alexa-cookie2 5.0.3 → 5.0.5

package/LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2018-2025 Apollon77 <ingo@fischer-ka.de>
+Copyright (c) 2018-2026 Apollon77 <ingo@fischer-ka.de>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -55,6 +55,12 @@ Partly based on [Amazon Alexa Remote Control](http://blog.loetzimmer.de/2017/10/
 Thank you for that work.
 
 ## Changelog:
+### 5.0.5 (2026-07-06)
+* (@Apollon77) Fix Proxy URL when no static port is provided
+
+### 5.0.4 (2026-07-05)
+* (@fkhr79, @blabond) Fix Amazon login proxy auth flow
+
 ### 5.0.3 (2025-07-13)
 * (Apollon77) Update some version details to sync with Alexa App
 

package/alexa-cookie.js

@@ -39,6 +39,19 @@ function AlexaCookie() {
 
     let Cookie = '';
 
+    const isAmazonCookieName = name => /^(session-id|session-id-time|session-token|ubid-.+|lc-.+|x-.+|at-.+|sess-at-.+|frc|map-md|csrf|sid|csm-hit|i18n-prefs|sp-cdn|skin)$/.test(name);
+
+    const sanitizeAmazonCookie = cookie => {
+        const cookies = cookieTools.parse(cookie || '');
+        let sanitizedCookie = '';
+        for (const name of Object.keys(cookies)) {
+            if (isAmazonCookieName(name)) {
+                sanitizedCookie += `${name}=${cookies[name]}; `;
+            }
+        }
+        return sanitizedCookie.replace(/[; ]*$/, '');
+    };
+
     const addCookies = (Cookie, headers) => {
         if (!headers || !headers['set-cookie']) return Cookie;
         const cookies = cookieTools.parse(Cookie || '');
@@ -155,8 +168,7 @@ function AlexaCookie() {
                 _options.baseAmazonPageHandle = `_${amazonDomain}`;
             }
             else if (amazonDomain !== 'com') {
-                //_options.baseAmazonPageHandle = '_' + amazonDomain;
-                _options.baseAmazonPageHandle = '';
+                _options.baseAmazonPageHandle = `_${amazonDomain}`;
             }
             else {
                 _options.baseAmazonPageHandle = '';
@@ -408,6 +420,7 @@ function AlexaCookie() {
         _options.logger && _options.logger(`Handle token registration Start: ${JSON.stringify(loginData)}`);
 
         loginData.deviceAppName = _options.deviceAppName;
+        loginData.loginCookie = sanitizeAmazonCookie(loginData.loginCookie);
 
         let deviceSerial;
         if (!_options.formerRegistrationData || !_options.formerRegistrationData.deviceSerial) {
@@ -520,6 +533,7 @@ function AlexaCookie() {
             Cookie = addCookies(Cookie, response.headers);
             loginData.refreshToken = body.response.success.tokens.bearer.refresh_token;
             const accessToken = body.response.success.tokens.bearer.access_token;
+            loginData.accessToken = accessToken;
             loginData.tokenDate = Date.now();
             loginData.macDms = body.response.success.tokens.mac_dms;
 
@@ -553,22 +567,34 @@ function AlexaCookie() {
                 _options.logger && _options.logger(JSON.stringify(options));
                 request(options, (error, response, body) => {
                     if (!error) {
-                        try {
-                            if (typeof body !== 'object') body = JSON.parse(body);
-                        } catch (err) {
+                        if (!response || response.statusCode < 200 || response.statusCode >= 300 || !body) {
+                            _options.logger && _options.logger(`Get User data Response: status=${response && response.statusCode}, body=${JSON.stringify(body)}`);
+                            if (!_options.amazonPage) {
+                                callback && callback(new Error(`Could not get user data from Amazon: HTTP ${response && response.statusCode}`), null);
+                                return;
+                            }
+                            loginData.amazonPage = _options.amazonPage;
+                        } else {
+                            try {
+                                if (typeof body !== 'object') body = JSON.parse(body);
+                            } catch (err) {
+                                _options.logger && _options.logger(`Get User data Response: ${JSON.stringify(body)}`);
+                                if (!_options.amazonPage) {
+                                    callback && callback(err, null);
+                                    return;
+                                }
+                                loginData.amazonPage = _options.amazonPage;
+                            }
                             _options.logger && _options.logger(`Get User data Response: ${JSON.stringify(body)}`);
-                            callback && callback(err, null);
-                            return;
-                        }
-                        _options.logger && _options.logger(`Get User data Response: ${JSON.stringify(body)}`);
 
-                        Cookie = addCookies(Cookie, response.headers);
+                            Cookie = addCookies(Cookie, response.headers);
 
-                        if (body.marketPlaceDomainName) {
-                            const pos = body.marketPlaceDomainName.indexOf('.');
-                            if (pos !== -1) _options.amazonPage = body.marketPlaceDomainName.substr(pos + 1);
+                            if (body && body.marketPlaceDomainName) {
+                                const pos = body.marketPlaceDomainName.indexOf('.');
+                                if (pos !== -1) _options.amazonPage = body.marketPlaceDomainName.substr(pos + 1);
+                            }
+                            loginData.amazonPage = _options.amazonPage;
                         }
-                        loginData.amazonPage = _options.amazonPage;
                     } else if (error && (!_options || !_options.amazonPage)) {
                         callback && callback(error, null);
                         return;
@@ -583,6 +609,7 @@ function AlexaCookie() {
                     getLocalCookies(loginData.amazonPage, loginData.refreshToken, (err, localCookie) => {
                         if (err) {
                             callback && callback(err, null);
+                            return;
                         }
 
                         loginData.localCookie = localCookie;
@@ -593,7 +620,6 @@ function AlexaCookie() {
                             }
                             loginData.localCookie = resData.cookie;
                             loginData.csrf = resData.csrf;
-                            delete loginData.accessToken;
                             delete loginData.authorization_code;
                             delete loginData.verifier;
                             loginData.dataVersion = 2;
@@ -721,6 +747,42 @@ function AlexaCookie() {
         });
     };
 
+    const finishCookieRefresh = (loginData, callback) => {
+        _options.logger && _options.logger('Alexa-Cookie: Skip App registration during refresh and update local cookies');
+        const updateLocalCookies = () => {
+            const amazonPage = loginData.amazonPage || _options.amazonPage;
+            getLocalCookies(amazonPage, loginData.refreshToken, (err, localCookie) => {
+                if (err) {
+                    callback && callback(err, null);
+                    return;
+                }
+
+                loginData.localCookie = localCookie;
+                getCSRFFromCookies(loginData.localCookie, _options, (err, resData) => {
+                    if (err) {
+                        callback && callback(new Error(`Error getting csrf for ${amazonPage}`), null);
+                        return;
+                    }
+                    loginData.localCookie = resData.cookie;
+                    loginData.csrf = resData.csrf;
+                    loginData.amazonPage = amazonPage;
+                    loginData.tokenDate = Date.now();
+                    delete loginData.authorization_code;
+                    delete loginData.verifier;
+                    loginData.dataVersion = 2;
+                    _options.logger && _options.logger('Alexa-Cookie: Refresh finished with updated cookies and csrf');
+                    callback && callback(null, loginData);
+                });
+            });
+        };
+
+        if (loginData.accessToken) {
+            registerTokenCapabilities(loginData.accessToken, updateLocalCookies);
+            return;
+        }
+        updateLocalCookies();
+    };
+
     this.refreshAlexaCookie = (__options, callback) => {
         if (!__options || !__options.formerRegistrationData || !__options.formerRegistrationData.loginCookie || !__options.formerRegistrationData.refreshToken) {
             callback && callback(new Error('No former registration data provided for Cookie Refresh'), null);
@@ -798,6 +860,7 @@ function AlexaCookie() {
             getLocalCookies(_options.baseAmazonPage, _options.formerRegistrationData.refreshToken, (err, comCookie) => {
                 if (err) {
                     callback && callback(err, null);
+                    return;
                 }
 
                 // Restore frc and map-md
@@ -806,8 +869,8 @@ function AlexaCookie() {
                 newCookie += `map-md=${initCookies['map-md']}; `;
                 newCookie += comCookie;
 
-                _options.formerRegistrationData.loginCookie = newCookie;
-                handleTokenRegistration(_options, _options.formerRegistrationData, callback);
+                _options.formerRegistrationData.loginCookie = sanitizeAmazonCookie(newCookie);
+                finishCookieRefresh(_options.formerRegistrationData, callback);
             });
         });
     };

package/lib/proxy.js

@@ -15,6 +15,8 @@ const path = require('path');
 const crypto = require('crypto');
 
 const FORMERDATA_STORE_VERSION = 4;
+const ALEXA_APP_VERSION = '2.2.651540.0';
+const EXTRA_AMAZON_PROXY_HOSTS = ['amazon.com', 'www.amazon.com', 'alexa.amazon.com'];
 
 function addCookies(Cookie, headers) {
     if (!headers || !headers['set-cookie']) return Cookie;
@@ -34,6 +36,21 @@ function addCookies(Cookie, headers) {
     return Cookie;
 }
 
+function isAmazonCookieName(name) {
+    return /^(session-id|session-id-time|session-token|ubid-.+|lc-.+|x-.+|at-.+|sess-at-.+|frc|map-md|csrf|sid|csm-hit|i18n-prefs|sp-cdn|skin)$/.test(name);
+}
+
+function sanitizeAmazonCookie(cookie) {
+    const cookies = cookieTools.parse(cookie || '');
+    let sanitizedCookie = '';
+    for (const name of Object.keys(cookies)) {
+        if (isAmazonCookieName(name)) {
+            sanitizedCookie += `${name}=${cookies[name]}; `;
+        }
+    }
+    return sanitizedCookie.replace(/[; ]*$/, '');
+}
+
 function customStringify(v, func, intent) {
     const cache = new Map();
     return JSON.stringify(v, function (key, value) {
@@ -55,6 +72,46 @@ function customStringify(v, func, intent) {
 
 function initAmazonProxy(_options, callbackCookie, callbackListening) {
     const initialCookies = {};
+    const proxyBase = () => `http://${_options.proxyOwnIp}:${_options.proxyPort}/`;
+    const defaultAmazonHost = `www.${_options.baseAmazonPage}`;
+    const amazonProxyHosts = [];
+
+    function escapeRegex(data) {
+        return data.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    }
+
+    function addAmazonProxyHost(host) {
+        if (host && !amazonProxyHosts.includes(host)) {
+            amazonProxyHosts.push(host);
+        }
+    }
+
+    function amazonRootFromHost(host) {
+        return host.replace(/^(www|alexa)\./, '');
+    }
+
+    addAmazonProxyHost(defaultAmazonHost);
+    addAmazonProxyHost(`alexa.${_options.baseAmazonPage}`);
+    addAmazonProxyHost(_options.baseAmazonPage);
+    EXTRA_AMAZON_PROXY_HOSTS.forEach(addAmazonProxyHost);
+
+    function amazonHostFromProxyPath(url) {
+        const match = (url || '').match(/^\/([^/?#]+)(?:[/?#]|$)/);
+        if (match && amazonProxyHosts.includes(match[1])) {
+            return match[1];
+        }
+        return null;
+    }
+
+    function amazonHostFromProxyUrl(url) {
+        if (!url) return null;
+        for (const host of amazonProxyHosts) {
+            if (url === `${proxyBase()}${host}` || url.startsWith(`${proxyBase()}${host}/`)) {
+                return host;
+            }
+        }
+        return null;
+    }
 
     const formerDataStorePath = _options.formerDataStorePath || path.join(__dirname, 'formerDataStore.json');
     let formerDataStoreValid = false;
@@ -90,7 +147,7 @@ function initAmazonProxy(_options, callbackCookie, callbackListening) {
     }
 
     if (!_options.formerRegistrationData || !_options.formerRegistrationData['map-md']) {
-        initialCookies['map-md'] = Buffer.from('{"device_user_dictionary":[],"device_registration_data":{"software_version":"1"},"app_identifier":{"app_version":"2.2.485407","bundle_id":"com.amazon.echo"}}').toString('base64');
+        initialCookies['map-md'] = Buffer.from(`{"device_user_dictionary":[],"device_registration_data":{"software_version":"1"},"app_identifier":{"app_version":"${ALEXA_APP_VERSION}","bundle_id":"com.amazon.echo"}}`).toString('base64');
     }
     else {
         _options.logger && _options.logger('Proxy Init: reuse map-md from former data');
@@ -135,13 +192,31 @@ function initAmazonProxy(_options, callbackCookie, callbackListening) {
     const code_challenge = base64URLEncode(sha256(code_verifier));
 
     let proxyCookies = '';
+    let returnedInitUrl;
+
+    function buildInitialUrl() {
+        return `https://www.${_options.baseAmazonPage}/ap/signin?openid.return_to=https%3A%2F%2Fwww.${_options.baseAmazonPage}%2Fap%2Fmaplanding&openid.assoc_handle=amzn_dp_project_dee_ios${_options.baseAmazonPageHandle}&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=amzn_dp_project_dee_ios${_options.baseAmazonPageHandle}&accountStatusPolicy=P1&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns.oa2=http%3A%2F%2Fwww.${_options.baseAmazonPage}%2Fap%2Fext%2Foauth%2F2&openid.oa2.client_id=device%3A${deviceId}&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.oa2.response_type=code&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.pape.max_auth_age=0&openid.oa2.scope=device_auth_access&openid.oa2.code_challenge_method=S256&openid.oa2.code_challenge=${code_challenge}&language=${_options.amazonPageProxyLanguage}`;
+    }
+
+    function rewriteProxyPath(url, req) {
+        const urlHost = amazonHostFromProxyPath(url);
+        if (urlHost) {
+            return url.replace(new RegExp(`^/${escapeRegex(urlHost)}`), '') || '/';
+        }
+        if (req && req.headers && req.headers.host === `${_options.proxyOwnIp}:${_options.proxyPort}` && url === '/') {
+            const initialUrl = returnedInitUrl || buildInitialUrl();
+            const parsed = new URL(initialUrl);
+            return `${parsed.pathname}${parsed.search}`;
+        }
+        return url;
+    }
 
     // proxy middleware options
     const optionsAlexa = {
         target: `https://alexa.${_options.baseAmazonPage}`,
         changeOrigin: true,
         ws: false,
-        pathRewrite: {}, // enhanced below
+        pathRewrite: rewriteProxyPath,
         router: router,
         hostRewrite: true,
         followRedirects: false,
@@ -150,18 +225,15 @@ function initAmazonProxy(_options, callbackCookie, callbackListening) {
         onProxyRes: onProxyRes,
         onProxyReq: onProxyReq,
         headers: {
-            'user-agent': 'AppleWebKit PitanguiBridge/2.2.485407.0-[HARDWARE=iPhone10_4][SOFTWARE=15.5][DEVICE=iPhone]',
-            'accept-language': _options.acceptLanguage,
-            'authority': `www.${_options.baseAmazonPage}`
+            'accept-language': _options.acceptLanguage
         },
-        cookieDomainRewrite: { // enhanced below
+        cookieDomainRewrite: {
             '*': ''
+        },
+        cookiePathRewrite: {
+            '*': '/'
         }
     };
-    optionsAlexa.pathRewrite[`^/www.${_options.baseAmazonPage}`] = '';
-    optionsAlexa.pathRewrite[`^/alexa.${_options.baseAmazonPage}`] = '';
-    optionsAlexa.cookieDomainRewrite[`.${_options.baseAmazonPage}`] = _options.proxyOwnIp;
-    optionsAlexa.cookieDomainRewrite[_options.baseAmazonPage] = _options.proxyOwnIp;
     if (_options.logger) optionsAlexa.logProvider = function logProvider() {
         return {
             log: _options.logger.log || _options.logger,
@@ -171,30 +243,27 @@ function initAmazonProxy(_options, callbackCookie, callbackListening) {
             error: _options.logger.error || _options.logger
         };
     };
-    let returnedInitUrl;
 
     function router(req) {
         const url = (req.originalUrl || req.url);
         _options.logger && _options.logger(`Router: ${url} / ${req.method} / ${JSON.stringify(req.headers)}`);
         if (req.headers.host === `${_options.proxyOwnIp}:${_options.proxyPort}`) {
-            if (url.startsWith(`/www.${_options.baseAmazonPage}/`)) {
-                return `https://www.${_options.baseAmazonPage}`;
-            } else if (url.startsWith(`/alexa.${_options.baseAmazonPage}/`)) {
-                return `https://alexa.${_options.baseAmazonPage}`;
-            } else if (req.headers.referer) {
-                if (req.headers.referer.startsWith(`http://${_options.proxyOwnIp}:${_options.proxyPort}/www.${_options.baseAmazonPage}/`)) {
-                    return `https://www.${_options.baseAmazonPage}`;
-                } else if (req.headers.referer.startsWith(`http://${_options.proxyOwnIp}:${_options.proxyPort}/alexa.${_options.baseAmazonPage}/`)) {
-                    return `https://alexa.${_options.baseAmazonPage}`;
-                }
+            const urlHost = amazonHostFromProxyPath(url);
+            if (urlHost) {
+                return `https://${urlHost}`;
+            }
+            const refererHost = amazonHostFromProxyUrl(req.headers.referer);
+            if (refererHost) {
+                return `https://${refererHost}`;
             }
             if (url === '/') { // initial redirect
-                returnedInitUrl =  `https://www.${_options.baseAmazonPage}/ap/signin?openid.return_to=https%3A%2F%2Fwww.${_options.baseAmazonPage}%2Fap%2Fmaplanding&openid.assoc_handle=amzn_dp_project_dee_ios${_options.baseAmazonPageHandle}&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=amzn_dp_project_dee_ios${_options.baseAmazonPageHandle}&accountStatusPolicy=P1&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns.oa2=http%3A%2F%2Fwww.${_options.baseAmazonPage}%2Fap%2Fext%2Foauth%2F2&openid.oa2.client_id=device%3A${deviceId}&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.oa2.response_type=code&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.pape.max_auth_age=0&openid.oa2.scope=device_auth_access&openid.oa2.code_challenge_method=S256&openid.oa2.code_challenge=${code_challenge}&language=${_options.amazonPageProxyLanguage}`;
+                returnedInitUrl =  buildInitialUrl();
                 _options.logger && _options.logger(`Alexa-Cookie: Initial Page Request: ${returnedInitUrl}`);
-                return returnedInitUrl;
+                const parsedInitUrl = new URL(returnedInitUrl);
+                return `${parsedInitUrl.protocol}//${parsedInitUrl.host}`;
             }
             else {
-                return `https://www.${_options.baseAmazonPage}`;
+                return `https://${defaultAmazonHost}`;
             }
         }
         return `https://alexa.${_options.baseAmazonPage}`;
@@ -214,26 +283,43 @@ function initAmazonProxy(_options, callbackCookie, callbackListening) {
 
     function replaceHosts(data) {
         //const dataOrig = data;
-        const amazonRegex = new RegExp(`https?://www.${_options.baseAmazonPage}:?[0-9]*/`.replace(/\./g, '\\.'), 'g');
-        const alexaRegex = new RegExp(`https?://alexa.${_options.baseAmazonPage}:?[0-9]*/`.replace(/\./g, '\\.'), 'g');
         data = data.replace(///g, '/');
-        data = data.replace(amazonRegex, `http://${_options.proxyOwnIp}:${_options.proxyPort}/www.${_options.baseAmazonPage}/`);
-        data = data.replace(alexaRegex, `http://${_options.proxyOwnIp}:${_options.proxyPort}/alexa.${_options.baseAmazonPage}/`);
+        for (const host of amazonProxyHosts) {
+            const hostRegex = new RegExp(`https?://${escapeRegex(host)}:?[0-9]*/`, 'g');
+            data = data.replace(hostRegex, `${proxyBase()}${host}/`);
+        }
         //_options.logger && _options.logger('REPLACEHOSTS: ' + dataOrig + ' --> ' + data);
         return data;
     }
 
     function replaceHostsBack(data) {
-        const amazonRegex = new RegExp(`http://${_options.proxyOwnIp}:${_options.proxyPort}/www.${_options.baseAmazonPage}/`.replace(/\./g, '\\.'), 'g');
-        const alexaRegex = new RegExp(`http://${_options.proxyOwnIp}:${_options.proxyPort}/alexa.${_options.baseAmazonPage}/`.replace(/\./g, '\\.'), 'g');
-        data = data.replace(amazonRegex, `https://www.${_options.baseAmazonPage}/`);
-        data = data.replace(alexaRegex, `https://alexa.${_options.baseAmazonPage}/`);
-        if (data === `http://${_options.proxyOwnIp}:${_options.proxyPort}/`) {
+        const base = proxyBase();
+        for (const host of amazonProxyHosts) {
+            const hostRegex = new RegExp(`${escapeRegex(base)}${escapeRegex(host)}/`, 'g');
+            data = data.replace(hostRegex, `https://${host}/`);
+        }
+        if (data === base) {
             data = returnedInitUrl;
         }
+        else if (data.startsWith(base)) {
+            data = `https://${defaultAmazonHost}/${data.slice(base.length)}`;
+        }
         return data;
     }
 
+    function parseQueryParams(data) {
+        const paramStart = data && data.indexOf('?');
+        if (paramStart === -1 || paramStart === undefined) return {};
+        return querystring.parse(data.substr(paramStart + 1));
+    }
+
+    function isProxySuccessUrl(data) {
+        if (!data) return false;
+        if (data.includes('/spa/index.html')) return true;
+        if (!data.includes('/ap/maplanding?')) return false;
+        return !!parseQueryParams(data)['openid.oa2.authorization_code'];
+    }
+
     function onProxyReq(proxyReq, req/*, _res*/) {
         const url = req.originalUrl || req.url;
         if (url.endsWith('.ico') || url.endsWith('.js') || url.endsWith('.ttf') || url.endsWith('.svg') || url.endsWith('.png') || url.endsWith('.appcache')) return;
@@ -276,8 +362,8 @@ function initAmazonProxy(_options, callbackCookie, callbackListening) {
                 }
             }
             if (typeof proxyReq.getHeader === 'function' && proxyReq.getHeader('origin') !== `https://${proxyReq.getHeader('host')}`) {
-                proxyReq.setHeader('origin', `https://www.${_options.baseAmazonPage}`);
-                _options.logger && _options.logger('Alexa-Cookie: Modify headers: Delete Origin');
+                proxyReq.setHeader('origin', `https://${proxyReq.getHeader('host') || defaultAmazonHost}`);
+                _options.logger && _options.logger('Alexa-Cookie: Modify headers: Changed Origin');
                 modified = true;
             }
 
@@ -310,15 +396,17 @@ function initAmazonProxy(_options, callbackCookie, callbackListening) {
         }
         _options.logger && _options.logger(`Alexa-Cookie: Cookies handled: ${JSON.stringify(proxyCookies)}`);
 
-        if (
-            (proxyRes.socket && proxyRes.socket._host === `www.${_options.baseAmazonPage}` && proxyRes.socket.parser.outgoing && proxyRes.socket.parser.outgoing.method === 'GET' && proxyRes.socket.parser.outgoing.path.startsWith('/ap/maplanding')) ||
-            (proxyRes.socket && proxyRes.socket.parser.outgoing && proxyRes.socket.parser.outgoing.getHeader('location') && proxyRes.socket.parser.outgoing.getHeader('location').includes('/ap/maplanding?')) ||
-            (proxyRes.headers.location && (proxyRes.headers.location.includes('/ap/maplanding?') || proxyRes.headers.location.includes('/spa/index.html')))
-        ) {
+        const outgoing = proxyRes.socket && proxyRes.socket.parser && proxyRes.socket.parser.outgoing;
+        const successUrl = [
+            proxyRes.headers.location,
+            outgoing && outgoing.method === 'GET' && outgoing.path,
+            outgoing && outgoing.getHeader && outgoing.getHeader('location')
+        ].find(isProxySuccessUrl);
+
+        if (successUrl) {
             _options.logger && _options.logger('Alexa-Cookie: Proxy detected SUCCESS!!');
 
-            const paramStart = proxyRes.headers.location.indexOf('?');
-            const queryParams = querystring.parse(proxyRes.headers.location.substr(paramStart + 1));
+            const queryParams = parseQueryParams(successUrl);
 
             proxyRes.statusCode = 302;
             proxyRes.headers.location = `http://${_options.proxyOwnIp}:${_options.proxyPort}/cookie-success`;
@@ -328,7 +416,7 @@ function initAmazonProxy(_options, callbackCookie, callbackListening) {
             _options.logger && _options.logger(`Alexa-Cookie: Proxy catched parameters: ${JSON.stringify(queryParams)}`);
 
             callbackCookie && callbackCookie(null, {
-                'loginCookie': proxyCookies,
+                'loginCookie': sanitizeAmazonCookie(proxyCookies),
                 'authorization_code': queryParams['openid.oa2.authorization_code'],
                 'frc': initialCookies.frc,
                 'map-md': initialCookies['map-md'],
@@ -342,7 +430,7 @@ function initAmazonProxy(_options, callbackCookie, callbackListening) {
         if (proxyRes.headers.location) {
             _options.logger && _options.logger(`Redirect: Original Location ----> ${proxyRes.headers.location}`);
             proxyRes.headers.location = replaceHosts(proxyRes.headers.location);
-            if (reqestHost && proxyRes.headers.location.startsWith('/')) {
+            if (reqestHost && amazonProxyHosts.includes(reqestHost) && proxyRes.headers.location.startsWith('/')) {
                 proxyRes.headers.location = `http://${_options.proxyOwnIp}:${_options.proxyPort}/${reqestHost}${proxyRes.headers.location}`;
             }
             _options.logger && _options.logger(`Redirect: Final Location ----> ${proxyRes.headers.location}`);
@@ -379,7 +467,8 @@ function initAmazonProxy(_options, callbackCookie, callbackListening) {
         _options.proxyPort = undefined;
     }
     const server = app.listen(_options.proxyPort, _options.proxyListenBind, function() {
-        _options.logger && _options.logger(`Alexa-Cookie: Proxy-Server listening on port ${server.address().port}`);
+        _options.proxyPort = this.address().port;
+        _options.logger && _options.logger(`Alexa-Cookie: Proxy-Server listening on port ${_options.proxyPort}`);
         callbackListening && callbackListening(server);
         callbackListening = null;
     }).on('error', err => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alexa-cookie2",
-  "version": "5.0.3",
+  "version": "5.0.5",
   "description": "Generate Cookie and CSRF for Alexa Remote",
   "author": {
     "name": "Apollon77",
@@ -22,15 +22,15 @@
   ],
   "dependencies": {
     "cookie": "^0.6.0",
-    "express": "^4.21.2",
-    "http-proxy-middleware": "^2.0.9",
+    "express": "^4.22.2",
+    "http-proxy-middleware": "^2.0.10",
     "http-proxy-response-rewrite": "^0.0.1",
     "https": "^1.0.0",
     "querystring": "^0.2.1"
   },
   "devDependencies": {
-    "@alcalzone/release-script": "^3.8.0",
-    "@alcalzone/release-script-plugin-license": "^3.7.0",
+    "@alcalzone/release-script": "^5.2.1",
+    "@alcalzone/release-script-plugin-license": "^5.2.0",
     "eslint": "^8.57.1"
   },
   "repository": {

package/test/base-amazon-page-handle.test.js

@@ -0,0 +1,123 @@
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const vm = require('vm');
+
+const testName = 'base-amazon-page-handle';
+const outputDir = process.env.ALEXA_COOKIE_TEST_OUTPUT_DIR || path.join(__dirname, '..', 'test-output');
+const outputFile = path.join(outputDir, `${testName}.txt`);
+const lines = [];
+
+function line(value = '') {
+    lines.push(value);
+}
+
+function writeOutput() {
+    fs.mkdirSync(outputDir, { recursive: true });
+    fs.writeFileSync(outputFile, `${lines.join('\n')}\n`);
+}
+
+function recordAssertion(description, fn) {
+    try {
+        fn();
+        line(`${description}: PASS`);
+    } catch (err) {
+        line(`${description}: FAIL`);
+        writeOutput();
+        throw err;
+    }
+}
+
+const cookieFile = path.join(__dirname, '..', 'alexa-cookie.js');
+const source = fs.readFileSync(cookieFile, 'utf8');
+
+let capturedProxyOptions;
+
+function loadCookieModule() {
+    capturedProxyOptions = undefined;
+    const module = { exports: {} };
+    const sandbox = {
+        __dirname: path.dirname(cookieFile),
+        console,
+        module,
+        exports: module.exports,
+        require(name) {
+            if (name === './lib/proxy.js') {
+                return {
+                    initAmazonProxy(options, _callbackCookie, callbackListening) {
+                        capturedProxyOptions = options;
+                        callbackListening && callbackListening({
+                            address: () => ({ port: options.proxyPort || 3456 }),
+                            close: (callback) => callback && callback()
+                        });
+                    }
+                };
+            }
+            if (name === 'cookie') {
+                return { parse: () => ({}) };
+            }
+            return require(name);
+        }
+    };
+    vm.runInNewContext(source, sandbox, { filename: cookieFile });
+    return module.exports;
+}
+
+function runProxyOnlyConfig(baseAmazonPage) {
+    const cookieModule = loadCookieModule();
+    const input = {
+        proxyOwnIp: '127.0.0.1',
+        proxyPort: 3456,
+        baseAmazonPage,
+        amazonPage: baseAmazonPage,
+        logger: () => {}
+    };
+    cookieModule.generateAlexaCookie('', '', input, () => {});
+    return { input, output: capturedProxyOptions };
+}
+
+try {
+    const de = runProxyOnlyConfig('amazon.de');
+    const uk = runProxyOnlyConfig('amazon.co.uk');
+    const com = runProxyOnlyConfig('amazon.com');
+
+    line('TEST: base Amazon page handle');
+    line('');
+    line('CODE UNDER TEST:');
+    line('- alexa-cookie.js: generateAlexaCookie option initialization');
+    line('- option passed to lib/proxy.js: baseAmazonPageHandle');
+    line('');
+    line('INPUT:');
+    line(`DE baseAmazonPage: ${de.input.baseAmazonPage}`);
+    line(`DE amazonPage: ${de.input.amazonPage}`);
+    line(`UK baseAmazonPage: ${uk.input.baseAmazonPage}`);
+    line(`UK amazonPage: ${uk.input.amazonPage}`);
+    line(`COM baseAmazonPage: ${com.input.baseAmazonPage}`);
+    line(`COM amazonPage: ${com.input.amazonPage}`);
+    line('');
+    line('OBSERVED:');
+    line(`DE baseAmazonPageHandle: ${de.output.baseAmazonPageHandle}`);
+    line(`UK baseAmazonPageHandle: ${uk.output.baseAmazonPageHandle}`);
+    line(`COM baseAmazonPageHandle: ${com.output.baseAmazonPageHandle}`);
+    line('');
+    line('ASSERTIONS:');
+    recordAssertion('DE baseAmazonPageHandle === "_de"', () => {
+        assert.strictEqual(de.output.baseAmazonPageHandle, '_de');
+    });
+    recordAssertion('UK baseAmazonPageHandle === "_uk"', () => {
+        assert.strictEqual(uk.output.baseAmazonPageHandle, '_uk');
+    });
+    recordAssertion('COM baseAmazonPageHandle === ""', () => {
+        assert.strictEqual(com.output.baseAmazonPageHandle, '');
+    });
+    line('');
+    line('RESULT: PASS');
+    writeOutput();
+} catch (err) {
+    if (!lines.includes('RESULT: PASS')) {
+        line('');
+        line('RESULT: FAIL');
+        writeOutput();
+    }
+    throw err;
+}