authscape 1.0.766 → 1.0.768

package/index.js

@@ -76,19 +76,30 @@ function _arrayWithHoles(r) { if (Array.isArray(r)) return r; }
 function asyncGeneratorStep(n, t, e, r, o, a, c) { try { var i = n[a](c), u = i.value; } catch (n) { return void e(n); } i.done ? t(u) : Promise.resolve(u).then(r, o); }
 function _asyncToGenerator(n) { return function () { var t = this, e = arguments; return new Promise(function (r, o) { var a = n.apply(t, e); function _next(n) { asyncGeneratorStep(a, r, o, _next, _throw, "next", n); } function _throw(n) { asyncGeneratorStep(a, r, o, _next, _throw, "throw", n); } _next(void 0); }); }; } // Re-export toast and transitions so pages can import from authscape
 // ============================================================================
-// Cookie utility function
+// Auth Redirect Circuit Breaker
 // ============================================================================
-var setCookie = function setCookie(name, value) {
-  var options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
-  return new Promise(function (resolve) {
-    var cookieString = "".concat(name, "=").concat(value, ";");
-    if (options.maxAge) cookieString += "max-age=".concat(options.maxAge, ";");
-    if (options.path) cookieString += "path=".concat(options.path, ";");
-    if (options.domain) cookieString += "domain=".concat(options.domain, ";");
-    if (options.secure) cookieString += "secure;";
-    document.cookie = cookieString;
-    resolve();
-  });
+var AUTH_REDIRECT_KEY = 'authscape_redirect_count';
+var AUTH_REDIRECT_TS_KEY = 'authscape_redirect_ts';
+var AUTH_MAX_REDIRECTS = 3;
+var AUTH_REDIRECT_WINDOW_MS = 30000; // 30 seconds
+
+var checkAndIncrementRedirect = function checkAndIncrementRedirect() {
+  if (typeof window === 'undefined') return false;
+  var now = Date.now();
+  var storedTs = parseInt(sessionStorage.getItem(AUTH_REDIRECT_TS_KEY) || '0', 10);
+  var count = parseInt(sessionStorage.getItem(AUTH_REDIRECT_KEY) || '0', 10);
+  if (now - storedTs > AUTH_REDIRECT_WINDOW_MS) {
+    count = 0;
+    sessionStorage.setItem(AUTH_REDIRECT_TS_KEY, String(now));
+  }
+  count += 1;
+  sessionStorage.setItem(AUTH_REDIRECT_KEY, String(count));
+  return count <= AUTH_MAX_REDIRECTS;
+};
+var resetRedirectCounter = function resetRedirectCounter() {
+  if (typeof window === 'undefined') return;
+  sessionStorage.removeItem(AUTH_REDIRECT_KEY);
+  sessionStorage.removeItem(AUTH_REDIRECT_TS_KEY);
 };
 
 // ============================================================================
@@ -758,6 +769,7 @@ function AuthScapeApp(_ref10) {
   var queryCodeUsed = (0, _react.useRef)(null);
   var ga4React = (0, _react.useRef)(null);
   var errorTrackingInitializedRef = (0, _react.useRef)(false);
+  var loginRedirectPending = (0, _react.useRef)(false);
   var searchParams = (0, _navigation.useSearchParams)();
   var queryCode = (_searchParams$get = searchParams === null || searchParams === void 0 ? void 0 : searchParams.get("code")) !== null && _searchParams$get !== void 0 ? _searchParams$get : null;
   var pathname = (0, _navigation.usePathname)();
@@ -783,13 +795,14 @@ function AuthScapeApp(_ref10) {
             setIsSigningIn(true);
             codeVerifier = window.localStorage.getItem("verifier");
             if (!(!codeFromQuery || !codeVerifier)) {
-              _context8.next = 11;
+              _context8.next = 12;
               break;
             }
             window.localStorage.clear();
-            module.exports.authService().login();
+            setIsSigningIn(false);
+            setFrontEndLoadedState(true);
             return _context8.abrupt("return");
-          case 11:
+          case 12:
             headers = {
               "Content-Type": "application/x-www-form-urlencoded"
             };
@@ -801,56 +814,51 @@ function AuthScapeApp(_ref10) {
               client_secret: process.env.client_secret,
               code_verifier: codeVerifier
             });
-            _context8.prev = 13;
-            _context8.next = 16;
+            _context8.prev = 14;
+            _context8.next = 17;
             return _axios["default"].post(process.env.authorityUri + "/connect/token", body, {
               headers: headers
             });
-          case 16:
+          case 17:
             response = _context8.sent;
             domainHost = window.location.hostname.split(".").slice(-2).join(".");
             window.localStorage.removeItem("verifier");
-            _context8.next = 21;
-            return setCookie("access_token", response.data.access_token, {
-              maxAge: 60 * 60 * 24 * 365,
+            _jsCookie["default"].set("access_token", response.data.access_token, {
+              expires: 365,
               path: "/",
               domain: domainHost,
               secure: true
             });
-          case 21:
-            _context8.next = 23;
-            return setCookie("expires_in", response.data.expires_in, {
-              maxAge: 60 * 60 * 24 * 365,
+            _jsCookie["default"].set("expires_in", String(response.data.expires_in), {
+              expires: 365,
               path: "/",
               domain: domainHost,
               secure: true
             });
-          case 23:
-            _context8.next = 25;
-            return setCookie("refresh_token", response.data.refresh_token, {
-              maxAge: 60 * 60 * 24 * 365,
+            _jsCookie["default"].set("refresh_token", response.data.refresh_token, {
+              expires: 365,
               path: "/",
               domain: domainHost,
               secure: true
             });
-          case 25:
+            resetRedirectCounter();
             redirectUri = window.localStorage.getItem("redirectUri") || "/";
             window.localStorage.clear();
             window.location.href = redirectUri;
-            _context8.next = 36;
+            _context8.next = 35;
             break;
-          case 30:
-            _context8.prev = 30;
-            _context8.t0 = _context8["catch"](13);
+          case 29:
+            _context8.prev = 29;
+            _context8.t0 = _context8["catch"](14);
             console.error("PKCE sign-in failed", _context8.t0);
             window.localStorage.clear();
             setIsSigningIn(false);
-            module.exports.authService().login();
-          case 36:
+            setFrontEndLoadedState(true);
+          case 35:
           case "end":
             return _context8.stop();
         }
-      }, _callee8, null, [[13, 30]]);
+      }, _callee8, null, [[14, 29]]);
     }));
     return function signInValidator(_x4) {
       return _ref11.apply(this, arguments);
@@ -961,7 +969,12 @@ function AuthScapeApp(_ref10) {
     };
   }, [frontEndLoadedState, pageProps.googleAnalytics4Code, pageProps.microsoftClarityCode]);
   (0, _react.useEffect)(function () {
-    if (enforceLoggedIn && pathname !== "/signin-oidc" && frontEndLoadedState && !signedInUserState) {
+    if (enforceLoggedIn && pathname !== "/signin-oidc" && frontEndLoadedState && !signedInUserState && !loginRedirectPending.current) {
+      if (!checkAndIncrementRedirect()) {
+        console.warn('[AuthScape] Auth redirect loop detected — halting redirects.');
+        return;
+      }
+      loginRedirectPending.current = true;
       module.exports.authService().login();
     }
   }, [signedInUserState, enforceLoggedIn, frontEndLoadedState, pathname]);
@@ -9599,19 +9612,6 @@ function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e
 function _regeneratorRuntime() { "use strict"; /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */ _regeneratorRuntime = function _regeneratorRuntime() { return e; }; var t, e = {}, r = Object.prototype, n = r.hasOwnProperty, o = Object.defineProperty || function (t, e, r) { t[e] = r.value; }, i = "function" == typeof Symbol ? Symbol : {}, a = i.iterator || "@@iterator", c = i.asyncIterator || "@@asyncIterator", u = i.toStringTag || "@@toStringTag"; function define(t, e, r) { return Object.defineProperty(t, e, { value: r, enumerable: !0, configurable: !0, writable: !0 }), t[e]; } try { define({}, ""); } catch (t) { define = function define(t, e, r) { return t[e] = r; }; } function wrap(t, e, r, n) { var i = e && e.prototype instanceof Generator ? e : Generator, a = Object.create(i.prototype), c = new Context(n || []); return o(a, "_invoke", { value: makeInvokeMethod(t, r, c) }), a; } function tryCatch(t, e, r) { try { return { type: "normal", arg: t.call(e, r) }; } catch (t) { return { type: "throw", arg: t }; } } e.wrap = wrap; var h = "suspendedStart", l = "suspendedYield", f = "executing", s = "completed", y = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} var p = {}; define(p, a, function () { return this; }); var d = Object.getPrototypeOf, v = d && d(d(values([]))); v && v !== r && n.call(v, a) && (p = v); var g = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(p); function defineIteratorMethods(t) { ["next", "throw", "return"].forEach(function (e) { define(t, e, function (t) { return this._invoke(e, t); }); }); } function AsyncIterator(t, e) { function invoke(r, o, i, a) { var c = tryCatch(t[r], t, o); if ("throw" !== c.type) { var u = c.arg, h = u.value; return h && "object" == _typeof(h) && n.call(h, "__await") ? e.resolve(h.__await).then(function (t) { invoke("next", t, i, a); }, function (t) { invoke("throw", t, i, a); }) : e.resolve(h).then(function (t) { u.value = t, i(u); }, function (t) { return invoke("throw", t, i, a); }); } a(c.arg); } var r; o(this, "_invoke", { value: function value(t, n) { function callInvokeWithMethodAndArg() { return new e(function (e, r) { invoke(t, n, e, r); }); } return r = r ? r.then(callInvokeWithMethodAndArg, callInvokeWithMethodAndArg) : callInvokeWithMethodAndArg(); } }); } function makeInvokeMethod(e, r, n) { var o = h; return function (i, a) { if (o === f) throw Error("Generator is already running"); if (o === s) { if ("throw" === i) throw a; return { value: t, done: !0 }; } for (n.method = i, n.arg = a;;) { var c = n.delegate; if (c) { var u = maybeInvokeDelegate(c, n); if (u) { if (u === y) continue; return u; } } if ("next" === n.method) n.sent = n._sent = n.arg;else if ("throw" === n.method) { if (o === h) throw o = s, n.arg; n.dispatchException(n.arg); } else "return" === n.method && n.abrupt("return", n.arg); o = f; var p = tryCatch(e, r, n); if ("normal" === p.type) { if (o = n.done ? s : l, p.arg === y) continue; return { value: p.arg, done: n.done }; } "throw" === p.type && (o = s, n.method = "throw", n.arg = p.arg); } }; } function maybeInvokeDelegate(e, r) { var n = r.method, o = e.iterator[n]; if (o === t) return r.delegate = null, "throw" === n && e.iterator["return"] && (r.method = "return", r.arg = t, maybeInvokeDelegate(e, r), "throw" === r.method) || "return" !== n && (r.method = "throw", r.arg = new TypeError("The iterator does not provide a '" + n + "' method")), y; var i = tryCatch(o, e.iterator, r.arg); if ("throw" === i.type) return r.method = "throw", r.arg = i.arg, r.delegate = null, y; var a = i.arg; return a ? a.done ? (r[e.resultName] = a.value, r.next = e.nextLoc, "return" !== r.method && (r.method = "next", r.arg = t), r.delegate = null, y) : a : (r.method = "throw", r.arg = new TypeError("iterator result is not an object"), r.delegate = null, y); } function pushTryEntry(t) { var e = { tryLoc: t[0] }; 1 in t && (e.catchLoc = t[1]), 2 in t && (e.finallyLoc = t[2], e.afterLoc = t[3]), this.tryEntries.push(e); } function resetTryEntry(t) { var e = t.completion || {}; e.type = "normal", delete e.arg, t.completion = e; } function Context(t) { this.tryEntries = [{ tryLoc: "root" }], t.forEach(pushTryEntry, this), this.reset(!0); } function values(e) { if (e || "" === e) { var r = e[a]; if (r) return r.call(e); if ("function" == typeof e.next) return e; if (!isNaN(e.length)) { var o = -1, i = function next() { for (; ++o < e.length;) if (n.call(e, o)) return next.value = e[o], next.done = !1, next; return next.value = t, next.done = !0, next; }; return i.next = i; } } throw new TypeError(_typeof(e) + " is not iterable"); } return GeneratorFunction.prototype = GeneratorFunctionPrototype, o(g, "constructor", { value: GeneratorFunctionPrototype, configurable: !0 }), o(GeneratorFunctionPrototype, "constructor", { value: GeneratorFunction, configurable: !0 }), GeneratorFunction.displayName = define(GeneratorFunctionPrototype, u, "GeneratorFunction"), e.isGeneratorFunction = function (t) { var e = "function" == typeof t && t.constructor; return !!e && (e === GeneratorFunction || "GeneratorFunction" === (e.displayName || e.name)); }, e.mark = function (t) { return Object.setPrototypeOf ? Object.setPrototypeOf(t, GeneratorFunctionPrototype) : (t.__proto__ = GeneratorFunctionPrototype, define(t, u, "GeneratorFunction")), t.prototype = Object.create(g), t; }, e.awrap = function (t) { return { __await: t }; }, defineIteratorMethods(AsyncIterator.prototype), define(AsyncIterator.prototype, c, function () { return this; }), e.AsyncIterator = AsyncIterator, e.async = function (t, r, n, o, i) { void 0 === i && (i = Promise); var a = new AsyncIterator(wrap(t, r, n, o), i); return e.isGeneratorFunction(r) ? a : a.next().then(function (t) { return t.done ? t.value : a.next(); }); }, defineIteratorMethods(g), define(g, u, "Generator"), define(g, a, function () { return this; }), define(g, "toString", function () { return "[object Generator]"; }), e.keys = function (t) { var e = Object(t), r = []; for (var n in e) r.push(n); return r.reverse(), function next() { for (; r.length;) { var t = r.pop(); if (t in e) return next.value = t, next.done = !1, next; } return next.done = !0, next; }; }, e.values = values, Context.prototype = { constructor: Context, reset: function reset(e) { if (this.prev = 0, this.next = 0, this.sent = this._sent = t, this.done = !1, this.delegate = null, this.method = "next", this.arg = t, this.tryEntries.forEach(resetTryEntry), !e) for (var r in this) "t" === r.charAt(0) && n.call(this, r) && !isNaN(+r.slice(1)) && (this[r] = t); }, stop: function stop() { this.done = !0; var t = this.tryEntries[0].completion; if ("throw" === t.type) throw t.arg; return this.rval; }, dispatchException: function dispatchException(e) { if (this.done) throw e; var r = this; function handle(n, o) { return a.type = "throw", a.arg = e, r.next = n, o && (r.method = "next", r.arg = t), !!o; } for (var o = this.tryEntries.length - 1; o >= 0; --o) { var i = this.tryEntries[o], a = i.completion; if ("root" === i.tryLoc) return handle("end"); if (i.tryLoc <= this.prev) { var c = n.call(i, "catchLoc"), u = n.call(i, "finallyLoc"); if (c && u) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } else if (c) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); } else { if (!u) throw Error("try statement without catch or finally"); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } } } }, abrupt: function abrupt(t, e) { for (var r = this.tryEntries.length - 1; r >= 0; --r) { var o = this.tryEntries[r]; if (o.tryLoc <= this.prev && n.call(o, "finallyLoc") && this.prev < o.finallyLoc) { var i = o; break; } } i && ("break" === t || "continue" === t) && i.tryLoc <= e && e <= i.finallyLoc && (i = null); var a = i ? i.completion : {}; return a.type = t, a.arg = e, i ? (this.method = "next", this.next = i.finallyLoc, y) : this.complete(a); }, complete: function complete(t, e) { if ("throw" === t.type) throw t.arg; return "break" === t.type || "continue" === t.type ? this.next = t.arg : "return" === t.type ? (this.rval = this.arg = t.arg, this.method = "return", this.next = "end") : "normal" === t.type && e && (this.next = e), y; }, finish: function finish(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.finallyLoc === t) return this.complete(r.completion, r.afterLoc), resetTryEntry(r), y; } }, "catch": function _catch(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.tryLoc === t) { var n = r.completion; if ("throw" === n.type) { var o = n.arg; resetTryEntry(r); } return o; } } throw Error("illegal catch attempt"); }, delegateYield: function delegateYield(e, r, n) { return this.delegate = { iterator: values(e), resultName: r, nextLoc: n }, "next" === this.method && (this.arg = t), y; } }, e; }
 function asyncGeneratorStep(n, t, e, r, o, a, c) { try { var i = n[a](c), u = i.value; } catch (n) { return void e(n); } i.done ? t(u) : Promise.resolve(u).then(r, o); }
 function _asyncToGenerator(n) { return function () { var t = this, e = arguments; return new Promise(function (r, o) { var a = n.apply(t, e); function _next(n) { asyncGeneratorStep(a, r, o, _next, _throw, "next", n); } function _throw(n) { asyncGeneratorStep(a, r, o, _next, _throw, "throw", n); } _next(void 0); }); }; }
-// Cookie utility function
-var setCookie = function setCookie(name, value) {
-  var options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
-  return new Promise(function (resolve) {
-    var cookieString = "".concat(name, "=").concat(value, ";");
-    if (options.maxAge) cookieString += "max-age=".concat(options.maxAge, ";");
-    if (options.path) cookieString += "path=".concat(options.path, ";");
-    if (options.domain) cookieString += "domain=".concat(options.domain, ";");
-    if (options.secure) cookieString += "secure;";
-    document.cookie = cookieString;
-    resolve();
-  });
-};
 var setupDefaultOptions = /*#__PURE__*/function () {
   var _ref = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime().mark(function _callee() {
     var ctx,
@@ -9658,9 +9658,16 @@ var RefreshToken = /*#__PURE__*/function () {
     return _regeneratorRuntime().wrap(function _callee2$(_context2) {
       while (1) switch (_context2.prev = _context2.next) {
         case 0:
+          _context2.prev = 0;
           accessToken = _jsCookie["default"].get('access_token') || '';
           refreshToken = _jsCookie["default"].get('refresh_token') || '';
-          _context2.next = 4;
+          if (refreshToken) {
+            _context2.next = 5;
+            break;
+          }
+          return _context2.abrupt("return", false);
+        case 5:
+          _context2.next = 7;
           return instance.post(process.env.authorityUri + "/connect/token", _queryString["default"].stringify({
             grant_type: 'refresh_token',
             client_id: process.env.client_id,
@@ -9672,42 +9679,44 @@ var RefreshToken = /*#__PURE__*/function () {
               "Authorization": "Bearer " + accessToken
             }
           });
-        case 4:
+        case 7:
           response = _context2.sent;
           if (!(response != null && response.status == 200)) {
-            _context2.next = 14;
+            _context2.next = 15;
             break;
           }
           domainHost = window.location.hostname.split('.').slice(-2).join('.');
           originalRequest.headers['Authorization'] = 'Bearer ' + response.data.access_token;
-          _context2.next = 10;
-          return setCookie('access_token', response.data.access_token, {
-            maxAge: 60 * 60 * 24 * 365,
+          _jsCookie["default"].set('access_token', response.data.access_token, {
+            expires: 365,
             path: '/',
             domain: domainHost,
             secure: true
           });
-        case 10:
-          _context2.next = 12;
-          return setCookie('expires_in', response.data.expires_in, {
-            maxAge: 60 * 60 * 24 * 365,
+          _jsCookie["default"].set('expires_in', String(response.data.expires_in), {
+            expires: 365,
             path: '/',
             domain: domainHost,
             secure: true
           });
-        case 12:
-          _context2.next = 14;
-          return setCookie('refresh_token', response.data.refresh_token, {
-            maxAge: 60 * 60 * 24 * 365,
+          _jsCookie["default"].set('refresh_token', response.data.refresh_token, {
+            expires: 365,
             path: '/',
             domain: domainHost,
             secure: true
           });
-        case 14:
+          return _context2.abrupt("return", true);
+        case 15:
+          return _context2.abrupt("return", false);
+        case 18:
+          _context2.prev = 18;
+          _context2.t0 = _context2["catch"](0);
+          return _context2.abrupt("return", false);
+        case 21:
         case "end":
           return _context2.stop();
       }
-    }, _callee2);
+    }, _callee2, null, [[0, 18]]);
   }));
   return function RefreshToken(_x, _x2) {
     return _ref2.apply(this, arguments);
@@ -9728,48 +9737,58 @@ var apiService = exports.apiService = function apiService() {
     return response;
   }, /*#__PURE__*/function () {
     var _ref3 = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime().mark(function _callee3(error) {
-      var originalConfig, domainHost;
+      var originalConfig, refreshed, domainHost;
       return _regeneratorRuntime().wrap(function _callee3$(_context3) {
         while (1) switch (_context3.prev = _context3.next) {
           case 0:
             originalConfig = error.config;
             if (!error.response) {
-              _context3.next = 10;
+              _context3.next = 13;
               break;
             }
             if (!(error.response.status === 401 && !originalConfig._retry)) {
-              _context3.next = 7;
+              _context3.next = 10;
               break;
             }
             originalConfig._retry = true;
             _context3.next = 6;
             return RefreshToken(originalConfig, instance);
           case 6:
+            refreshed = _context3.sent;
+            if (!refreshed) {
+              _context3.next = 9;
+              break;
+            }
             return _context3.abrupt("return", instance.request(originalConfig));
-          case 7:
+          case 9:
+            return _context3.abrupt("return", Promise.reject(error));
+          case 10:
             if (!(error.response.status === 400)) {
-              _context3.next = 10;
+              _context3.next = 13;
               break;
             }
             if (error.response.config.url.includes("/connect/token")) {
               domainHost = window.location.hostname.split('.').slice(-2).join('.');
               _jsCookie["default"].remove('access_token', {
                 path: '/',
-                domain: domainHost
+                domain: domainHost,
+                secure: true
               });
               _jsCookie["default"].remove('refresh_token', {
                 path: '/',
-                domain: domainHost
+                domain: domainHost,
+                secure: true
               });
               _jsCookie["default"].remove('expires_in', {
                 path: '/',
-                domain: domainHost
+                domain: domainHost,
+                secure: true
               });
             }
             return _context3.abrupt("return", Promise.reject(error));
-          case 10:
+          case 13:
             return _context3.abrupt("return", Promise.reject(error));
-          case 11:
+          case 14:
           case "end":
             return _context3.stop();
         }
@@ -10318,15 +10337,18 @@ var _authService = exports.authService = function authService() {
               AuthUri = process.env.authorityUri;
               _jsCookie["default"].remove('access_token', {
                 path: '/',
-                domain: domainHost
+                domain: domainHost,
+                secure: true
               });
               _jsCookie["default"].remove('refresh_token', {
                 path: '/',
-                domain: domainHost
+                domain: domainHost,
+                secure: true
               });
               _jsCookie["default"].remove('expires_in', {
                 path: '/',
-                domain: domainHost
+                domain: domainHost,
+                secure: true
               });
 
               // destroyCookie({}, "access_token", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "authscape",
-  "version": "1.0.766",
+  "version": "1.0.768",
   "description": "",
   "main": "index.js",
   "files": [

package/src/components/AuthScapeApp.js

@@ -17,18 +17,33 @@ import { HubConnectionBuilder, LogLevel, HttpTransportType } from '@microsoft/si
 import Cookies from 'js-cookie';
 
 // ============================================================================
-// Cookie utility function
+// Auth Redirect Circuit Breaker
 // ============================================================================
-const setCookie = (name, value, options = {}) => {
-  return new Promise((resolve) => {
-    let cookieString = `${name}=${value};`;
-    if (options.maxAge) cookieString += `max-age=${options.maxAge};`;
-    if (options.path) cookieString += `path=${options.path};`;
-    if (options.domain) cookieString += `domain=${options.domain};`;
-    if (options.secure) cookieString += `secure;`;
-    document.cookie = cookieString;
-    resolve();
-  });
+const AUTH_REDIRECT_KEY = 'authscape_redirect_count';
+const AUTH_REDIRECT_TS_KEY = 'authscape_redirect_ts';
+const AUTH_MAX_REDIRECTS = 3;
+const AUTH_REDIRECT_WINDOW_MS = 30000; // 30 seconds
+
+const checkAndIncrementRedirect = () => {
+  if (typeof window === 'undefined') return false;
+  const now = Date.now();
+  const storedTs = parseInt(sessionStorage.getItem(AUTH_REDIRECT_TS_KEY) || '0', 10);
+  let count = parseInt(sessionStorage.getItem(AUTH_REDIRECT_KEY) || '0', 10);
+
+  if (now - storedTs > AUTH_REDIRECT_WINDOW_MS) {
+    count = 0;
+    sessionStorage.setItem(AUTH_REDIRECT_TS_KEY, String(now));
+  }
+
+  count += 1;
+  sessionStorage.setItem(AUTH_REDIRECT_KEY, String(count));
+  return count <= AUTH_MAX_REDIRECTS;
+};
+
+const resetRedirectCounter = () => {
+  if (typeof window === 'undefined') return;
+  sessionStorage.removeItem(AUTH_REDIRECT_KEY);
+  sessionStorage.removeItem(AUTH_REDIRECT_TS_KEY);
 };
 
 // ============================================================================
@@ -484,6 +499,7 @@ export function AuthScapeApp({
   const queryCodeUsed = useRef(null);
   const ga4React = useRef(null);
   const errorTrackingInitializedRef = useRef(false);
+  const loginRedirectPending = useRef(false);
 
   const searchParams = useSearchParams();
   const queryCode = searchParams?.get("code") ?? null;
@@ -500,7 +516,8 @@ export function AuthScapeApp({
     const codeVerifier = window.localStorage.getItem("verifier");
     if (!codeFromQuery || !codeVerifier) {
       window.localStorage.clear();
-      module.exports.authService().login();
+      setIsSigningIn(false);
+      setFrontEndLoadedState(true);
       return;
     }
 
@@ -526,25 +543,27 @@ export function AuthScapeApp({
 
       window.localStorage.removeItem("verifier");
 
-      await setCookie("access_token", response.data.access_token, {
-        maxAge: 60 * 60 * 24 * 365,
+      Cookies.set("access_token", response.data.access_token, {
+        expires: 365,
         path: "/",
         domain: domainHost,
         secure: true,
       });
-      await setCookie("expires_in", response.data.expires_in, {
-        maxAge: 60 * 60 * 24 * 365,
+      Cookies.set("expires_in", String(response.data.expires_in), {
+        expires: 365,
         path: "/",
         domain: domainHost,
         secure: true,
       });
-      await setCookie("refresh_token", response.data.refresh_token, {
-        maxAge: 60 * 60 * 24 * 365,
+      Cookies.set("refresh_token", response.data.refresh_token, {
+        expires: 365,
         path: "/",
         domain: domainHost,
         secure: true,
       });
 
+      resetRedirectCounter();
+
       const redirectUri = window.localStorage.getItem("redirectUri") || "/";
       window.localStorage.clear();
 
@@ -553,7 +572,7 @@ export function AuthScapeApp({
       console.error("PKCE sign-in failed", exp);
       window.localStorage.clear();
       setIsSigningIn(false);
-      module.exports.authService().login();
+      setFrontEndLoadedState(true);
     }
   };
 
@@ -653,8 +672,14 @@ export function AuthScapeApp({
       enforceLoggedIn &&
       pathname !== "/signin-oidc" &&
       frontEndLoadedState &&
-      !signedInUserState
+      !signedInUserState &&
+      !loginRedirectPending.current
     ) {
+      if (!checkAndIncrementRedirect()) {
+        console.warn('[AuthScape] Auth redirect loop detected — halting redirects.');
+        return;
+      }
+      loginRedirectPending.current = true;
       module.exports.authService().login();
     }
   }, [signedInUserState, enforceLoggedIn, frontEndLoadedState, pathname]);

package/src/services/apiService.js

@@ -3,19 +3,6 @@ import querystring from 'query-string';
 import fileDownload from 'js-file-download';
 import Cookies from 'js-cookie';
 
-// Cookie utility function
-const setCookie = (name, value, options = {}) => {
-  return new Promise((resolve) => {
-    let cookieString = `${name}=${value};`;
-    if (options.maxAge) cookieString += `max-age=${options.maxAge};`;
-    if (options.path) cookieString += `path=${options.path};`;
-    if (options.domain) cookieString += `domain=${options.domain};`;
-    if (options.secure) cookieString += `secure;`;
-    document.cookie = cookieString;
-    resolve();
-  });
-};
-
 const setupDefaultOptions = async (ctx = null) => {
     let defaultOptions = {};
     if (ctx == null) {
@@ -42,46 +29,58 @@ const setupDefaultOptions = async (ctx = null) => {
 }
 
 const RefreshToken = async (originalRequest, instance) => {
-    let accessToken = Cookies.get('access_token') || '';
-    let refreshToken = Cookies.get('refresh_token') || '';
-
-    let response = await instance.post(process.env.authorityUri + "/connect/token",
-        querystring.stringify({
-            grant_type: 'refresh_token',
-            client_id: process.env.client_id,
-            client_secret: process.env.client_secret,
-            refresh_token: refreshToken
-        }), {
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded",
-            "Authorization": "Bearer " + accessToken
-        }
-    });
+    try {
+        let accessToken = Cookies.get('access_token') || '';
+        let refreshToken = Cookies.get('refresh_token') || '';
 
-    if (response != null && response.status == 200) {
-        let domainHost = window.location.hostname.split('.').slice(-2).join('.');
-        originalRequest.headers['Authorization'] = 'Bearer ' + response.data.access_token;
+        if (!refreshToken) {
+            return false;
+        }
 
-        await setCookie('access_token', response.data.access_token, {
-            maxAge: 60 * 60 * 24 * 365,
-            path: '/',
-            domain: domainHost,
-            secure: true
+        let response = await instance.post(process.env.authorityUri + "/connect/token",
+            querystring.stringify({
+                grant_type: 'refresh_token',
+                client_id: process.env.client_id,
+                client_secret: process.env.client_secret,
+                refresh_token: refreshToken
+            }), {
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                "Authorization": "Bearer " + accessToken
+            }
         });
 
-        await setCookie('expires_in', response.data.expires_in, {
-            maxAge: 60 * 60 * 24 * 365,
-            path: '/',
-            domain: domainHost,
-            secure: true
-        });
+        if (response != null && response.status == 200) {
+            let domainHost = window.location.hostname.split('.').slice(-2).join('.');
+            originalRequest.headers['Authorization'] = 'Bearer ' + response.data.access_token;
+
+            Cookies.set('access_token', response.data.access_token, {
+                expires: 365,
+                path: '/',
+                domain: domainHost,
+                secure: true
+            });
+
+            Cookies.set('expires_in', String(response.data.expires_in), {
+                expires: 365,
+                path: '/',
+                domain: domainHost,
+                secure: true
+            });
+
+            Cookies.set('refresh_token', response.data.refresh_token, {
+                expires: 365,
+                path: '/',
+                domain: domainHost,
+                secure: true
+            });
+
+            return true;
+        }
 
-        await setCookie('refresh_token', response.data.refresh_token, {
-            maxAge: 60 * 60 * 24 * 365,
-            path: '/',
-            domain: domainHost,
-            secure: true
-        });
+        return false;
+    } catch (err) {
+        return false;
     }
 }
 
@@ -107,16 +106,19 @@ export const apiService = (ctx = null) => {
             if (error.response) {
                 if (error.response.status === 401 && !originalConfig._retry) {
                     originalConfig._retry = true;
-                    await RefreshToken(originalConfig, instance);
-                    return instance.request(originalConfig);
+                    const refreshed = await RefreshToken(originalConfig, instance);
+                    if (refreshed) {
+                        return instance.request(originalConfig);
+                    }
+                    return Promise.reject(error);
                 }
 
                 if (error.response.status === 400) {
                     if (error.response.config.url.includes("/connect/token")) {
                         let domainHost = window.location.hostname.split('.').slice(-2).join('.');
-                        Cookies.remove('access_token', { path: '/', domain: domainHost });
-                        Cookies.remove('refresh_token', { path: '/', domain: domainHost });
-                        Cookies.remove('expires_in', { path: '/', domain: domainHost });
+                        Cookies.remove('access_token', { path: '/', domain: domainHost, secure: true });
+                        Cookies.remove('refresh_token', { path: '/', domain: domainHost, secure: true });
+                        Cookies.remove('expires_in', { path: '/', domain: domainHost, secure: true });
                     }
                     return Promise.reject(error);
                 }

package/src/services/authService.js

@@ -127,9 +127,9 @@ export const authService = () => {
             let AuthUri = process.env.authorityUri;
 
 
-            Cookies.remove('access_token', { path: '/', domain: domainHost });
-            Cookies.remove('refresh_token', { path: '/', domain: domainHost });
-            Cookies.remove('expires_in', { path: '/', domain: domainHost });
+            Cookies.remove('access_token', { path: '/', domain: domainHost, secure: true });
+            Cookies.remove('refresh_token', { path: '/', domain: domainHost, secure: true });
+            Cookies.remove('expires_in', { path: '/', domain: domainHost, secure: true });
 
 
             // destroyCookie({}, "access_token", {