);
+            res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, REFRESH_COOKIE_OPTIONS);
             return res.redirect(redirect);
         }
         res.locals['payload'] = {

package/dist/auth/drivers/openid.js

@@ -2,11 +2,11 @@ import { BaseException } from '@wbce-d9/exceptions';
 import express, { Router } from 'express';
 import flatten from 'flat';
 import jwt from 'jsonwebtoken';
-import { generators, Issuer } from 'openid-client';
+import { Issuer, generators } from 'openid-client';
 import { getAuthProvider } from '../../auth.js';
-import { GET_SET_HEADER } from '../../constants.js';
+import { ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
 import env from '../../env.js';
-import { InvalidConfigException, InvalidCredentialsException, InvalidTokenException } from '../../exceptions/index.js';
+import { InvalidConfigException, InvalidCredentialsException, InvalidTokenException, InvalidPayloadException, } from '../../exceptions/index.js';
 import logger from '../../logger.js';
 import { respond } from '../../middleware/respond.js';
 import { AuthenticationService } from '../../services/authentication.js';
@@ -15,6 +15,7 @@ import asyncHandler from '../../utils/async-handler.js';
 import { getConfigFromEnv } from '../../utils/get-config-from-env.js';
 import { getIPFromReq } from '../../utils/get-ip-from-req.js';
 import { Url } from '../../utils/url.js';
+import { isRedirectAllowedOnLogin } from '../../utils/is-redirect-allowed-on-login.js';
 import { BaseOAuthDriver } from './baseoauth.js';
 export class OpenIDAuthDriver extends BaseOAuthDriver {
     client;
@@ -138,7 +139,11 @@ export function createOpenIDAuthRouter(providerName) {
         const provider = getAuthProvider(providerName);
         const codeVerifier = provider.generateCodeVerifier();
         const prompt = !!req.query['prompt'];
-        const token = jwt.sign({ verifier: codeVerifier, redirect: req.query['redirect'], prompt }, env['SECRET'], {
+        const redirect = req.query['redirect'];
+        if (isRedirectAllowedOnLogin(redirect, providerName) === false) {
+            throw new InvalidPayloadException(`URL "${redirect}" can't be used to redirect after login`);
+        }
+        const token = jwt.sign({ verifier: codeVerifier, redirect, prompt }, env['SECRET'], {
             expiresIn: '5m',
             issuer: 'directus',
         });
@@ -211,7 +216,8 @@ export function createOpenIDAuthRouter(providerName) {
         }
         const { accessToken, refreshToken, expires } = authResponse;
         if (redirect) {
-            res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
+            res?.cookie(env['ACCESS_TOKEN_COOKIE_NAME'], accessToken, ACCESS_COOKIE_OPTIONS);
+            res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, REFRESH_COOKIE_OPTIONS);
             return res.redirect(redirect);
         }
         res.locals['payload'] = {

package/dist/auth/drivers/saml.js

@@ -3,18 +3,19 @@ import { BaseException } from '@wbce-d9/exceptions';
 import express, { Router } from 'express';
 import * as samlify from 'samlify';
 import { getAuthProvider } from '../../auth.js';
-import { COOKIE_OPTIONS, GET_SET_HEADER } from '../../constants.js';
+import { ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS } from '../../constants.js';
 import getDatabase from '../../database/index.js';
 import emitter from '../../emitter.js';
 import env from '../../env.js';
 import { RecordNotUniqueException } from '../../exceptions/database/record-not-unique.js';
-import { InvalidCredentialsException, InvalidProviderException } from '../../exceptions/index.js';
+import { InvalidCredentialsException, InvalidProviderException, InvalidPayloadException, } from '../../exceptions/index.js';
 import logger from '../../logger.js';
 import { respond } from '../../middleware/respond.js';
 import { AuthenticationService } from '../../services/authentication.js';
 import { UsersService } from '../../services/users.js';
 import asyncHandler from '../../utils/async-handler.js';
 import { getConfigFromEnv } from '../../utils/get-config-from-env.js';
+import { isRedirectAllowedOnLogin } from '../../utils/is-redirect-allowed-on-login.js';
 import { LocalAuthDriver } from './local.js';
 // Register the samlify schema validator
 samlify.setSchemaValidator(validator);
@@ -89,7 +90,11 @@ export function createSAMLAuthRouter(providerName) {
         const { context: url } = sp.createLoginRequest(idp, 'redirect');
         const parsedUrl = new URL(url);
         if (req.query['redirect']) {
-            parsedUrl.searchParams.append('RelayState', req.query['redirect']);
+            const redirect = req.query['redirect'];
+            if (isRedirectAllowedOnLogin(redirect, providerName) === false) {
+                throw new InvalidPayloadException(`URL "${redirect}" can't be used to redirect after login`);
+            }
+            parsedUrl.searchParams.append('RelayState', redirect);
         }
         return res.redirect(parsedUrl.toString());
     }));
@@ -97,11 +102,14 @@ export function createSAMLAuthRouter(providerName) {
         const { sp, idp } = getAuthProvider(providerName);
         const { context } = sp.createLogoutRequest(idp, 'redirect', req.body);
         const authService = new AuthenticationService({ accountability: req.accountability, schema: req.schema });
+        if (req.cookies[env['ACCESS_TOKEN_COOKIE_NAME']]) {
+            res.clearCookie(env['ACCESS_TOKEN_COOKIE_NAME'], ACCESS_COOKIE_OPTIONS);
+        }
         if (req.cookies[env['REFRESH_TOKEN_COOKIE_NAME']]) {
             const currentRefreshToken = req.cookies[env['REFRESH_TOKEN_COOKIE_NAME']];
             if (currentRefreshToken) {
                 await authService.logout(currentRefreshToken);
-                res.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], COOKIE_OPTIONS);
+                res.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], REFRESH_COOKIE_OPTIONS);
             }
         }
         return res.redirect(context);
@@ -121,7 +129,8 @@ export function createSAMLAuthRouter(providerName) {
                 },
             };
             if (relayState) {
-                res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
+                res?.cookie(env['ACCESS_TOKEN_COOKIE_NAME'], accessToken, ACCESS_COOKIE_OPTIONS);
+                res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, REFRESH_COOKIE_OPTIONS);
                 return res.redirect(relayState);
             }
             return next();

package/dist/cli/utils/create-env/env-stub.liquid

@@ -199,6 +199,18 @@ STORAGE_LOCAL_ROOT="./uploads"
 # The duration that the access token is valid ["15m"]
 ACCESS_TOKEN_TTL="15m"
 
+# Whether or not to set the secure attribute for the access token cookie [false]
+ACCESS_TOKEN_COOKIE_SECURE=false
+
+# Value of sameSite for the access token cookie ["lax"]
+ACCESS_TOKEN_COOKIE_SAME_SITE="lax"
+
+# Name of the access token cookie ["directus_refresh_token"]
+ACCESS_TOKEN_COOKIE_NAME="directus_session_token"
+
+# Which domain to use for the access token cookie. Useful for development mode.
+# ACCESS_TOKEN_COOKIE_DOMAIN
+
 # The duration that the refresh token is valid, and also how long users stay logged-in to the App ["7d"]
 REFRESH_TOKEN_TTL="7d"
 

package/dist/constants.d.ts

@@ -8,8 +8,9 @@ export declare const DEFAULT_AUTH_PROVIDER = "default";
 export declare const COLUMN_TRANSFORMS: string[];
 export declare const GENERATE_SPECIAL: string[];
 export declare const UUID_REGEX = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
-export declare const COOKIE_OPTIONS: CookieOptions;
+export declare const REFRESH_COOKIE_OPTIONS: CookieOptions;
 export declare const GET_SET_HEADER: (cookieValue: string) => string;
+export declare const ACCESS_COOKIE_OPTIONS: CookieOptions;
 export declare const OAS_REQUIRED_SCHEMAS: string[];
 /** Formats from which transformation is supported */
 export declare const SUPPORTED_IMAGE_TRANSFORM_FORMATS: string[];

package/dist/constants.js

@@ -48,19 +48,28 @@ export const DEFAULT_AUTH_PROVIDER = 'default';
 export const COLUMN_TRANSFORMS = ['year', 'month', 'day', 'weekday', 'hour', 'minute', 'second'];
 export const GENERATE_SPECIAL = ['uuid', 'date-created', 'role-created', 'user-created'];
 export const UUID_REGEX = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}';
-export const COOKIE_OPTIONS = {
+export const REFRESH_COOKIE_OPTIONS = {
     httpOnly: true,
     domain: env['REFRESH_TOKEN_COOKIE_DOMAIN'],
     maxAge: getMilliseconds(env['REFRESH_TOKEN_TTL']),
     secure: env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false,
     sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
+    path: '/auth',
 };
 export const GET_SET_HEADER = (cookieValue) => {
     const domainHeader = env['REFRESH_TOKEN_COOKIE_DOMAIN'] ? ` Domain=${env['REFRESH_TOKEN_COOKIE_DOMAIN']};` : '';
     const partitionedHeader = env['REFRESH_TOKEN_COOKIE_PARTITIONED'] == true ? ' Partitioned;' : '';
-    const cookieHeaderValue = `${env['REFRESH_TOKEN_COOKIE_NAME']}=${cookieValue}; HttpOnly; Max-Age=${getMilliseconds(env['REFRESH_TOKEN_TTL'])}; Secure=${env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false}; SameSite=${env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict'}; Path=/;${domainHeader}${partitionedHeader}`;
+    const cookieHeaderValue = `${env['REFRESH_TOKEN_COOKIE_NAME']}=${cookieValue}; HttpOnly; Max-Age=${getMilliseconds(env['REFRESH_TOKEN_TTL'])}; Secure=${env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false}; SameSite=${env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict'}; Path=/auth;${domainHeader}${partitionedHeader}`;
     return cookieHeaderValue;
 };
+export const ACCESS_COOKIE_OPTIONS = {
+    httpOnly: true,
+    domain: env['ACCESS_TOKEN_COOKIE_DOMAIN'],
+    maxAge: getMilliseconds(env['ACCESS_TOKEN_TTL']),
+    secure: env['ACCESS_TOKEN_COOKIE_SECURE'] ?? false,
+    sameSite: env['ACCESS_TOKEN_COOKIE_SAME_SITE'] || 'strict',
+    path: '/',
+};
 export const OAS_REQUIRED_SCHEMAS = ['Diff', 'Schema', 'Query', 'x-metadata'];
 /** Formats from which transformation is supported */
 export const SUPPORTED_IMAGE_TRANSFORM_FORMATS = ['image/jpeg', 'image/png', 'image/webp', 'image/tiff', 'image/avif'];

package/dist/controllers/auth.js

@@ -1,6 +1,6 @@
 import { Router } from 'express';
 import { createLDAPAuthRouter, createLocalAuthRouter, createOAuth2AuthRouter, createOpenIDAuthRouter, createSAMLAuthRouter, } from '../auth/drivers/index.js';
-import { DEFAULT_AUTH_PROVIDER, GET_SET_HEADER } from '../constants.js';
+import { ACCESS_COOKIE_OPTIONS, DEFAULT_AUTH_PROVIDER, REFRESH_COOKIE_OPTIONS } from '../constants.js';
 import env from '../env.js';
 import { InvalidPayloadException } from '../exceptions/index.js';
 import logger from '../logger.js';
@@ -68,7 +68,8 @@ router.post('/refresh', asyncHandler(async (req, res, next) => {
         payload['data']['refresh_token'] = refreshToken;
     }
     if (mode === 'cookie') {
-        res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
+        res?.cookie(env['ACCESS_TOKEN_COOKIE_NAME'], accessToken, ACCESS_COOKIE_OPTIONS);
+        res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, REFRESH_COOKIE_OPTIONS);
     }
     res.locals['payload'] = payload;
     return next();
@@ -93,13 +94,11 @@ router.post('/logout', asyncHandler(async (req, res, next) => {
         throw new InvalidPayloadException(`"refresh_token" is required in either the JSON payload or Cookie`);
     }
     await authenticationService.logout(currentRefreshToken);
+    if (req.cookies[env['ACCESS_TOKEN_COOKIE_NAME']]) {
+        res.clearCookie(env['ACCESS_TOKEN_COOKIE_NAME'], ACCESS_COOKIE_OPTIONS);
+    }
     if (req.cookies[env['REFRESH_TOKEN_COOKIE_NAME']]) {
-        res.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], {
-            httpOnly: true,
-            domain: env['REFRESH_TOKEN_COOKIE_DOMAIN'],
-            secure: env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false,
-            sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
-        });
+        res.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], REFRESH_COOKIE_OPTIONS);
     }
     return next();
 }), respond);

package/dist/controllers/shares.js

@@ -1,6 +1,7 @@
 import express from 'express';
 import Joi from 'joi';
-import { GET_SET_HEADER, UUID_REGEX } from '../constants.js';
+import { ACCESS_COOKIE_OPTIONS, REFRESH_COOKIE_OPTIONS, UUID_REGEX } from '../constants.js';
+import env from '../env.js';
 import { ForbiddenException, InvalidPayloadException } from '../exceptions/index.js';
 import { respond } from '../middleware/respond.js';
 import useCollection from '../middleware/use-collection.js';
@@ -24,7 +25,8 @@ router.post('/auth', asyncHandler(async (req, res, next) => {
         throw new InvalidPayloadException(error.message);
     }
     const { accessToken, refreshToken, expires } = await service.login(req.body);
-    res.setHeader('Set-Cookie', GET_SET_HEADER(refreshToken));
+    res?.cookie(env['ACCESS_TOKEN_COOKIE_NAME'], accessToken, ACCESS_COOKIE_OPTIONS);
+    res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], refreshToken, REFRESH_COOKIE_OPTIONS);
     res.locals['payload'] = { data: { access_token: accessToken, expires } };
     return next();
 }), respond);

package/dist/env.js

@@ -34,6 +34,10 @@ const allowedEnvironmentVars = [
     'KEY',
     'SECRET',
     'ACCESS_TOKEN_TTL',
+    'ACCESS_TOKEN_COOKIE_DOMAIN',
+    'ACCESS_TOKEN_COOKIE_SECURE',
+    'ACCESS_TOKEN_COOKIE_SAME_SITE',
+    'ACCESS_TOKEN_COOKIE_NAME',
     'REFRESH_TOKEN_TTL',
     'REFRESH_TOKEN_COOKIE_DOMAIN',
     'REFRESH_TOKEN_COOKIE_SECURE',
@@ -143,6 +147,7 @@ const allowedEnvironmentVars = [
     'AUTH_.+_GROUP_SCOPE',
     'AUTH_.+_IDP.+',
     'AUTH_.+_SP.+',
+    'AUTH_.+_REDIRECT_ALLOW_LIST',
     // extensions
     'PACKAGE_FILE_LOCATION',
     'EXTENSIONS_PATH',
@@ -211,6 +216,9 @@ const defaults = {
     RATE_LIMITER_GLOBAL_DURATION: 1,
     RATE_LIMITER_GLOBAL_STORE: 'memory',
     ACCESS_TOKEN_TTL: '15m',
+    ACCESS_TOKEN_COOKIE_SECURE: false,
+    ACCESS_TOKEN_COOKIE_SAME_SITE: 'lax',
+    ACCESS_TOKEN_COOKIE_NAME: 'directus_access_token',
     REFRESH_TOKEN_TTL: '7d',
     REFRESH_TOKEN_COOKIE_SECURE: false,
     REFRESH_TOKEN_COOKIE_SAME_SITE: 'lax',

package/dist/middleware/extract-token.d.ts

@@ -3,6 +3,7 @@
  *
  * Authorization: Bearer
  * access_token query parameter
+ * Access token cookie
  *
  * and store in req.token
  */

package/dist/middleware/extract-token.js

@@ -3,9 +3,11 @@
  *
  * Authorization: Bearer
  * access_token query parameter
+ * Access token cookie
  *
  * and store in req.token
  */
+import env from '../env.js';
 const extractToken = (req, _res, next) => {
     let token = null;
     if (req.query && req.query['access_token']) {
@@ -17,6 +19,12 @@ const extractToken = (req, _res, next) => {
             token = parts[1];
         }
     }
+    /**
+     * Check if there is an access token stored in the cookies
+     */
+    if (req?.cookies?.[env['ACCESS_TOKEN_COOKIE_NAME']]) {
+        token = req.cookies[env['ACCESS_TOKEN_COOKIE_NAME']];
+    }
     /**
      * @TODO
      * Look into RFC6750 compliance:

package/dist/services/graphql/index.js

@@ -5,14 +5,13 @@ import { GraphQLBoolean, GraphQLEnumType, GraphQLError, GraphQLFloat, GraphQLID,
 import { GraphQLJSON, InputTypeComposer, ObjectTypeComposer, SchemaComposer, toInputObjectType } from 'graphql-compose';
 import { flatten, get, mapKeys, merge, omit, pick, set, transform, uniq } from 'lodash-es';
 import { clearSystemCache, getCache } from '../../cache.js';
-import { DEFAULT_AUTH_PROVIDER, GENERATE_SPECIAL } from '../../constants.js';
+import { ACCESS_COOKIE_OPTIONS, DEFAULT_AUTH_PROVIDER, GENERATE_SPECIAL, REFRESH_COOKIE_OPTIONS, } from '../../constants.js';
 import getDatabase from '../../database/index.js';
 import env from '../../env.js';
 import { ForbiddenException, GraphQLValidationException, InvalidPayloadException } from '../../exceptions/index.js';
 import { getExtensionManager } from '../../extensions.js';
 import { generateHash } from '../../utils/generate-hash.js';
 import { getGraphQLType } from '../../utils/get-graphql-type.js';
-import { getMilliseconds } from '../../utils/get-milliseconds.js';
 import { reduceSchema } from '../../utils/reduce-schema.js';
 import { sanitizeQuery } from '../../utils/sanitize-query.js';
 import { validateQuery } from '../../utils/validate-query.js';
@@ -1696,13 +1695,8 @@ export class GraphQLService {
                     });
                     const result = await authenticationService.login(DEFAULT_AUTH_PROVIDER, args, args?.otp);
                     if (args['mode'] === 'cookie') {
-                        res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], result['refreshToken'], {
-                            httpOnly: true,
-                            domain: env['REFRESH_TOKEN_COOKIE_DOMAIN'],
-                            maxAge: getMilliseconds(env['REFRESH_TOKEN_TTL']),
-                            secure: env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false,
-                            sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
-                        });
+                        res?.cookie(env['ACCESS_TOKEN_COOKIE_NAME'], result['accessToken'], ACCESS_COOKIE_OPTIONS);
+                        res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], result['refreshToken'], REFRESH_COOKIE_OPTIONS);
                     }
                     return {
                         access_token: result['accessToken'],
@@ -1737,13 +1731,8 @@ export class GraphQLService {
                     }
                     const result = await authenticationService.refresh(currentRefreshToken);
                     if (args['mode'] === 'cookie') {
-                        res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], result['refreshToken'], {
-                            httpOnly: true,
-                            domain: env['REFRESH_TOKEN_COOKIE_DOMAIN'],
-                            maxAge: getMilliseconds(env['REFRESH_TOKEN_TTL']),
-                            secure: env['REFRESH_TOKEN_COOKIE_SECURE'] ?? false,
-                            sameSite: env['REFRESH_TOKEN_COOKIE_SAME_SITE'] || 'strict',
-                        });
+                        res?.cookie(env['ACCESS_TOKEN_COOKIE_NAME'], result['accessToken'], ACCESS_COOKIE_OPTIONS);
+                        res?.cookie(env['REFRESH_TOKEN_COOKIE_NAME'], result['refreshToken'], REFRESH_COOKIE_OPTIONS);
                     }
                     return {
                         access_token: result['accessToken'],
@@ -1757,7 +1746,7 @@ export class GraphQLService {
                 args: {
                     refresh_token: GraphQLString,
                 },
-                resolve: async (_, args, { req }) => {
+                resolve: async (_, args, { req, res }) => {
                     const accountability = { role: null };
                     if (req?.ip)
                         accountability.ip = req.ip;
@@ -1776,6 +1765,12 @@ export class GraphQLService {
                         throw new InvalidPayloadException(`"refresh_token" is required in either the JSON payload or Cookie`);
                     }
                     await authenticationService.logout(currentRefreshToken);
+                    if (req?.cookies?.[env['ACCESS_TOKEN_COOKIE_NAME']]) {
+                        res?.clearCookie(env['ACCESS_TOKEN_COOKIE_NAME'], ACCESS_COOKIE_OPTIONS);
+                    }
+                    if (req?.cookies?.[env['REFRESH_TOKEN_COOKIE_NAME']]) {
+                        res?.clearCookie(env['REFRESH_TOKEN_COOKIE_NAME'], REFRESH_COOKIE_OPTIONS);
+                    }
                     return true;
                 },
             },

package/dist/utils/is-redirect-allowed-on-login.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Checks if the defined redirect after successful SSO login is in the allow list
+ */
+export declare function isRedirectAllowedOnLogin(redirect: unknown, provider: string): boolean;

package/dist/utils/is-redirect-allowed-on-login.js

@@ -0,0 +1,42 @@
+import { toArray } from '@wbce-d9/utils';
+import env from '../env.js';
+import isUrlAllowed from './is-url-allowed.js';
+function isUrlValid(string) {
+    try {
+        new URL(string);
+        return true;
+    }
+    catch (err) {
+        return false;
+    }
+}
+/**
+ * Checks if the defined redirect after successful SSO login is in the allow list
+ */
+export function isRedirectAllowedOnLogin(redirect, provider) {
+    if (!redirect)
+        return true; // empty redirect
+    if (typeof redirect !== 'string')
+        return false; // invalid type
+    const publicUrl = env['PUBLIC_URL'];
+    if (!isUrlValid(redirect)) {
+        if (!redirect.startsWith('//')) {
+            // should be a relative path like `/admin/test`
+            return true;
+        }
+        // domain without protocol `//example.com/test`
+        return false;
+    }
+    const { protocol: redirectProtocol, hostname: redirectDomain } = new URL(redirect);
+    const envKey = `AUTH_${provider.toUpperCase()}_REDIRECT_ALLOW_LIST`;
+    if (envKey in env) {
+        if (isUrlAllowed(redirect, [...toArray(env[envKey]), publicUrl]))
+            return true;
+    }
+    if (!isUrlValid(publicUrl)) {
+        return false;
+    }
+    // allow redirects to the defined PUBLIC_URL
+    const { protocol: publicProtocol, hostname: publicDomain } = new URL(publicUrl);
+    return `${redirectProtocol}//${redirectDomain}` === `${publicProtocol}//${publicDomain}`;
+}

package/dist/utils/is-redirect-allowed-on-login.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/is-url-allowed.d.ts

@@ -1,4 +1,4 @@
 /**
- * Check if url matches allow list either exactly or by domain+path
+ * Check if url matches allow list either exactly or by origin+pathname
  */
 export default function isUrlAllowed(url: string, allowList: string | string[]): boolean;

package/dist/utils/is-url-allowed.js

@@ -2,7 +2,7 @@ import { toArray } from '@wbce-d9/utils';
 import logger from '../logger.js';
 import { URL } from 'url';
 /**
- * Check if url matches allow list either exactly or by domain+path
+ * Check if url matches allow list either exactly or by origin+pathname
  */
 export default function isUrlAllowed(url, allowList) {
     const urlAllowList = toArray(allowList);
@@ -11,8 +11,8 @@ export default function isUrlAllowed(url, allowList) {
     const parsedWhitelist = urlAllowList
         .map((allowedURL) => {
         try {
-            const { hostname, pathname } = new URL(allowedURL);
-            return hostname + pathname;
+            const { origin, pathname } = new URL(allowedURL);
+            return origin + pathname;
         }
         catch {
             logger.warn(`Invalid URL used "${url}"`);
@@ -21,8 +21,8 @@ export default function isUrlAllowed(url, allowList) {
     })
         .filter((f) => f);
     try {
-        const { hostname, pathname } = new URL(url);
-        return parsedWhitelist.includes(hostname + pathname);
+        const { origin, pathname } = new URL(url);
+        return parsedWhitelist.includes(origin + pathname);
     }
     catch {
         return false;

package/dist/utils/is-url-allowed.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "10.3.0",
+  "version": "10.3.1",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -72,7 +72,7 @@
     "@wbce-d9/format-title": "10.0.0",
     "argon2": "0.30.3",
     "async": "3.2.4",
-    "axios": "1.3.6",
+    "axios": "^1.7.2",
     "busboy": "1.6.0",
     "bytes": "3.1.2",
     "camelcase": "7.0.1",
@@ -143,20 +143,20 @@
     "uuid-validate": "0.0.3",
     "vm2": "^3.9.19",
     "wellknown": "0.5.0",
-    "@wbce-d9/app": "9.29.0",
-    "@wbce-d9/constants": "9.26.3",
-    "@wbce-d9/exceptions": "9.26.3",
-    "@wbce-d9/extensions-sdk": "9.26.5",
-    "@wbce-d9/schema": "9.26.3",
-    "@wbce-d9/storage-driver-azure": "9.26.5",
-    "@wbce-d9/specs": "9.26.3",
-    "@wbce-d9/storage": "9.26.3",
-    "@wbce-d9/storage-driver-cloudinary": "9.26.5",
-    "@wbce-d9/storage-driver-gcs": "9.26.5",
-    "@wbce-d9/storage-driver-s3": "9.26.7",
-    "@wbce-d9/update-check": "9.26.3",
-    "@wbce-d9/utils": "9.28.0",
-    "@wbce-d9/storage-driver-local": "9.26.5"
+    "@wbce-d9/app": "9.29.1",
+    "@wbce-d9/constants": "9.26.4",
+    "@wbce-d9/extensions-sdk": "9.26.6",
+    "@wbce-d9/specs": "9.26.4",
+    "@wbce-d9/exceptions": "9.26.4",
+    "@wbce-d9/storage": "9.26.4",
+    "@wbce-d9/schema": "9.26.4",
+    "@wbce-d9/storage-driver-azure": "9.26.6",
+    "@wbce-d9/storage-driver-cloudinary": "9.26.6",
+    "@wbce-d9/storage-driver-gcs": "9.26.6",
+    "@wbce-d9/storage-driver-local": "9.26.6",
+    "@wbce-d9/storage-driver-s3": "9.26.8",
+    "@wbce-d9/update-check": "9.26.4",
+    "@wbce-d9/utils": "9.28.1"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
@@ -204,7 +204,7 @@
     "supertest": "6.3.3",
     "typescript": "5.0.4",
     "vitest": "0.30.1",
-    "@wbce-d9/types": "9.26.3"
+    "@wbce-d9/types": "9.26.4"
   },
   "optionalDependencies": {
     "@keyv/redis": "2.5.7",