kinetex 1.3.0 → 1.5.0

package/dist/cjs/dedup.js

@@ -19,6 +19,81 @@
 // ============================================================================
 // §2  DEDUP MAP
 // ============================================================================
+/**
+ * Headers that are per-request noise rather than part of a request's identity.
+ *
+ * Two callers sending different trace ids are the same request as far as the
+ * response is concerned, so including them would only cost the coalescing that
+ * dedup exists to provide. Everything else — `Authorization`, `Cookie`,
+ * `Accept`, any custom header a gateway keys on — participates, so a request is
+ * only ever coalesced with one that would have received the same response.
+ */
+/**
+ * The default dedup key: method, URL, and the identity-bearing headers.
+ *
+ * Sorting makes the key order-independent, since two requests that differ only
+ * in header order are the same request. Values are included verbatim: a caller
+ * that wants coarser or finer granularity supplies a `keyFn`.
+ */
+/**
+ * Headers excluded from a request's identity, as with {@link defaultDedupKey}.
+ * Duplicated rather than imported so `dedup.ts` stays dependency-free; the two
+ * lists must be kept in step.
+ */
+const NON_IDENTITY_HEADERS = [
+    "traceparent",
+    "tracestate",
+    "baggage",
+    "x-request-id",
+    "x-correlation-id",
+    "x-trace-id",
+];
+/**
+ * A stable, opaque digest of everything that makes a request distinct.
+ *
+ * Hashing rather than concatenating keeps credentials out of the key: a dedup
+ * map is a long-lived map of strings, and its keys should not be a place where
+ * an `Authorization` header sits in plain text. Returns `""` when no header
+ * distinguishes the request, so the common unauthenticated case keys on method
+ * and URL alone.
+ */
+export async function identityFingerprint(headers) {
+    if (headers === undefined)
+        return "";
+    const lowered = new Map();
+    for (const [name, value] of Object.entries(headers)) {
+        lowered.set(name.toLowerCase(), value);
+    }
+    const parts = [];
+    for (const name of NON_IDENTITY_HEADERS)
+        lowered.delete(name);
+    for (const name of [...lowered.keys()].sort()) {
+        parts.push(`${name}=${lowered.get(name)}`);
+    }
+    if (parts.length === 0)
+        return "";
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(parts.join("|")));
+    return Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+/**
+ * Build a dedup key from a method, URL and identity digest.
+ */
+export function dedupKeyFrom(method, url, fingerprint) {
+    return fingerprint ? `${method}:${url}:${fingerprint}` : `${method}:${url}`;
+}
+export function defaultDedupKey(method, url, headers) {
+    if (headers === undefined)
+        return `${method}::${url}`;
+    const identity = Object.entries(headers)
+        .filter(([name]) => !NON_IDENTITY_HEADERS.includes(name.toLowerCase()))
+        .map(([name, value]) => `${name.toLowerCase()}=${value}`)
+        .sort();
+    // No distinguishing header means the key stays method + URL, so an empty
+    // header set does not silently become a different key shape.
+    return identity.length === 0 ? `${method}::${url}` : `${method}::${url}::${identity.join("&")}`;
+}
 /**
  * `DedupMap` manages in-flight promises keyed by a request fingerprint.
  * It is transport-agnostic — pass any async factory function.
@@ -26,6 +101,9 @@
 export class DedupMap {
     inflight = new Map();
     timeouts = new Map();
+    /** Window timers, overridable for tests. See {@link DedupOptions.timers}. */
+    _setTimeout;
+    _clearTimeout;
     windowMs;
     methods;
     keyFn;
@@ -39,8 +117,10 @@ export class DedupMap {
     constructor(options = {}) {
         this.windowMs = options.windowMs ?? 0;
         this.methods = new Set((options.methods ?? ["GET", "HEAD"]).map((m) => m.toUpperCase()));
-        this.keyFn = options.keyFn ?? ((m, url) => `${m}::${url}`);
+        this.keyFn = options.keyFn ?? defaultDedupKey;
         this._globalSignal = options.signal ?? null;
+        this._setTimeout = options.timers?.setTimeout ?? ((fn, ms) => setTimeout(fn, ms));
+        this._clearTimeout = options.timers?.clearTimeout ?? ((h) => clearTimeout(h));
     }
     /**
      * Execute `factory` for the given method/url, or return the in-flight
@@ -64,9 +144,12 @@ export class DedupMap {
      * entry and creating a new one. The first caller becomes the "leader" and all
      * subsequent callers within the same tick share the same promise.
      *
-     * Note: The default `keyFn` does NOT include headers in the deduplication key.
-     * Two requests with different auth tokens to the same URL will NOT be deduplicated
-     * unless you provide a custom `keyFn` that includes headers.
+     * Note: the default key includes the request headers, so two requests to the
+     * same URL carrying different `Authorization` or `Cookie` are separate
+     * requests and are never coalesced. A key of method + URL alone was the
+     * default once, and it handed one caller's response to another: 50 callers
+     * aside, even two callers for different tenants shared a single response.
+     * See {@link defaultDedupKey}.
      */
     execute(method, url, factory, headers, windowMs, signal) {
         // Use per-key TTL if provided, otherwise fall back to global windowMs (F-3)
@@ -75,29 +158,54 @@ export class DedupMap {
         const effectiveSignal = signal ?? this._globalSignal;
         // Handle abort signal (F-2): if signal is already aborted, don't dedupe
         if (effectiveSignal?.aborted) {
+            // Still a real network call. It used to return before the counters were
+            // touched, so a client whose method filter excluded everything reported
+            // totalRequests 0 and a hitRate of 0 after any number of real requests
+            // — and `misses` is documented as "requests that triggered a real
+            // network call". Both bypasses below now count.
+            this._misses++;
             return factory();
         }
         if (!this.methods.has(method.toUpperCase())) {
+            this._misses++;
             return factory();
         }
-        const key = this.keyFn(method, url, headers);
+        // The method is canonicalised before it reaches the key function. The
+        // methods filter has always been case-insensitive, but the key was built
+        // from the caller's spelling, so `execute("get", u)` and
+        // `execute("GET", u)` were two different keys and never coalesced — the
+        // one case a caller gets wrong most often, and one the library otherwise
+        // treats as equal everywhere.
+        const canonicalMethod = method.toUpperCase();
+        const key = this.keyFn(canonicalMethod, url, headers);
         const existing = this.inflight.get(key);
         if (existing) {
-            // Within window: return cached result
-            if (existing.resolvedAt !== null &&
-                effectiveWindowMs > 0 &&
-                Date.now() - existing.resolvedAt <= effectiveWindowMs) {
+            // In-flight: share the promise. This is coalescing, not caching, so it
+            // is not gated on the window.
+            if (existing.resolvedAt === null) {
                 this._hits++;
-                // Return the typed promise directly - preserves error type
                 return existing.promise;
             }
-            // In-flight: share the promise
-            if (existing.resolvedAt === null) {
+            // Within window: return cached result
+            if (effectiveWindowMs > 0 && Date.now() - existing.resolvedAt <= effectiveWindowMs) {
                 this._hits++;
+                // Return the typed promise directly - preserves error type
                 return existing.promise;
             }
-            // Expired window — fall through to new request
-            this.inflight.delete(key);
+            if (effectiveWindowMs > 0) {
+                // This caller's own window has lapsed — drop the stale entry and lead.
+                this.inflight.delete(key);
+            }
+            else {
+                // This caller explicitly asked for no window, so it gets its own
+                // request. It used to fall through to `inflight.delete(key)` and lead
+                // as well, which destroyed a window some *other* caller had
+                // established and was still relying on: one `windowMs: 0` call was
+                // enough to empty the cache for everyone, and the next windowed caller
+                // had to go to the network for a result that was still in hand.
+                this._misses++;
+                return factory();
+            }
         }
         this._misses++;
         // Create entry and register it in the inflight map BEFORE starting the async work
@@ -113,7 +221,7 @@ export class DedupMap {
                     this.inflight.delete(key);
                     const existingTimeout = this.timeouts.get(key);
                     if (existingTimeout !== undefined) {
-                        clearTimeout(existingTimeout);
+                        this._clearTimeout(existingTimeout);
                         this.timeouts.delete(key);
                     }
                 }
@@ -132,6 +240,16 @@ export class DedupMap {
         })().then((result) => {
             entry.resolvedAt = Date.now();
             entry.result = result;
+            // This entry may have lost the key while the factory was running: an
+            // abort, a `clear()`, or an `invalidate()` all drop it, and a later
+            // caller for the same URL then becomes the leader. Registering a
+            // window timer here regardless re-inserted a timer for a key someone
+            // else now owns, and when it fired it deleted their still-in-flight
+            // entry — so the request after that started a third copy. The
+            // identity check is what makes "who owns this key" decidable.
+            if (this.inflight.get(key) !== entry) {
+                return result;
+            }
             if (effectiveWindowMs <= 0) {
                 this.inflight.delete(key);
             }
@@ -142,10 +260,10 @@ export class DedupMap {
                 // out from under callers that were sharing it.
                 const stale = this.timeouts.get(key);
                 if (stale !== undefined) {
-                    clearTimeout(stale);
+                    this._clearTimeout(stale);
                     this.timeouts.delete(key);
                 }
-                const timeoutId = setTimeout(() => {
+                const timeoutId = this._setTimeout(() => {
                     this.inflight.delete(key);
                     this.timeouts.delete(key);
                 }, effectiveWindowMs);
@@ -155,10 +273,13 @@ export class DedupMap {
         }, (err) => {
             entry.resolvedAt = Date.now();
             entry.error = err;
-            this.inflight.delete(key);
+            // Same ownership rule as the success path: an entry that has already
+            // been dropped must not delete the entry that replaced it.
+            if (this.inflight.get(key) === entry)
+                this.inflight.delete(key);
             const existingTimeout = this.timeouts.get(key);
             if (existingTimeout !== undefined) {
-                clearTimeout(existingTimeout);
+                this._clearTimeout(existingTimeout);
                 this.timeouts.delete(key);
             }
             throw err;
@@ -216,7 +337,7 @@ export class DedupMap {
         this.inflight.clear();
         // Clear pending timeouts (B-1)
         for (const timeoutId of this.timeouts.values()) {
-            clearTimeout(timeoutId);
+            this._clearTimeout(timeoutId);
         }
         this.timeouts.clear();
     }
@@ -230,7 +351,7 @@ export class DedupMap {
     invalidate(key) {
         const timeoutId = this.timeouts.get(key);
         if (timeoutId) {
-            clearTimeout(timeoutId);
+            this._clearTimeout(timeoutId);
             this.timeouts.delete(key);
         }
         return this.inflight.delete(key);

package/dist/cjs/digest.js

@@ -8,7 +8,8 @@
  * WWW-Authenticate challenge, compute the response hash, and format the
  * Authorization header in one call.
  */
-import { randomBytes } from "./utils.js";
+import { randomBytes, uint8ArrayToBase64 } from "./utils.js";
+import { sha256Hex } from "./utils.js";
 // ============================================================================
 // §1  MD5 — Pure JS (no Web Crypto dependency)
 // ============================================================================
@@ -69,11 +70,14 @@ function md5(input) {
     for (let offset = 0; offset < bytes.length; offset += 64) {
         const M = [];
         for (let i = 0; i < 16; i++) {
-            const b0 = bytes[offset + i * 4];
-            const b1 = bytes[offset + i * 4 + 1];
-            const b2 = bytes[offset + i * 4 + 2];
-            const b3 = bytes[offset + i * 4 + 3];
-            M[i] = (b0 | (b1 << 8) | (b2 << 16) | (b3 << 24)) >>> 0;
+            // Named `w0..w3`, not `b0..b3`: `b0` shadowed the outer MD5 state variable
+            // of the same name, so the running state and the little-endian word read
+            // out of the block were indistinguishable at a glance.
+            const w0 = bytes[offset + i * 4];
+            const w1 = bytes[offset + i * 4 + 1];
+            const w2 = bytes[offset + i * 4 + 2];
+            const w3 = bytes[offset + i * 4 + 3];
+            M[i] = (w0 | (w1 << 8) | (w2 << 16) | (w3 << 24)) >>> 0;
         }
         let A = a0, B = b0, C = c0, D = d0;
         for (let i = 0; i < 64; i++) {
@@ -133,16 +137,37 @@ function md5(input) {
  * console.log(challenge.realm); // "testrealm@host.com"
  * ```
  */
+/** Decode a hex digest string into its raw bytes. */
+function hexToBytes(hex) {
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+/** Decode `quoted-pair` escapes (RFC 7230 §3.2.6) in a quoted-string body. */
+function unescapeQuoted(value) {
+    return value.replace(/\\(.)/g, "$1");
+}
 export function parseDigestChallenge(header) {
     const challenge = {
         algorithm: "MD5",
     };
     const cleaned = header.replace(/^Digest\s+/i, "").trim();
-    const regex = /(\w+)\s*=\s*(?:"([^"]*)"|([^,\s]+))/g;
+    // A quoted-string may contain a `quoted-pair` (RFC 7230 §3.2.6): `"` and
+    // `\\` are literal characters, not delimiters. The previous `"([^"]*)"`
+    // stopped at the first quote regardless of a preceding backslash, so
+    // `realm="a\"b"` parsed as `a\` and left `b"` to be re-scanned as if it
+    // were another parameter — a realm containing a quote silently truncated
+    // the challenge, and `realm="x\", qop="auth-int"` did the same to `qop`.
+    // Round-tripping a header produced by `formatDigestAuth` was therefore
+    // lossy for exactly the values that need escaping.
+    const quotedString = '"((?:[^"\\\\]|\\\\.)*)"';
+    const regex = new RegExp(`(\\w+)\\s*=\\s*(?:${quotedString}|([^,\\s]+))`, "g");
     let match;
     while ((match = regex.exec(cleaned)) !== null) {
         const key = match[1].toLowerCase();
-        const value = (match[2] ?? match[3]);
+        const value = match[2] !== undefined ? unescapeQuoted(match[2]) : match[3];
         switch (key) {
             case "realm":
                 challenge.realm = value;
@@ -188,14 +213,6 @@ export function parseDigestChallenge(header) {
  * @param data - String to hash
  * @returns 64-char hex-encoded SHA-256 digest
  */
-async function sha256Hex(data) {
-    const enc = new TextEncoder();
-    const buf = await crypto.subtle.digest("SHA-256", enc.encode(data));
-    const bytes = new Uint8Array(buf);
-    return Array.from(bytes)
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("");
-}
 // ============================================================================
 // §3c  SHA-512/256 — Pure-JS (FIPS 180-4)
 // ============================================================================
@@ -428,7 +445,11 @@ export async function computeDigestResponse(challenge, username, password, metho
     const realm = challenge.realm;
     const _cnonce = cnonce || randomBytes(5);
     const _nc = nc || "00000001";
-    const algo = resolveHashAlgo(challenge.algorithm);
+    const resolved = resolveHashAlgo(challenge.algorithm);
+    if (resolved === null) {
+        throw new Error(`Unsupported digest algorithm: ${challenge.algorithm}`);
+    }
+    const { algo, sess } = resolved;
     async function hash(s) {
         if (algo === "MD5")
             return md5(s);
@@ -436,12 +457,44 @@ export async function computeDigestResponse(challenge, username, password, metho
             return sha512256Hex(s);
         return await sha256Hex(s);
     }
-    const ha1 = await hash(`${username}:${realm}:${password}`);
+    // `-sess` binds the session (RFC 7616 §3.4.4/§3.4.5): the client nonce and
+    // the server nonce are folded into HA1, so the same credentials cannot be
+    // replayed under a different nonce. It requires `qop` to be present,
+    // because without one there is no cnonce to fold in.
+    // With `userhash=true`, RFC 7616 §3.4.4 substitutes the hashed username
+    // for the plaintext one everywhere it appears — including inside HA1.
+    const user = challenge.userhash
+        ? uint8ArrayToBase64(hexToBytes(await hash(`${username}:${realm}`)))
+        : username;
+    let ha1 = await hash(`${user}:${realm}:${password}`);
+    if (sess) {
+        if (!challenge.qop) {
+            throw new Error(`Digest algorithm ${challenge.algorithm} requires a qop parameter`);
+        }
+        ha1 = await hash(`${ha1}:${nonce}:${_cnonce}`);
+    }
     const ha2 = await hash(`${method}:${uri}`);
     let response;
     const qopList = qop.split(/\s*,\s*/).filter(Boolean);
-    if (qopList.includes("auth") || qopList.includes("auth-int")) {
-        response = await hash(`${ha1}:${nonce}:${_nc}:${_cnonce}:${qopList[0]}:${ha2}`);
+    if (qopList.length > 0) {
+        // RFC 7616 §3.4.3: with `qop=auth-int`, HA2 is
+        //   H(method:uri:H(entity-body))
+        // and the entity-body hash is part of the response. This API is not given
+        // the body, so that hash cannot be produced — and the old code took
+        // `qopList[0]` and used it in the response while still hashing
+        // H(method:uri). A server offering `qop="auth-int,auth"`, which RFC 7616
+        // §3.4.4 explicitly says a client may see, was therefore answered with a
+        // `qop=auth-int` header carrying a response computed as if it were `auth`:
+        // a client that claims a protection it does not implement, and fails
+        // against every conforming server.
+        //
+        // So: prefer `auth`, which is the only one implementable here, and refuse
+        // rather than answer wrongly when only `auth-int` is offered.
+        if (!qopList.includes("auth")) {
+            throw new Error(`Digest challenge offers only unsupported qop values: ${qopList.join(", ")}. ` +
+                `"auth-int" requires the entity body, which this API does not receive.`);
+        }
+        response = await hash(`${ha1}:${nonce}:${_nc}:${_cnonce}:auth:${ha2}`);
     }
     else {
         response = await hash(`${ha1}:${nonce}:${ha2}`);
@@ -455,13 +508,64 @@ export async function computeDigestResponse(challenge, username, password, metho
  * @param algorithm - Algorithm string from the challenge (e.g. "MD5", "SHA-256")
  * @returns The resolved algorithm identifier
  */
+/**
+ * Compute the `username*` value for a challenge offering `userhash=true`
+ * (RFC 7616 §3.4.4): `base64(H(username : realm))`.
+ *
+ * A server that sends `userhash=true` is telling the client *not* to send the
+ * username in the clear. The previous code parsed the flag, exposed it on the
+ * public {@link DigestChallenge} type with a JSDoc promising support, and then
+ * ignored it — sending a plain `username="admin"` back to a server that had
+ * explicitly asked for it to be hashed. That is a privacy regression, and the
+ * server rejects the request too, because HA1 was built from the unhashed name.
+ *
+ * @returns the base64 hashed username, or `null` when `userhash` is not offered
+ */
+export async function computeUsernameStar(challenge, username) {
+    if (!challenge.userhash)
+        return null;
+    const resolved = resolveHashAlgo(challenge.algorithm);
+    if (resolved === null) {
+        throw new Error(`Unsupported digest algorithm: ${challenge.algorithm}`);
+    }
+    const { algo } = resolved;
+    const digest = algo === "MD5"
+        ? md5(`${username}:${challenge.realm}`)
+        : algo === "SHA-512-256"
+            ? sha512256Hex(`${username}:${challenge.realm}`)
+            : await sha256Hex(`${username}:${challenge.realm}`);
+    return uint8ArrayToBase64(hexToBytes(digest));
+}
+/**
+ * Resolve the challenge's `algorithm` field to a base hash plus the
+ * `-sess` session-binding flag (RFC 7616 §3.4.4/§3.4.5).
+ *
+ * Two separate defects lived here. First, "anything unrecognised is MD5" was
+ * a silent downgrade: `SCRAM-SHA-256` and `garbage` were answered with a
+ * 32-hex MD5 under a header naming a different algorithm, so the server's
+ * rejection blamed an algorithm the caller never chose. Second, the
+ * `-sess` forms stripped to `MD5SESS`/`SHA256SESS`, matched nothing, and then
+ * fell through the `hash` dispatch to its SHA-256 default — so `MD5-sess`
+ * was computed with SHA-256, and `SHA-256-sess` happened to work only by
+ * accident. An unrecognised algorithm is now an error.
+ *
+ * @returns the base algorithm and whether HA1 is session-bound, or `null`
+ *          when the algorithm is not one we can compute
+ */
 function resolveHashAlgo(algorithm) {
-    const upper = algorithm.toUpperCase().replace(/-/g, "");
-    if (upper === "SHA256")
-        return "SHA-256";
-    if (upper === "SHA512256")
-        return "SHA-512-256";
-    return "MD5";
+    const trimmed = algorithm.trim();
+    const sess = /-sess$/i.test(trimmed);
+    const base = trimmed
+        .replace(/-sess$/i, "")
+        .toUpperCase()
+        .replace(/-/g, "");
+    if (base === "MD5")
+        return { algo: "MD5", sess };
+    if (base === "SHA256")
+        return { algo: "SHA-256", sess };
+    if (base === "SHA512256")
+        return { algo: "SHA-512-256", sess };
+    return null;
 }
 // ============================================================================
 // §5  DIGEST AUTHORIZATION HEADER FORMATTING
@@ -491,23 +595,49 @@ function resolveHashAlgo(algorithm) {
  *   "/dir/index.html", "f2/wE", "00000001");
  * ```
  */
-export function formatDigestAuth(challenge, username, response, uri, cnonce, nc) {
+/**
+ * Escape a value for a `quoted-string` (RFC 7230 §3.2.6): backslash and double
+ * quote are escaped, everything else passes through.
+ *
+ * A username or URI containing `"` previously terminated the quoted string
+ * early and everything after it was parsed as further auth-params — a
+ * username of `evil", qop=auth, x="` produced a header carrying an attacker-
+ * chosen `qop` and an extra parameter. `realm` and `opaque` come from the
+ * *server*, so a hostile or compromised one could inject into the client's own
+ * outgoing Authorization header.
+ */
+function quoted(value) {
+    return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+export function formatDigestAuth(challenge, username, response, uri, cnonce, nc, usernameStar) {
     const parts = [];
     const _cnonce = cnonce || randomBytes(5);
     const _nc = nc || "00000001";
-    parts.push(`username="${username}"`);
-    parts.push(`realm="${challenge.realm}"`);
-    parts.push(`nonce="${challenge.nonce}"`);
-    parts.push(`uri="${uri}"`);
-    parts.push(`response="${response}"`);
+    if (challenge.userhash) {
+        if (usernameStar === undefined) {
+            throw new Error("challenge offers userhash=true: pass the value from computeUsernameStar() " +
+                "as `usernameStar` — sending a plaintext username would defeat it");
+        }
+        parts.push(`username*="${quoted(usernameStar)}"`);
+    }
+    else {
+        if (usernameStar !== undefined) {
+            throw new Error("usernameStar was given but the challenge does not offer userhash");
+        }
+        parts.push(`username="${quoted(username)}"`);
+    }
+    parts.push(`realm="${quoted(challenge.realm)}"`);
+    parts.push(`nonce="${quoted(challenge.nonce)}"`);
+    parts.push(`uri="${quoted(uri)}"`);
+    parts.push(`response="${quoted(response)}"`);
     if (challenge.opaque)
-        parts.push(`opaque="${challenge.opaque}"`);
+        parts.push(`opaque="${quoted(challenge.opaque)}"`);
     if (challenge.algorithm && challenge.algorithm !== "MD5")
         parts.push(`algorithm=${challenge.algorithm}`);
     if (challenge.qop) {
-        parts.push(`qop=${challenge.qop.split(/\s*,\s*/)[0]}`);
+        parts.push(`qop=auth`);
         parts.push(`nc=${_nc}`);
-        parts.push(`cnonce="${_cnonce}"`);
+        parts.push(`cnonce="${quoted(_cnonce)}"`);
     }
     return `Digest ${parts.join(", ")}`;
 }
@@ -548,7 +678,8 @@ export async function createDigestAuthorization(wwwAuth, username, password, met
     const cnonce = randomBytes(5);
     const nc = "00000001";
     const response = await computeDigestResponse(challenge, username, password, method, uri, cnonce, nc);
-    return formatDigestAuth(challenge, username, response, uri, cnonce, nc);
+    const usernameStar = await computeUsernameStar(challenge, username);
+    return formatDigestAuth(challenge, username, response, uri, cnonce, nc, usernameStar ?? undefined);
 }
 /**
  * Stateful Digest-auth authorizer.
@@ -565,14 +696,40 @@ export async function createDigestAuthorization(wwwAuth, username, password, met
  */
 export function createDigestAuthorizer() {
     const counters = new Map();
+    // The server chooses the nonce, and nonce expiry is a routine server-side
+    // control, so a long-lived client sees a fresh `realm\u0000nonce` key on every
+    // challenge. Entries were never evicted, so the map grew by one key per
+    // challenge for the life of the process — keyed on strings an
+    // attacker-influenced server supplies. `Map` preserves insertion order, so
+    // dropping the first key evicts the oldest challenge.
+    //
+    // ponytail: bounded LRU-by-insertion-order rather than a TTL timer. Raise
+    // MAX_TRACKED_NONCES if a deployment is ever seen cycling nonces faster
+    // than this; a timer per key would be the alternative.
+    const MAX_TRACKED_NONCES = 64;
+    const rememberNonce = (scope, value) => {
+        if (!counters.has(scope)) {
+            counters.set(scope, value);
+            if (counters.size > MAX_TRACKED_NONCES) {
+                const oldest = counters.keys().next();
+                if (!oldest.done)
+                    counters.delete(oldest.value);
+            }
+            return;
+        }
+        // Re-insert so a hot challenge counts as recently used.
+        counters.delete(scope);
+        counters.set(scope, value);
+    };
     return async (wwwAuth, username, password, method, uri) => {
         const challenge = parseDigestChallenge(wwwAuth);
         const cnonce = randomBytes(5);
         const scope = `${challenge.realm}\u0000${challenge.nonce}`;
         const next = (counters.get(scope) ?? 0) + 1;
-        counters.set(scope, next);
+        rememberNonce(scope, next);
         const nc = next.toString(16).padStart(8, "0");
         const response = await computeDigestResponse(challenge, username, password, method, uri, cnonce, nc);
-        return formatDigestAuth(challenge, username, response, uri, cnonce, nc);
+        const usernameStar = await computeUsernameStar(challenge, username);
+        return formatDigestAuth(challenge, username, response, uri, cnonce, nc, usernameStar ?? undefined);
     };
 }