cauthy-auth 0.28.0 → 0.28.1

package/dist/index.mjs

@@ -846,6 +846,13 @@ function providerIn(segment) {
 function env2(name) {
   return typeof process !== "undefined" ? process.env?.[name] : void 0;
 }
+function hostOf(origin) {
+  try {
+    return new URL(origin).hostname;
+  } catch {
+    return void 0;
+  }
+}
 function b64url(bytes) {
   let s = "";
   for (const b of bytes) s += String.fromCharCode(b);
@@ -879,6 +886,10 @@ function createCauthy(given = {}) {
   if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address, e.g. https://id.example.com");
   if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
   if (secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
+  const baseURL = given.baseURL ?? env2("CAUTHY_BASE_URL");
+  if (baseURL !== void 0 && baseURL !== "" && !/^https?:\/\/[^/]+\/*$/.test(baseURL)) {
+    throw new CauthyConfigError("baseURL (CAUTHY_BASE_URL) must be the application's public origin, e.g. https://app.example.com");
+  }
   const basePath = "/" + (given.basePath ?? "/api/auth").replace(/^\/+|\/+$/g, "");
   const afterSignIn = localPath(given.afterSignIn, "/");
   const afterSignOut = localPath(given.afterSignOut, "/");
@@ -894,7 +905,12 @@ function createCauthy(given = {}) {
     verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, "/") : void 0
   };
   const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, fetch: given.fetch });
-  const originOf = (request) => withoutTrailingSlashes(given.baseURL ?? new URL(request.url).origin);
+  const originOf = (request) => {
+    if (baseURL) return withoutTrailingSlashes(baseURL);
+    const url = new URL(request.url);
+    const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase();
+    return proto === "https" || proto === "http" ? `${proto}://${url.host}` : url.origin;
+  };
   const attrs = (request, maxAge) => ({ secure: originOf(request).startsWith("https://"), maxAge });
   async function token(form) {
     const body2 = new URLSearchParams({ client_id: clientId, ...form });
@@ -1192,9 +1208,18 @@ function createCauthy(given = {}) {
   });
   const problem = (status2, code, message, field, headers, reasons) => json({ error: { code, message, ...field ? { field } : {}, ...reasons && reasons.length > 0 ? { reasons } : {} } }, status2, headers);
   const invalid = (p) => problem(400, p.code, p.message, p.field);
+  let explained = false;
   function ownRequest(request) {
     const origin = request.headers.get("origin");
-    if (origin !== null) return origin === originOf(request) || origin === new URL(request.url).origin;
+    if (origin !== null) {
+      const own = originOf(request);
+      if (origin === own || origin === new URL(request.url).origin) return true;
+      if (!explained && hostOf(origin) === new URL(own).hostname) {
+        explained = true;
+        console.warn(`cauthy-auth: refused a request from ${origin} as cross_site: this application sees itself as ${own}. Behind a proxy? Set CAUTHY_BASE_URL (or baseURL) to the public origin.`);
+      }
+      return false;
+    }
     return (request.headers.get("sec-fetch-site") ?? "same-origin") === "same-origin";
   }
   async function body(request) {