nuxt-auth-utils 0.5.29 → 0.5.31

package/dist/runtime/server/lib/oauth/line.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthLineEventHandler({
   config,
@@ -29,6 +29,7 @@ export function defineOAuthLineEventHandler({
       return handleMissingConfiguration(event, "line", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["profile", "openid"];
       return sendRedirect(
@@ -38,11 +39,14 @@ export function defineOAuthLineEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state: query.state || "",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "line", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/linear.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthLinearEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -24,6 +24,7 @@ export function defineOAuthLinearEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "linear", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["read"];
       return sendRedirect(
@@ -33,10 +34,14 @@ export function defineOAuthLinearEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "linear", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"

package/dist/runtime/server/lib/oauth/linkedin.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthLinkedInEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +15,7 @@ export function defineOAuthLinkedInEventHandler({ config, onSuccess, onError })
       return handleMissingConfiguration(event, "linkedin", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.length) {
@@ -30,10 +31,14 @@ export function defineOAuthLinkedInEventHandler({ config, onSuccess, onError })
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "linkedin", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/livechat.js

@@ -1,11 +1,12 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { defu } from "defu";
 import { withQuery } from "ufo";
-import { randomUUID } from "uncrypto";
 import {
   getOAuthRedirectURL,
   handleAccessTokenErrorResponse,
+  handleInvalidState,
   handleMissingConfiguration,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
@@ -19,9 +20,7 @@ export function defineOAuthLiveChatEventHandler({
       authorizationURL: "https://accounts.livechat.com",
       tokenURL: "https://accounts.livechat.com/v2/token",
       userURL: "https://accounts.livechat.com/v2/accounts/me",
-      authorizationParams: {
-        state: randomUUID()
-      }
+      authorizationParams: {}
     });
     if (!config.clientId || !config.clientSecret) {
       return handleMissingConfiguration(
@@ -33,6 +32,7 @@ export function defineOAuthLiveChatEventHandler({
     }
     const query = getQuery(event);
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       return sendRedirect(
         event,
@@ -41,10 +41,14 @@ export function defineOAuthLiveChatEventHandler({
           redirect_uri: redirectURL,
           response_type: "code",
           scope: config.scope?.length ? config.scope.join(" ") : void 0,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "livechat", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       params: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/microsoft.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +15,7 @@ export function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError })
     const authorizationURL = config.authorizationURL || `https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/authorize`;
     const tokenURL = config.tokenURL || `https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/token`;
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope && config.scope.length > 0 ? config.scope : ["User.Read"];
       config.scope = [...new Set(config.scope)];
@@ -25,11 +26,14 @@ export function defineOAuthMicrosoftEventHandler({ config, onSuccess, onError })
           response_type: "code",
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state: query.state || "",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "microsoft", onError);
+    }
     const tokens = await requestAccessToken(tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/oidc.js

@@ -32,10 +32,10 @@ export function defineOAuthOidcEventHandler({ config, onSuccess, onError }) {
         client_id: config.clientId,
         redirect_uri: redirectURL,
         scope: config.scope.join(" "),
-        state,
         nonce,
         response_type: "code",
-        ...config.params?.authorization_endpoint
+        ...config.params?.authorization_endpoint,
+        state
       };
       authQuery.code_challenge = verifier.code_challenge;
       authQuery.code_challenge_method = verifier.code_challenge_method;

package/dist/runtime/server/lib/oauth/okta.js

@@ -1,4 +1,4 @@
-import { eventHandler, getQuery, sendRedirect, createError, deleteCookie } from "h3";
+import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
 import { handleMissingConfiguration, handleState, handleInvalidState, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
@@ -108,13 +108,12 @@ export function defineOAuthOktaEventHandler({ config, onSuccess, onError }) {
           audience: config.audience || "",
           max_age: config.maxAge || 0,
           connection: config.connection || "",
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
     if (query.state !== state) {
-      deleteCookie(event, "nuxt-auth-state");
       return handleInvalidState(event, "okta", onError);
     }
     const tokens = await requestAccessToken(tokenURL, {

package/dist/runtime/server/lib/oauth/ory.js

@@ -49,10 +49,10 @@ export function defineOAuthOryEventHandler({ config, onSuccess, onError }) {
           response_type: "code",
           redirect_uri: redirectURL,
           scope: config.scope,
-          state,
           code_challenge: verifier.code_challenge,
           code_challenge_method: verifier.code_challenge_method,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/osu.js

@@ -28,8 +28,8 @@ export function defineOAuthOsuEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/paypal.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthPaypalEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -22,6 +22,7 @@ export function defineOAuthPaypalEventHandler({ config, onSuccess, onError }) {
       config.tokenURL = `https://${paypalAPI}/v1/oauth2/token`;
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.includes("openid")) {
@@ -38,10 +39,14 @@ export function defineOAuthPaypalEventHandler({ config, onSuccess, onError }) {
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
           flowEntry: "static",
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "paypal", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`

package/dist/runtime/server/lib/oauth/polar.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, getOAuthRedirectURL, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthPolarEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -14,6 +14,7 @@ export function defineOAuthPolarEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "polar", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.includes("openid"))
@@ -27,10 +28,14 @@ export function defineOAuthPolarEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "polar", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/riotgames.js

@@ -38,8 +38,8 @@ export function defineOAuthRiotGamesEventHandler({ config, onSuccess, onError })
           redirect_uri: redirectURL,
           response_type: "code",
           scope: config.scope.join(" "),
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/roblox.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthRobloxEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -18,6 +18,7 @@ export function defineOAuthRobloxEventHandler({ config, onSuccess, onError }) {
       return handleAccessTokenErrorResponse(event, "roblox", query, onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       return sendRedirect(
@@ -27,10 +28,14 @@ export function defineOAuthRobloxEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "roblox", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         client_id: config.clientId,

package/dist/runtime/server/lib/oauth/salesforce.js

@@ -40,8 +40,8 @@ export function defineOAuthSalesforceEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/seznam.js

@@ -1,7 +1,7 @@
 import defu from "defu";
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
-import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleMissingConfiguration, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthSeznamEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +15,7 @@ export function defineOAuthSeznamEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "seznam", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || ["identity"];
       return sendRedirect(
@@ -24,10 +25,13 @@ export function defineOAuthSeznamEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(","),
-          state: query.state || ""
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "seznam", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/shopifyCustomer.js

@@ -1,7 +1,7 @@
 import { createError, eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthShopifyCustomerEventHandler({
   config,
@@ -42,6 +42,9 @@ export function defineOAuthShopifyCustomerEventHandler({
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "shopifyCustomer", onError);
+    }
     const tokens = await requestAccessToken(discoveryResponse.token_endpoint, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/slack.js

@@ -40,8 +40,8 @@ export function defineOAuthSlackEventHandler({
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          state,
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }

package/dist/runtime/server/lib/oauth/spotify.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +15,7 @@ export function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "spotify", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user-read-email")) {
@@ -27,10 +28,14 @@ export function defineOAuthSpotifyEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "spotify", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       headers: {
         Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`

package/dist/runtime/server/lib/oauth/steam.js

@@ -1,7 +1,7 @@
 import { eventHandler, createError, getQuery, getRequestURL, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration } from "../utils.js";
+import { handleInvalidState, handleMissingConfiguration, handleState } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -13,8 +13,9 @@ export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "steam", ["apiKey"], onError);
     }
     const url = getRequestURL(event);
+    const state = await handleState(event, { isCallback: Boolean(query["openid.claimed_id"]) });
     if (!query["openid.claimed_id"]) {
-      const redirectURL = config.redirectURL || getRequestURL(event).href;
+      const redirectURL = withQuery(config.redirectURL || getRequestURL(event).href, { state });
       const realm = url.port ? `${url.protocol}//${url.hostname}:${url.port}` : `${url.protocol}//${url.hostname}`;
       const steamOpenIdParams = {
         "openid.ns": "http://specs.openid.net/auth/2.0",
@@ -26,6 +27,9 @@ export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
       };
       return sendRedirect(event, withQuery(config.authorizationURL, steamOpenIdParams));
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "steam", onError);
+    }
     if (!query["openid.signed"] || !query["openid.sig"]) {
       const error = createError({
         statusCode: 400,

package/dist/runtime/server/lib/oauth/strava.js

@@ -4,7 +4,9 @@ import { defu } from "defu";
 import {
   getOAuthRedirectURL,
   handleAccessTokenErrorResponse,
+  handleInvalidState,
   handleMissingConfiguration,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
@@ -36,6 +38,7 @@ export function defineOAuthStravaEventHandler({
     const authorizationURL = "https://www.strava.com/oauth/authorize";
     const tokenURL = "https://www.strava.com/oauth/token";
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       return sendRedirect(
         event,
@@ -44,10 +47,14 @@ export function defineOAuthStravaEventHandler({
           redirect_uri: redirectURL,
           response_type: "code",
           approval_prompt: config.approvalPrompt || "auto",
-          scope: config.scope
+          scope: config.scope,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "strava", onError);
+    }
     const tokens = await requestAccessToken(tokenURL, {
       body: {
         client_id: config.clientId,

package/dist/runtime/server/lib/oauth/tiktok.js

@@ -2,7 +2,7 @@ import crypto from "node:crypto";
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleAccessTokenErrorResponse, handleMissingConfiguration, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, getOAuthRedirectURL, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthTikTokEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -17,6 +17,7 @@ export function defineOAuthTikTokEventHandler({ config, onSuccess, onError }) {
     }
     const codeVerifier = "verify";
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (!config.scope.includes("user.info.basic")) {
@@ -33,10 +34,14 @@ export function defineOAuthTikTokEventHandler({ config, onSuccess, onError }) {
             code_verifier: codeVerifier,
             code_challenge: crypto.createHash("sha256").update(codeVerifier).digest("hex"),
             code_challenge_method: "S256"
-          } : {}
+          } : {},
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "tiktok", onError);
+    }
     const tokens = await requestAccessToken(
       config.tokenURL,
       {

package/dist/runtime/server/lib/oauth/twitch.js

@@ -1,7 +1,7 @@
 import { eventHandler, getQuery, sendRedirect } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
-import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken } from "../utils.js";
+import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
 export function defineOAuthTwitchEventHandler({ config, onSuccess, onError }) {
   return eventHandler(async (event) => {
@@ -15,6 +15,7 @@ export function defineOAuthTwitchEventHandler({ config, onSuccess, onError }) {
       return handleMissingConfiguration(event, "twitch", ["clientId", "clientSecret"], onError);
     }
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("user:read:email")) {
@@ -27,10 +28,14 @@ export function defineOAuthTwitchEventHandler({ config, onSuccess, onError }) {
           client_id: config.clientId,
           redirect_uri: redirectURL,
           scope: config.scope.join(" "),
-          ...config.authorizationParams
+          ...config.authorizationParams,
+          state
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "twitch", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",

package/dist/runtime/server/lib/oauth/vk.js

@@ -6,6 +6,8 @@ import {
   handleMissingConfiguration,
   handleAccessTokenErrorResponse,
   getOAuthRedirectURL,
+  handleInvalidState,
+  handleState,
   requestAccessToken
 } from "../utils.js";
 import { useRuntimeConfig, createError } from "#imports";
@@ -31,6 +33,7 @@ export function defineOAuthVKEventHandler({
     }
     const codeVerifier = "verify";
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
     if (!query.code) {
       config.scope = config.scope || [];
       if (config.emailRequired && !config.scope.includes("email")) {
@@ -43,12 +46,15 @@ export function defineOAuthVKEventHandler({
           client_id: config.clientId,
           code_challenge: crypto.createHash("sha256").update(codeVerifier).digest("base64url"),
           code_challenge_method: "s256",
-          state: crypto.randomUUID(),
+          state,
           redirect_uri: redirectURL,
           scope: config.scope.join(" ")
         })
       );
     }
+    if (query.state !== state) {
+      return handleInvalidState(event, "vk", onError);
+    }
     const tokens = await requestAccessToken(config.tokenURL, {
       body: {
         grant_type: "authorization_code",