nuxt-auth-utils 0.5.29 → 0.5.30

package/README.md

@@ -418,7 +418,7 @@ export default defineWebAuthnRegisterEventHandler({
     // And verify that the email is the same as the one in session
     const session = await getUserSession(event)
     if (session.user?.email && session.user.email !== userBody.userName) {
-      throw createError({ statusCode: 400, message: 'Email not matching curent session' })
+      throw createError({ statusCode: 400, message: 'Email not matching current session' })
     }
 
     // If he registers a new account with credentials

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.29",
+  "version": "0.5.30",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/app/plugins/session.client.js

@@ -3,7 +3,7 @@ export default defineNuxtPlugin(async (nuxtApp) => {
   if (!nuxtApp.payload.serverRendered) {
     await useUserSession().fetch();
   } else if (Boolean(nuxtApp.payload.prerenderedAt) || Boolean(nuxtApp.payload.isCached) || nuxtApp.$config.public.auth.loadStrategy === "client-only") {
-    nuxtApp.hook("app:mounted", async () => {
+    nuxtApp.hook("app:suspense:resolve", async () => {
       await useUserSession().fetch();
     });
   }

package/dist/runtime/server/lib/oauth/apple.js

@@ -1,7 +1,7 @@
 import { eventHandler, getRequestHeader, readBody, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, signJwt, verifyJwt } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken, signJwt, verifyJwt } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthAppleEventHandler({
   config,
@@ -19,10 +19,15 @@ export function defineOAuthAppleEventHandler({
     }
     const isPost = getRequestHeader(event, "content-type") === "application/x-www-form-urlencoded";
     let code;
+    let state;
     let user;
     if (isPost) {
-      ({ code, user } = await readBody(event));
+      ({ code, state, user } = await readBody(event));
     }
+    const storedState = await handleState(event, {
+      isCallback: isPost && Boolean(code),
+      sameSite: "none"
+    });
     if (!isPost || !code) {
       const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
       config.scope = Array.isArray(config.scope) ? config.scope.join(" ") : config.scope || "name email";
@@ -34,10 +39,14 @@ export function defineOAuthAppleEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state: storedState
         })
       );
     }
+    if (state !== storedState) {
+      return handleInvalidState(event, "apple", onError);
+    }
     try {
       const secret = await signJwt(
         {

package/dist/runtime/server/lib/oauth/atlassian.js

@@ -1,8 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { randomUUID } from "uncrypto";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthAtlassianEventHandler({
   config,
@@ -28,6 +27,7 @@ export function defineOAuthAtlassianEventHandler({
     }
     const query = getQuery(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       return sendRedirect(
         event,
@@ -36,10 +36,10 @@ export function defineOAuthAtlassianEventHandler({
           client_id: config.clientId,
           scope: config.scope?.join(" "),
           redirect_uri: redirectURL,
-          state: randomUUID(),
           response_type: "code",
           prompt: "consent",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
@@ -52,6 +52,9 @@ export function defineOAuthAtlassianEventHandler({
       if (!onError) throw error;
       return onError(event, error);
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "atlassian", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         "Content-Type": "application/json"

package/dist/runtime/server/lib/oauth/auth0.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthAuth0EventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -26,6 +26,7 @@ export function defineOAuthAuth0EventHandler({ config, onSuccess, onError }) {
         onError
       );
     }
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["openid", "offline_access"];
       if (config.emailRequired && !config.scope.includes("email")) {
@@ -41,10 +42,14 @@ export function defineOAuthAuth0EventHandler({ config, onSuccess, onError }) {
           audience: config.audience || "",
           max_age: config.maxAge || 0,
           connection: config.connection || "",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "auth0", onError);
+    }
     const tokens = await requestAccessToken(tokenURL, {
       headers: {
         "Content-Type": "application/json"

package/dist/runtime/server/lib/oauth/authentik.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthAuthentikEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -22,6 +22,7 @@ export function defineOAuthAuthentikEventHandler({ config, onSuccess, onError })
     const authorizationURL = `https://${config.domain}/application/o/authorize/`;
     const tokenURL = `https://${config.domain}/application/o/token/`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       return sendRedirect(
         event,
@@ -29,10 +30,14 @@ export function defineOAuthAuthentikEventHandler({ config, onSuccess, onError })
           response_type: "code",
           client_id: config.clientId,
           redirect_uri: redirectURL,
-          scope: (config.scope || ["openid", "profile", "email"]).join(" ")
+          scope: (config.scope || ["openid", "profile", "email"]).join(" "),
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "authentik", onError);
+    }
     const tokens = await requestAccessToken(tokenURL, {
       headers: {
         "Authorization": `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`,

package/dist/runtime/server/lib/oauth/azureb2c.js

@@ -27,10 +27,10 @@ export function defineOAuthAzureB2CEventHandler({ config, onSuccess, onError })
           response_type: "code",
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
           code_challenge: verifier.code_challenge,
           code_challenge_method: verifier.code_challenge_method,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/battledotnet.js

@@ -1,8 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { randomUUID } from "uncrypto";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -30,6 +29,7 @@ export function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError
       );
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["openid"];
       config.region = config.region || "EU";
@@ -43,13 +43,15 @@ export function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state: randomUUID(),
-          // Todo: handle PKCE flow
           response_type: "code",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "battledotnet", onError);
+    }
     config.scope = config.scope || [];
     if (!config.scope.includes("openid")) {
       config.scope.push("openid");

package/dist/runtime/server/lib/oauth/box.js

@@ -36,8 +36,8 @@ export function defineOAuthBoxEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: scope.join(" "),
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/cognito.js

@@ -2,7 +2,7 @@ import { defu } from "defu";
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { discovery } from "openid-client";
 import { withQuery } from "ufo";
-import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleMissingConfiguration, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthCognitoEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -24,6 +24,7 @@ export function defineOAuthCognitoEventHandler({ config, onSuccess, onError }) {
     } = issuer.serverMetadata();
     const query = getQuery(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["openid", "profile"];
       return sendRedirect(
@@ -33,10 +34,14 @@ export function defineOAuthCognitoEventHandler({ config, onSuccess, onError }) {
           redirect_uri: redirectURL,
           response_type: "code",
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "cognito", onError);
+    }
     const tokens = await requestAccessToken(
       tokenURL,
       {

package/dist/runtime/server/lib/oauth/discord.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthDiscordEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -19,6 +19,7 @@ export function defineOAuthDiscordEventHandler({ config, onSuccess, onError }) {
       return handleAccessTokenErrorResponse(event, "discord", query, onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("email")) {
@@ -34,10 +35,14 @@ export function defineOAuthDiscordEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "discord", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         client_id: config.clientId,

package/dist/runtime/server/lib/oauth/dropbox.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthDropboxEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +15,7 @@ export function defineOAuthDropboxEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "dropbox", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.includes("openid")) {
@@ -30,10 +31,14 @@ export function defineOAuthDropboxEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "dropbox", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`

package/dist/runtime/server/lib/oauth/facebook.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthFacebookEventHandler({
   config,
@@ -28,6 +28,7 @@ export function defineOAuthFacebookEventHandler({
       return handleMissingConfiguration(event, "facebook", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = [...new Set(config.scope)];
       return sendRedirect(
@@ -36,11 +37,14 @@ export function defineOAuthFacebookEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state: query.state || "",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "facebook", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         client_id: config.clientId,

package/dist/runtime/server/lib/oauth/gitea.js

@@ -5,6 +5,8 @@ import {
   handleMissingConfiguration,
   handleAccessTokenErrorResponse,
   getOAuthRedirectURL,
+  handleInvalidState,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
@@ -40,6 +42,7 @@ export function defineOAuthGiteaEventHandler({
       );
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.length) {
@@ -55,10 +58,14 @@ export function defineOAuthGiteaEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "gitea", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/github.js

@@ -37,8 +37,8 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/gitlab.js

@@ -5,6 +5,8 @@ import {
   handleMissingConfiguration,
   handleAccessTokenErrorResponse,
   getOAuthRedirectURL,
+  handleInvalidState,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
@@ -40,6 +42,7 @@ export function defineOAuthGitLabEventHandler({
       );
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.length) {
@@ -55,10 +58,14 @@ export function defineOAuthGitLabEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "gitlab", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/google.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthGoogleEventHandler({
   config,
@@ -20,6 +20,7 @@ export function defineOAuthGoogleEventHandler({
       return handleMissingConfiguration(event, "google", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["email", "profile"];
       return sendRedirect(
@@ -29,11 +30,14 @@ export function defineOAuthGoogleEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state: query.state || "",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "google", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/heroku.js

@@ -40,8 +40,8 @@ export function defineOAuthHerokuEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/hubspot.js

@@ -5,6 +5,8 @@ import {
   getOAuthRedirectURL,
   handleAccessTokenErrorResponse,
   handleMissingConfiguration,
+  handleInvalidState,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
@@ -19,16 +21,21 @@ export function defineOAuthHubspotEventHandler({ config, onSuccess, onError }) {
     if (query.error) {
       return handleAccessTokenErrorResponse(event, "hubspot", query, onError);
     }
+    const state = await handleState(event);
     if (!query.code) {
       return sendRedirect(
         event,
         withQuery("https://app.hubspot.com/oauth/authorize", {
           client_id: config.clientId,
           redirect_uri: redirectURL,
-          scope: config.scope?.join(" ") || "oauth"
+          scope: config.scope?.join(" ") || "oauth",
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "hubspot", onError);
+    }
     const tokens = await requestAccessToken(
       "https://api.hubapi.com/oauth/v1/token",
       {

package/dist/runtime/server/lib/oauth/instagram.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthInstagramEventHandler({
   config,
@@ -33,6 +33,7 @@ export function defineOAuthInstagramEventHandler({
       return handleMissingConfiguration(event, "instagram", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       return sendRedirect(
@@ -41,10 +42,14 @@ export function defineOAuthInstagramEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(),
-          response_type: "code"
+          response_type: "code",
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "instagram", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         client_id: config.clientId,

package/dist/runtime/server/lib/oauth/keycloak.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthKeycloakEventHandler({
   config,
@@ -30,6 +30,7 @@ export function defineOAuthKeycloakEventHandler({
     const authorizationURL = `${realmURL}/protocol/openid-connect/auth`;
     const tokenURL = `${realmURLInternal}/protocol/openid-connect/token`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["openid"];
       return sendRedirect(
@@ -40,10 +41,14 @@ export function defineOAuthKeycloakEventHandler({
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           response_type: "code",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "keycloak", onError);
+    }
     config.scope = config.scope || [];
     if (!config.scope.includes("openid")) {
       config.scope.push("openid");

package/dist/runtime/server/lib/oauth/kick.js

@@ -1,8 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { randomUUID } from "uncrypto";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken, handlePkceVerifier } from "../utils.js";
+import { handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken, handlePkceVerifier, handleState } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthKickEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +14,7 @@ export function defineOAuthKickEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "kick", ["clientId", "clientSecret"], onError);
     }
     const verifier = await handlePkceVerifier(event);
+    const state = await handleState(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     if (!query.code) {
       config.scope = config.scope || [];
@@ -27,12 +27,15 @@ export function defineOAuthKickEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state: randomUUID(),
+          state,
           code_challenge: verifier.code_challenge,
           code_challenge_method: verifier.code_challenge_method
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "kick", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",