client-certificate-auth 1.3.5 → 1.3.6

package/lib/clientCertificateAuth.cjs

@@ -19,6 +19,19 @@ async function loadModule() {
     return _default;
 }
 
+/**
+ * Duck-typed thenable check per Promises/A+: an object or function with
+ * a callable `.then` method. Matches the set of values `Promise.resolve`
+ * natively adopts as thenables.
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+function isThenable(value) {
+    return value !== null
+        && (typeof value === 'object' || typeof value === 'function')
+        && typeof value.then === 'function';
+}
+
 /**
  * Options not supported by the sync CJS wrapper.
  * These require the ESM module's async header parsing.
@@ -72,8 +85,8 @@ function clientCertificateAuth(callback, options = {}) {
         queueMicrotask(() => {
             try {
                 const result = hook(...args);
-                if (result instanceof Promise) {
-                    result.catch(err => console.error('client-certificate-auth: hook error:', err));
+                if (isThenable(result)) {
+                    Promise.resolve(result).catch(err => console.error('client-certificate-auth: hook error:', err));
                 }
             } catch (err) {
                 console.error('client-certificate-auth: hook error:', err);
@@ -118,8 +131,8 @@ function clientCertificateAuth(callback, options = {}) {
 
         try {
             const result = callback(cert, req);
-            if (result instanceof Promise) {
-                result.then(doneAuthorizing).catch((err) => {
+            if (isThenable(result)) {
+                Promise.resolve(result).then(doneAuthorizing).catch((err) => {
                     safeCallHook(onRejected, cert, req, err.message || 'callback_threw');
                     if (err.status === undefined) {
                         err.status = 401;

package/lib/clientCertificateAuth.js

@@ -7,6 +7,19 @@
 
 import { extractClientCertificate } from './extractor.js';
 
+/**
+ * Duck-typed thenable check per Promises/A+: an object or function with
+ * a callable `.then` method. Matches the set of values `Promise.resolve`
+ * natively adopts as thenables.
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+function isThenable(value) {
+  return value !== null
+    && (typeof value === 'object' || typeof value === 'function')
+    && typeof /** @type {{then?: unknown}} */ (value).then === 'function';
+}
+
 /**
  * @typedef {import('http').IncomingMessage & { secure?: boolean; socket: import('tls').TLSSocket & { authorized?: boolean; authorizationError?: string }; clientCertificate?: import('tls').PeerCertificate }} ClientCertRequest
  * @typedef {import('http').ServerResponse & { redirect: (statusOrUrl: number | string, url?: string) => void }} ClientCertResponse
@@ -107,8 +120,8 @@ export default function clientCertificateAuth(callback, options = {}) {
     queueMicrotask(() => {
       try {
         const result = hook(...args);
-        if (result instanceof Promise) {
-          result.catch(err => console.error('client-certificate-auth: hook error:', err));
+        if (isThenable(result)) {
+          Promise.resolve(result).catch(err => console.error('client-certificate-auth: hook error:', err));
         }
       } catch (err) {
         console.error('client-certificate-auth: hook error:', err);
@@ -177,8 +190,8 @@ export default function clientCertificateAuth(callback, options = {}) {
 
     try {
       const callbackResult = callback(cert, req);
-      if (callbackResult instanceof Promise) {
-        callbackResult.then(doneAuthorizing).catch((err) => {
+      if (isThenable(callbackResult)) {
+        Promise.resolve(callbackResult).then(doneAuthorizing).catch((err) => {
           safeCallHook(onRejected, cert, req, err.message || 'callback_threw');
           if (err.status === undefined) {
             err.status = 401;

package/lib/helpers.js

@@ -38,7 +38,8 @@ export function allowCN(names) {
  * Create a validation callback that allows certificates with matching fingerprints.
  * Supports SHA-1 fingerprints (compared against cert.fingerprint) and SHA-256
  * fingerprints with "SHA256:" prefix (compared against cert.fingerprint256).
- * Fingerprints without a prefix are treated as SHA-1.
+ * Fingerprints without a prefix are treated as SHA-1. Hex inputs are
+ * normalized: case and colon delimiters are ignored on both sides.
  *
  * @param {string[]} fingerprints - Allowed fingerprints
  * @returns {ValidationCallback}
@@ -46,28 +47,30 @@ export function allowCN(names) {
  * @example
  * app.use(clientCertificateAuth(allowFingerprints([
  *   'SHA256:AB:CD:EF:...',  // matched against cert.fingerprint256
- *   'AB:CD:EF:...'          // matched against cert.fingerprint (SHA-1)
+ *   'AB:CD:EF:...',         // colon-delimited, matched against cert.fingerprint
+ *   'ABCDEF...'             // contiguous hex also matches cert.fingerprint
  * ])));
  */
 export function allowFingerprints(fingerprints) {
+    const normalize = (fp) => fp.toUpperCase().replace(/:/g, '');
     const sha256Allowed = new Set();
     const sha1Allowed = new Set();
 
     for (const fp of fingerprints) {
         const upper = fp.toUpperCase();
         if (upper.startsWith('SHA256:')) {
-            sha256Allowed.add(upper.slice(7));
+            sha256Allowed.add(normalize(upper.slice(7)));
         } else {
-            sha1Allowed.add(upper);
+            sha1Allowed.add(normalize(upper));
         }
     }
 
     return (cert) => {
         if (sha1Allowed.size > 0 && cert.fingerprint) {
-            if (sha1Allowed.has(cert.fingerprint.toUpperCase())) {return true;}
+            if (sha1Allowed.has(normalize(cert.fingerprint))) {return true;}
         }
         if (sha256Allowed.size > 0 && cert.fingerprint256) {
-            if (sha256Allowed.has(cert.fingerprint256.toUpperCase())) {return true;}
+            if (sha256Allowed.has(normalize(cert.fingerprint256))) {return true;}
         }
         return false;
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "client-certificate-auth",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "Express/Connect middleware for mTLS client certificate authentication with reverse proxy support (AWS ALB, Envoy, Cloudflare, Traefik)",
   "homepage": "https://github.com/tgies/client-certificate-auth",
   "bugs": {