nuxt-auth-utils 0.5.28 → 0.5.30

package/README.md

@@ -219,6 +219,7 @@ It can also be set using environment variables:
 - Azure B2C
 - Battle.net
 - Bluesky (AT Protocol)
+- Box.com
 - Discord
 - Dropbox
 - Facebook
@@ -242,6 +243,7 @@ It can also be set using environment variables:
 - osu!
 - PayPal
 - Polar
+- Riot Games
 - Salesforce
 - Seznam
 - Shopify Customer
@@ -304,7 +306,7 @@ if (await verifyPassword(hashedPassword, 'user_password')) {
 It also provides a `passwordNeedsRehash` function to check if a password needs to be rehashed. This is useful when the hash settings are changed, such as as increasing the scrypt cost parameters.
 
 ```ts
-const needsRehash = await passwordNeedsRehash(hashedPassword)
+const needsRehash = passwordNeedsRehash(hashedPassword)
 
 if (needsRehash) {
   // Password needs to be rehashed
@@ -416,7 +418,7 @@ export default defineWebAuthnRegisterEventHandler({
     // And verify that the email is the same as the one in session
     const session = await getUserSession(event)
     if (session.user?.email && session.user.email !== userBody.userName) {
-      throw createError({ statusCode: 400, message: 'Email not matching curent session' })
+      throw createError({ statusCode: 400, message: 'Email not matching current session' })
     }
 
     // If he registers a new account with credentials

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.28",
+  "version": "0.5.30",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -115,6 +115,12 @@ const module$1 = defineNuxtModule({
       redirectURL: "",
       baseURL: ""
     });
+    runtimeConfig.oauth.box = defu(runtimeConfig.oauth.box, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: []
+    });
     runtimeConfig.oauth.github = defu(runtimeConfig.oauth.github, {
       clientId: "",
       clientSecret: "",
@@ -406,6 +412,12 @@ const module$1 = defineNuxtModule({
       redirectURL: "",
       scope: []
     });
+    runtimeConfig.oauth.riotgames = defu(runtimeConfig.oauth.riotgames, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: "",
+      scope: []
+    });
   }
 });
 

package/dist/runtime/app/plugins/session.client.js

@@ -3,7 +3,7 @@ export default defineNuxtPlugin(async (nuxtApp) => {
   if (!nuxtApp.payload.serverRendered) {
     await useUserSession().fetch();
   } else if (Boolean(nuxtApp.payload.prerenderedAt) || Boolean(nuxtApp.payload.isCached) || nuxtApp.$config.public.auth.loadStrategy === "client-only") {
-    nuxtApp.hook("app:mounted", async () => {
+    nuxtApp.hook("app:suspense:resolve", async () => {
       await useUserSession().fetch();
     });
   }

package/dist/runtime/server/lib/oauth/apple.js

@@ -1,7 +1,7 @@
 import { eventHandler, getRequestHeader, readBody, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, signJwt, verifyJwt } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken, signJwt, verifyJwt } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthAppleEventHandler({
   config,
@@ -19,10 +19,15 @@ export function defineOAuthAppleEventHandler({
     }
     const isPost = getRequestHeader(event, "content-type") === "application/x-www-form-urlencoded";
     let code;
+    let state;
     let user;
     if (isPost) {
-      ({ code, user } = await readBody(event));
+      ({ code, state, user } = await readBody(event));
     }
+    const storedState = await handleState(event, {
+      isCallback: isPost && Boolean(code),
+      sameSite: "none"
+    });
     if (!isPost || !code) {
       const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
       config.scope = Array.isArray(config.scope) ? config.scope.join(" ") : config.scope || "name email";
@@ -34,10 +39,14 @@ export function defineOAuthAppleEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state: storedState
         })
       );
     }
+    if (state !== storedState) {
+      return handleInvalidState(event, "apple", onError);
+    }
     try {
       const secret = await signJwt(
         {

package/dist/runtime/server/lib/oauth/atlassian.js

@@ -1,8 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { randomUUID } from "uncrypto";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthAtlassianEventHandler({
   config,
@@ -28,6 +27,7 @@ export function defineOAuthAtlassianEventHandler({
     }
     const query = getQuery(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       return sendRedirect(
         event,
@@ -36,10 +36,10 @@ export function defineOAuthAtlassianEventHandler({
           client_id: config.clientId,
           scope: config.scope?.join(" "),
           redirect_uri: redirectURL,
-          state: randomUUID(),
           response_type: "code",
           prompt: "consent",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
@@ -52,6 +52,9 @@ export function defineOAuthAtlassianEventHandler({
       if (!onError) throw error;
       return onError(event, error);
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "atlassian", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         "Content-Type": "application/json"

package/dist/runtime/server/lib/oauth/auth0.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthAuth0EventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -26,6 +26,7 @@ export function defineOAuthAuth0EventHandler({ config, onSuccess, onError }) {
         onError
       );
     }
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["openid", "offline_access"];
       if (config.emailRequired && !config.scope.includes("email")) {
@@ -41,10 +42,14 @@ export function defineOAuthAuth0EventHandler({ config, onSuccess, onError }) {
           audience: config.audience || "",
           max_age: config.maxAge || 0,
           connection: config.connection || "",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "auth0", onError);
+    }
     const tokens = await requestAccessToken(tokenURL, {
       headers: {
         "Content-Type": "application/json"

package/dist/runtime/server/lib/oauth/authentik.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -22,6 +22,7 @@ export function defineOAuthAuthentikEventHandler({ config, onSuccess, onError })
     const authorizationURL = `https://${config.domain}/application/o/authorize/`;
     const tokenURL = `https://${config.domain}/application/o/token/`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       return sendRedirect(
         event,
@@ -29,10 +30,14 @@ export function defineOAuthAuthentikEventHandler({ config, onSuccess, onError })
           response_type: "code",
           client_id: config.clientId,
           redirect_uri: redirectURL,
-          scope: (config.scope || ["openid", "profile", "email"]).join(" ")
+          scope: (config.scope || ["openid", "profile", "email"]).join(" "),
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "authentik", onError);
+    }
     const tokens = await requestAccessToken(tokenURL, {
       headers: {
         "Authorization": `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`,

package/dist/runtime/server/lib/oauth/azureb2c.js

@@ -27,10 +27,10 @@ export function defineOAuthAzureB2CEventHandler({ config, onSuccess, onError })
           response_type: "code",
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
           code_challenge: verifier.code_challenge,
           code_challenge_method: verifier.code_challenge_method,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/battledotnet.js

@@ -1,8 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { randomUUID } from "uncrypto";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -30,6 +29,7 @@ export function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError
       );
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["openid"];
       config.region = config.region || "EU";
@@ -43,13 +43,15 @@ export function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state: randomUUID(),
-          // Todo: handle PKCE flow
           response_type: "code",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "battledotnet", onError);
+    }
     config.scope = config.scope || [];
     if (!config.scope.includes("openid")) {
       config.scope.push("openid");

package/dist/runtime/server/lib/oauth/box.d.ts

@@ -0,0 +1,95 @@
+import type { OAuthConfig } from '#auth-utils';
+export interface OAuthBoxConfig {
+    /**
+     * Box OAuth Client ID
+     * @default process.env.NUXT_OAUTH_BOX_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Box OAuth Client Secret
+     * @default process.env.NUXT_OAUTH_BOX_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Box OAuth Scope
+     * @default []
+     * @see https://developer.box.com/guides/api-calls/permissions-and-errors/scopes/
+     */
+    scope?: string[];
+    /**
+     * Box OAuth Authorization URL
+     * @default 'https://account.box.com/api/oauth2/authorize'
+     */
+    authorizationURL?: string;
+    /**
+     * Box OAuth Token URL
+     * @default 'https://api.box.com/oauth2/token'
+     */
+    tokenURL?: string;
+    /**
+     * Box User Info URL
+     * @default 'https://api.box.com/2.0/users/me'
+     */
+    userURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     * @see https://developer.box.com/guides/authentication/oauth2/oauth2-setup/
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_BOX_REDIRECT_URL
+     */
+    redirectURL?: string;
+}
+/**
+ * Box User object returned from /2.0/users/me
+ * @see https://developer.box.com/reference/get-users-me/
+ * @see https://www.postman.com/boxdev/box-s-public-workspace/example/8119550-f7344611-7834-4040-a4ae-d6b3ef95bfdb
+ */
+interface OAuthBoxUser {
+    type: 'user';
+    id: string;
+    name: string;
+    login: string;
+    created_at: string;
+    modified_at: string;
+    language: string;
+    timezone: string;
+    space_amount: number;
+    space_used: number;
+    max_upload_size: number;
+    status: 'active' | 'inactive' | 'cannot_delete_edit' | 'cannot_delete_edit_upload';
+    job_title?: string;
+    phone?: string;
+    address?: string;
+    avatar_url?: string;
+}
+/**
+ * Box OAuth tokens
+ * @see https://developer.box.com/reference/post-oauth2-token/
+ * @see https://www.postman.com/boxdev/box-s-public-workspace/example/8119550-70a8e5bd-4d25-494c-be2c-5409db9d1ace
+ */
+interface OAuthBoxTokens {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+    token_type: 'bearer';
+    restricted_to?: Array<{
+        scope: string;
+        object?: {
+            type: string;
+            id: string;
+        };
+    }>;
+}
+/**
+ * Define an OAuth event handler for Box authentication.
+ * @see https://developer.box.com/guides/authentication/oauth2/
+ * @see https://www.postman.com/boxdev/box-s-public-workspace/collection/trhp912/box-platform-api
+ */
+export declare function defineOAuthBoxEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthBoxConfig, {
+    user: OAuthBoxUser;
+    tokens: OAuthBoxTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export {};

package/dist/runtime/server/lib/oauth/box.js

@@ -0,0 +1,69 @@
+import { eventHandler, getQuery, sendRedirect, createError } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handleState, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthBoxEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.box, {
+      authorizationURL: "https://account.box.com/api/oauth2/authorize",
+      tokenURL: "https://api.box.com/oauth2/token",
+      userURL: "https://api.box.com/2.0/users/me",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const errorMessageParts = [query.error, query.error_description].filter(Boolean).join(": ");
+      const error = createError({
+        statusCode: 401,
+        message: `Box login failed: ${errorMessageParts || "Unknown error"}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId || !config.clientSecret) {
+      return handleMissingConfiguration(event, "box", ["clientId", "clientSecret"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    if (!query.code) {
+      const scope = config.scope || [];
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: scope.join(" "),
+          ...config.authorizationParams,
+          state
+        })
+      );
+    }
+    if (query.state !== state) {
+      return handleInvalidState(event, "box", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectURL,
+        code: query.code
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "box", tokens, onError);
+    }
+    const user = await $fetch(config.userURL, {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/cognito.js

@@ -2,7 +2,7 @@ import { defu } from "defu";
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { discovery } from "openid-client";
 import { withQuery } from "ufo";
-import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleMissingConfiguration, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthCognitoEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -24,6 +24,7 @@ export function defineOAuthCognitoEventHandler({ config, onSuccess, onError }) {
     } = issuer.serverMetadata();
     const query = getQuery(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["openid", "profile"];
       return sendRedirect(
@@ -33,10 +34,14 @@ export function defineOAuthCognitoEventHandler({ config, onSuccess, onError }) {
           redirect_uri: redirectURL,
           response_type: "code",
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "cognito", onError);
+    }
     const tokens = await requestAccessToken(
       tokenURL,
       {

package/dist/runtime/server/lib/oauth/discord.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthDiscordEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -19,6 +19,7 @@ export function defineOAuthDiscordEventHandler({ config, onSuccess, onError }) {
       return handleAccessTokenErrorResponse(event, "discord", query, onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("email")) {
@@ -34,10 +35,14 @@ export function defineOAuthDiscordEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "discord", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         client_id: config.clientId,

package/dist/runtime/server/lib/oauth/dropbox.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthDropboxEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +15,7 @@ export function defineOAuthDropboxEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "dropbox", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.includes("openid")) {
@@ -30,10 +31,14 @@ export function defineOAuthDropboxEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "dropbox", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`

package/dist/runtime/server/lib/oauth/facebook.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthFacebookEventHandler({
   config,
@@ -28,6 +28,7 @@ export function defineOAuthFacebookEventHandler({
       return handleMissingConfiguration(event, "facebook", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = [...new Set(config.scope)];
       return sendRedirect(
@@ -36,11 +37,14 @@ export function defineOAuthFacebookEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state: query.state || "",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "facebook", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         client_id: config.clientId,

package/dist/runtime/server/lib/oauth/gitea.js

@@ -5,6 +5,8 @@ import {
   handleMissingConfiguration,
   handleAccessTokenErrorResponse,
   getOAuthRedirectURL,
+  handleInvalidState,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
@@ -40,6 +42,7 @@ export function defineOAuthGiteaEventHandler({
       );
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.length) {
@@ -55,10 +58,14 @@ export function defineOAuthGiteaEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "gitea", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/github.js

@@ -37,8 +37,8 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/gitlab.js

@@ -5,6 +5,8 @@ import {
   handleMissingConfiguration,
   handleAccessTokenErrorResponse,
   getOAuthRedirectURL,
+  handleInvalidState,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
@@ -40,6 +42,7 @@ export function defineOAuthGitLabEventHandler({
       );
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.length) {
@@ -55,10 +58,14 @@ export function defineOAuthGitLabEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "gitlab", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",