client-certificate-auth 1.3.0 → 1.3.1

package/lib/helpers.js

@@ -9,6 +9,17 @@
  * @typedef {(cert: PeerCertificate, req?: import('http').IncomingMessage) => boolean | Promise<boolean>} ValidationCallback
  */
 
+/**
+ * Normalize a certificate DN field value to an array.
+ * Node.js returns string for single-valued and string[] for multi-valued DN attributes.
+ * @param {string | string[] | undefined} value
+ * @returns {string[]}
+ */
+function toArray(value) {
+    if (value === undefined || value === null) {return [];}
+    return Array.isArray(value) ? value : [value];
+}
+
 /**
  * Create a validation callback that allows certificates with matching Common Names.
  *
@@ -20,7 +31,7 @@
  */
 export function allowCN(names) {
     const allowed = new Set(names);
-    return (cert) => allowed.has(cert.subject?.CN);
+    return (cert) => toArray(cert.subject?.CN).some((cn) => allowed.has(cn));
 }
 
 /**
@@ -76,7 +87,7 @@ export function allowIssuer(match) {
     const entries = Object.entries(match);
     return (cert) => {
         if (!cert.issuer) {return false;}
-        return entries.every(([key, value]) => cert.issuer[key] === value);
+        return entries.every(([key, value]) => toArray(cert.issuer[key]).includes(value));
     };
 }
 
@@ -94,7 +105,7 @@ export function allowSubject(match) {
     const entries = Object.entries(match);
     return (cert) => {
         if (!cert.subject) {return false;}
-        return entries.every(([key, value]) => cert.subject[key] === value);
+        return entries.every(([key, value]) => toArray(cert.subject[key]).includes(value));
     };
 }
 
@@ -109,7 +120,7 @@ export function allowSubject(match) {
  */
 export function allowOU(ous) {
     const allowed = new Set(ous);
-    return (cert) => allowed.has(cert.subject?.OU);
+    return (cert) => toArray(cert.subject?.OU).some((ou) => allowed.has(ou));
 }
 
 /**
@@ -123,7 +134,7 @@ export function allowOU(ous) {
  */
 export function allowOrganization(orgs) {
     const allowed = new Set(orgs);
-    return (cert) => allowed.has(cert.subject?.O);
+    return (cert) => toArray(cert.subject?.O).some((o) => allowed.has(o));
 }
 
 /**
@@ -196,9 +207,9 @@ export function allowEmail(emails) {
     const allowed = new Set(emails.map((e) => e.toLowerCase()));
 
     return (cert) => {
-        // Check subject.emailAddress
+        // Check subject.emailAddress (may be string or string[] for multi-valued)
         if (cert.subject?.emailAddress) {
-            if (allowed.has(cert.subject.emailAddress.toLowerCase())) {
+            if (toArray(cert.subject.emailAddress).some((e) => allowed.has(e.toLowerCase()))) {
                 return true;
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "client-certificate-auth",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Express/Connect middleware for mTLS client certificate authentication with reverse proxy support (AWS ALB, Envoy, Cloudflare, Traefik)",
   "homepage": "https://github.com/tgies/client-certificate-auth",
   "bugs": {