@zitadel/sdk-core 1.0.0-alpha.23 → 1.0.0-alpha.24

package/dist/middleware.d.ts

@@ -28,14 +28,25 @@ export declare const INTERNAL_HEADERS: ReadonlySet<string>;
  */
 export declare function matchesRoutes(pathname: string, routes: readonly string[]): boolean;
 /**
- * Filters upstream response headers for proxying: strips hop-by-hop headers,
- * `set-cookie` (handled separately via `getSetCookie()`), and `location`
- * (prevents leaking internal upstream URLs).
+ * Filters upstream response headers for proxying: strips hop-by-hop headers
+ * and `set-cookie` (handled separately via `getSetCookie()`), and reduces
+ * `location` to a redirect that can only land on this app.
+ *
+ * `location` was stripped outright until the identity-provider callback
+ * needed it: the provider returns the browser to `/__nextgen/idp/callback`,
+ * and the engine answers `302` back to the page the sign-in started on. That
+ * is a top-level navigation with no JavaScript in the loop, so a dropped
+ * `Location` leaves the browser on an empty page. Outbound redirects to a
+ * provider do not travel this way -- they arrive as `step.redirect_url` in a
+ * JSON body and the widget navigates -- so nothing legitimate points off-origin.
  *
  * @param upstream - The upstream response headers.
+ * @param selfUrl - The app's own request URL, which is both the origin a
+ *   redirect must land on and the base a relative one resolves against.
+ *   Omitting it keeps the old behaviour of dropping every redirect.
  * @returns A new `Headers` object with filtered headers.
  */
-export declare function filterResponseHeaders(upstream: Headers): Headers;
+export declare function filterResponseHeaders(upstream: Headers, selfUrl?: string): Headers;
 /**
  * The authenticated session for a signed-in user. Identity follows the
  * user-ref vocabulary (ADR 058): render `display`, falling back to

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,MAAM,CAazC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAqC,CAAC;AAIvF;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAUlF;AAID;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAYhE;AAID;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oFAAoF;IACpF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,SAAS,GAAG;IAAE,eAAe,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3E,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG;IAAE,eAAe,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC;AAEpE,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+DAA+D;IAC/D,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,6CAA6C;IAC7C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG;IAAE,eAAe,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,WAAW,CAAC;AAE7D;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,MAAM,CAazC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAqC,CAAC;AAIvF;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAUlF;AA2CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAiBlF;AAID;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oFAAoF;IACpF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,SAAS,GAAG;IAAE,eAAe,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3E,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG;IAAE,eAAe,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC;AAEpE,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+DAA+D;IAC/D,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,6CAA6C;IAC7C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG;IAAE,eAAe,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,WAAW,CAAC;AAE7D;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC"}

package/dist/middleware.js

@@ -54,21 +54,78 @@ export function matchesRoutes(pathname, routes) {
 }
 // ─── Response header filtering ───────────────────────────────────────────────
 /**
- * Filters upstream response headers for proxying: strips hop-by-hop headers,
- * `set-cookie` (handled separately via `getSetCookie()`), and `location`
- * (prevents leaking internal upstream URLs).
+ * An upstream `Location`, pointed back at this app.
+ *
+ * Only the path, query and fragment survive; whatever origin the upstream
+ * named is discarded and the result is re-based onto the request's own URL.
+ * That keeps both properties the blanket strip was protecting -- an internal
+ * hostname can never reach the browser, and the redirect can only ever land on
+ * this app -- without needing to know what this app's public origin is.
+ *
+ * Comparing origins instead would have required that knowledge, and there is
+ * no reliable source for it: `X-Forwarded-Host` is attacker-settable on a
+ * direct request, and the request's own host is wrong behind a proxy that
+ * terminates TLS or rewrites it. Discarding the origin sidesteps the question
+ * -- a redirect to another origin becomes the same path on this one rather
+ * than being dropped, so a deployment behind such a proxy works instead of
+ * landing on a blank page.
+ *
+ * Nothing legitimate on this path points off-origin anyway: an outbound
+ * redirect to a provider travels as `step.redirect_url` in a JSON body and the
+ * widget performs it, never as a proxied header.
+ *
+ * A relative reference resolves against the path it came from (RFC 3986 §5),
+ * so `next?flow=x` answered to `/__nextgen/idp/callback` means
+ * `/__nextgen/idp/next?flow=x`. An unparseable value is the one case with
+ * nothing to forward.
+ */
+function ontoThisApp(location, selfUrl) {
+    if (selfUrl === undefined || selfUrl === "") {
+        return undefined;
+    }
+    try {
+        const base = new URL(selfUrl);
+        const target = new URL(location, base);
+        return new URL(`${target.pathname}${target.search}${target.hash}`, base).toString();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Filters upstream response headers for proxying: strips hop-by-hop headers
+ * and `set-cookie` (handled separately via `getSetCookie()`), and reduces
+ * `location` to a redirect that can only land on this app.
+ *
+ * `location` was stripped outright until the identity-provider callback
+ * needed it: the provider returns the browser to `/__nextgen/idp/callback`,
+ * and the engine answers `302` back to the page the sign-in started on. That
+ * is a top-level navigation with no JavaScript in the loop, so a dropped
+ * `Location` leaves the browser on an empty page. Outbound redirects to a
+ * provider do not travel this way -- they arrive as `step.redirect_url` in a
+ * JSON body and the widget navigates -- so nothing legitimate points off-origin.
  *
  * @param upstream - The upstream response headers.
+ * @param selfUrl - The app's own request URL, which is both the origin a
+ *   redirect must land on and the base a relative one resolves against.
+ *   Omitting it keeps the old behaviour of dropping every redirect.
  * @returns A new `Headers` object with filtered headers.
  */
-export function filterResponseHeaders(upstream) {
+export function filterResponseHeaders(upstream, selfUrl) {
     const filtered = new Headers();
     upstream.forEach((value, key) => {
-        if (!HOP_BY_HOP.has(key.toLowerCase()) &&
-            key.toLowerCase() !== "set-cookie" &&
-            key.toLowerCase() !== "location") {
-            filtered.set(key, value);
+        const name = key.toLowerCase();
+        if (HOP_BY_HOP.has(name) || name === "set-cookie") {
+            return;
+        }
+        if (name === "location") {
+            const onThisApp = ontoThisApp(value, selfUrl);
+            if (onThisApp !== undefined) {
+                filtered.set("location", onThisApp);
+            }
+            return;
         }
+        filtered.set(key, value);
     });
     return filtered;
 }