nuxt-auth-utils 0.5.31 → 0.5.33

package/README.md

@@ -7,7 +7,7 @@
 
 Add Authentication to Nuxt applications with secured & sealed cookies sessions.
 
-- [Release Notes](/CHANGELOG.md)
+- [Release Notes](https://github.com/atinux/nuxt-auth-utils/releases)
 - [Demo with OAuth](https://github.com/atinux/atidone)
 - [Demo with Passkeys](https://github.com/atinux/todo-passkeys)
 <!-- - [🏀 Online playground](https://stackblitz.com/github/your-org/nuxt-auth-utils?file=playground%2Fapp.vue) -->
@@ -220,6 +220,7 @@ It can also be set using environment variables:
 - Battle.net
 - Bluesky (AT Protocol)
 - Box.com
+- Cloudflare
 - Discord
 - Dropbox
 - Facebook
@@ -236,6 +237,7 @@ It can also be set using environment variables:
 - Linear
 - LinkedIn
 - LiveChat
+- Mastodon
 - Microsoft
 - OIDC / OpenID Connect (Generic)
 - Okta
@@ -254,6 +256,7 @@ It can also be set using environment variables:
 - TikTok
 - Twitch
 - VK
+- WeChat
 - WorkOS
 - X (Twitter)
 - XSUAA
@@ -291,6 +294,34 @@ Make sure to set the callback URL in your OAuth app settings as `<your-domain>/a
 
 If the redirect URL mismatch in production, this means that the module cannot guess the right redirect URL. You can set the `NUXT_OAUTH_<PROVIDER>_REDIRECT_URL` env variable to overwrite the default one.
 
+#### Mastodon
+
+Mastodon does not have a single shared OAuth server: every account lives on its own instance (e.g. `mastodon.social`, `h4.io`), and there is no portable identity across instances the way there is with AT Protocol/Bluesky. Because of this, the provider needs to know which instance to talk to before it can start the flow, and it registers an application against that instance on first use via `POST /api/v1/apps` (Mastodon's own API, not the RFC 7591 Dynamic Client Registration spec it superficially resembles).
+
+```ts
+// server/routes/auth/mastodon.get.ts
+export default defineOAuthMastodonEventHandler({
+  async onSuccess(event, { user }) {
+    await setUserSession(event, {
+      user: {
+        mastodon: user.acct,
+      },
+    })
+    return sendRedirect(event, '/')
+  },
+})
+```
+
+The instance can be provided either as a static `instance` config/`NUXT_OAUTH_MASTODON_INSTANCE` env variable, or per-request as an `instance` query parameter, e.g. `/auth/mastodon?instance=mastodon.social`:
+
+```ts
+navigateTo({ path: '/auth/mastodon', query: { instance: 'mastodon.social' } }, { external: true })
+```
+
+A full handle (`@user@mastodon.social`) is also accepted and only the instance part is used, since that's all that is required to start the OAuth flow.
+
+Registered apps are cached in memory per instance and redirect URL for the lifetime of the server process, so it does not re-register on every login. The callback doesn't depend on this cache, so after a restart or on another worker, the next login only registers a new application.
+
 ### Password Hashing
 
 Nuxt Auth Utils provides password hashing utilities like `hashPassword` and `verifyPassword` to hash and verify passwords by using [scrypt](https://en.wikipedia.org/wiki/Scrypt) as it is supported in many JS runtime.
@@ -778,6 +809,27 @@ await setUserSession(event, { ... } , {
 
 Checkout the [`SessionConfig`](https://github.com/unjs/h3/blob/c04c458810e34eb15c1647e1369e7d7ef19f567d/src/utils/session.ts#L20) for all options.
 
+## Shared session between microservices and subdomains
+
+To share a session between multiple applications, use the same `NUXT_SESSION_PASSWORD` and session `name` in each of them.
+
+If the applications run on different subdomains, also set the session cookie `domain` to the parent domain in each `nuxt.config.ts`:
+
+```ts
+export default defineNuxtConfig({
+  modules: ['nuxt-auth-utils'],
+  runtimeConfig: {
+    session: {
+      cookie: {
+        domain: '.example.com'
+      }
+    }
+  }
+})
+```
+
+The browser then sends the session cookie to every subdomain of `example.com`, and each application can decrypt it.
+
 ## More
 
 - [nuxt-authorization](https://github.com/barbapapazes/nuxt-authorization): Authorization module for managing permissions inside a Nuxt app, compatible with `nuxt-auth-utils`
@@ -803,11 +855,10 @@ pnpm run lint
 # Run Vitest
 pnpm run test
 pnpm run test:watch
-
-# Release new version
-pnpm run release
 ```
 
+Releases are automated with [uppt](https://github.com/danielroe/uppt): every push to `main` opens or updates a draft release PR from conventional commits. Merging it tags the version, creates the GitHub release and stages the npm publish, which is then approved on npmjs.com.
+
 <!-- Badges -->
 [npm-version-src]: https://img.shields.io/npm/v/nuxt-auth-utils/latest.svg?style=flat&colorA=020420&colorB=00DC82
 [npm-version-href]: https://npmjs.com/package/nuxt-auth-utils

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.5.31",
+  "version": "0.5.33",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -191,6 +191,11 @@ const module$1 = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.cloudflare = defu(runtimeConfig.oauth.cloudflare, {
+      clientId: "",
+      clientSecret: "",
+      redirectURL: ""
+    });
     for (const provider of atprotoProviders) {
       runtimeConfig.oauth[provider] = defu(runtimeConfig.oauth[provider], atprotoProviderDefaultClientMetadata);
     }
@@ -235,6 +240,11 @@ const module$1 = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.mastodon = defu(runtimeConfig.oauth.mastodon, {
+      instance: "",
+      clientName: "",
+      redirectURL: ""
+    });
     runtimeConfig.oauth.cognito = defu(runtimeConfig.oauth.cognito, {
       clientId: "",
       clientSecret: "",
@@ -245,7 +255,8 @@ const module$1 = defineNuxtModule({
     runtimeConfig.oauth.facebook = defu(runtimeConfig.oauth.facebook, {
       clientId: "",
       clientSecret: "",
-      redirectURL: ""
+      redirectURL: "",
+      apiVersion: "v25.0"
     });
     runtimeConfig.oauth.instagram = defu(runtimeConfig.oauth.instagram, {
       clientId: "",
@@ -329,6 +340,12 @@ const module$1 = defineNuxtModule({
       clientSecret: "",
       redirectURL: ""
     });
+    runtimeConfig.oauth.wechat = defu(runtimeConfig.oauth.wechat, {
+      appId: "",
+      appSecret: "",
+      redirectURL: "",
+      scope: []
+    });
     runtimeConfig.oauth.atlassian = defu(runtimeConfig.oauth.atlassian, {
       clientId: "",
       clientSecret: "",
@@ -355,6 +372,7 @@ const module$1 = defineNuxtModule({
       clientSecret: "",
       redirectURL: "",
       baseURL: "",
+      userURL: "",
       scope: ""
     });
     runtimeConfig.oauth.slack = defu(runtimeConfig.oauth.slack, {

package/dist/runtime/app/composables/session.js

@@ -4,8 +4,9 @@ export function useUserSession() {
   const serverEvent = import.meta.server ? useRequestEvent() : null;
   const sessionState = useState("nuxt-session", () => null);
   const authReadyState = useState("nuxt-auth-ready", () => false);
+  const requestFetch = useRequestFetch();
   const clear = async () => {
-    await useRequestFetch()("/api/_auth/session", {
+    await requestFetch("/api/_auth/session", {
       method: "DELETE",
       onResponse({ response: { headers } }) {
         if (import.meta.server && serverEvent) {
@@ -18,7 +19,7 @@ export function useUserSession() {
     sessionState.value = null;
   };
   const fetch = async () => {
-    sessionState.value = await useRequestFetch()("/api/_auth/session", {
+    sessionState.value = await requestFetch("/api/_auth/session", {
       headers: {
         accept: "application/json"
       },
@@ -35,7 +36,11 @@ export function useUserSession() {
     }
   };
   const openInPopup = (route, size = {}) => {
-    localStorage.setItem("temp-nuxt-auth-utils-popup", "true");
+    try {
+      localStorage.setItem("temp-nuxt-auth-utils-popup", "true");
+    } catch (error) {
+      console.error("[nuxt-auth-utils] Could not use localStorage during popup flow initialization.", error);
+    }
     const width = size.width ?? 960;
     const height = size.height ?? 600;
     const top = (window.top?.outerHeight ?? 0) / 2 + (window.top?.screenY ?? 0) - height / 2;

package/dist/runtime/app/plugins/session.client.js

@@ -7,9 +7,13 @@ export default defineNuxtPlugin(async (nuxtApp) => {
       await useUserSession().fetch();
     });
   }
-  if (localStorage.getItem("temp-nuxt-auth-utils-popup")) {
-    localStorage.removeItem("temp-nuxt-auth-utils-popup");
-    const error = useError();
-    if (!error.value) window.close();
+  try {
+    if (localStorage.getItem("temp-nuxt-auth-utils-popup")) {
+      localStorage.removeItem("temp-nuxt-auth-utils-popup");
+      const error = useError();
+      if (!error.value) window.close();
+    }
+  } catch (error) {
+    console.error("[nuxt-auth-utils] Could not use localStorage during popup flow last step. Popup won't be closed automatically.", error);
   }
 });

package/dist/runtime/server/lib/oauth/apple.js

@@ -44,7 +44,7 @@ export function defineOAuthAppleEventHandler({
         })
       );
     }
-    if (state !== storedState) {
+    if (!storedState || state !== storedState) {
       return handleInvalidState(event, "apple", onError);
     }
     try {
@@ -71,6 +71,9 @@ export function defineOAuthAppleEventHandler({
           redirect_uri: config.redirectURL
         }
       });
+      if (accessTokenResult.error) {
+        return handleAccessTokenErrorResponse(event, "apple", accessTokenResult, onError);
+      }
       const payload = await verifyJwt(accessTokenResult.id_token, {
         publicJwkUrl: "https://appleid.apple.com/auth/keys",
         audience: config.clientId,

package/dist/runtime/server/lib/oauth/atlassian.js

@@ -52,7 +52,7 @@ export function defineOAuthAtlassianEventHandler({
       if (!onError) throw error;
       return onError(event, error);
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "atlassian", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/auth0.js

@@ -47,7 +47,7 @@ export function defineOAuthAuth0EventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "auth0", onError);
     }
     const tokens = await requestAccessToken(tokenURL, {

package/dist/runtime/server/lib/oauth/authentik.js

@@ -35,7 +35,7 @@ export function defineOAuthAuthentikEventHandler({ config, onSuccess, onError })
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "authentik", onError);
     }
     const tokens = await requestAccessToken(tokenURL, {

package/dist/runtime/server/lib/oauth/azureb2c.js

@@ -34,7 +34,7 @@ export function defineOAuthAzureB2CEventHandler({ config, onSuccess, onError })
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "azureb2c", onError);
     }
     const tokens = await requestAccessToken(tokenURL, {

package/dist/runtime/server/lib/oauth/battledotnet.js

@@ -49,7 +49,7 @@ export function defineOAuthBattledotnetEventHandler({ config, onSuccess, onError
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "battledotnet", onError);
     }
     config.scope = config.scope || [];

package/dist/runtime/server/lib/oauth/box.js

@@ -41,7 +41,7 @@ export function defineOAuthBoxEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "box", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/cloudflare.d.ts

@@ -0,0 +1,86 @@
+import type { OAuthConfig } from '#auth-utils';
+/**
+ * Cloudflare OAuth provider — Authorization Code flow (the only flow Cloudflare supports).
+ *
+ * References:
+ * - Endpoints:  https://developers.cloudflare.com/fundamentals/oauth/integrate-with-cloudflare/
+ * - Flow/PKCE:  https://developers.cloudflare.com/fundamentals/oauth/create-an-oauth-client/#supported-oauth-flows
+ * - Scopes:     https://developers.cloudflare.com/fundamentals/oauth/create-an-oauth-client/#select-scopes
+ *
+ * Scopes are dot-notation API-permission names (e.g. `workers-platform.read`) fetched from
+ * `GET /client/v4/oauth/scopes` — `openid` is NOT a Cloudflare scope. PKCE (S256) is required
+ * for public clients (auth method `none`) and optional for confidential clients (client secret).
+ */
+export interface OAuthCloudflareConfig {
+    /**
+     * Cloudflare OAuth Client ID
+     * @default process.env.NUXT_OAUTH_CLOUDFLARE_CLIENT_ID
+     */
+    clientId?: string;
+    /**
+     * Cloudflare OAuth Client Secret. Required for confidential clients
+     * (`client_secret_post`/`client_secret_basic`); omit for public PKCE-only
+     * clients (`token_endpoint_auth_method=none`).
+     * @default process.env.NUXT_OAUTH_CLOUDFLARE_CLIENT_SECRET
+     */
+    clientSecret?: string;
+    /**
+     * Cloudflare OAuth scopes — dot-notation API token permission IDs from
+     * `GET /client/v4/oauth/scopes`, matching the scopes the client was registered with.
+     * Cloudflare requires at least one; there is no default (`openid` is not a Cloudflare scope).
+     * @see https://developers.cloudflare.com/fundamentals/oauth/create-an-oauth-client/#select-scopes
+     * @example ['workers-platform.read']
+     */
+    scope?: string[];
+    /**
+     * Cloudflare OAuth Authorization URL
+     * @default 'https://dash.cloudflare.com/oauth2/auth'
+     */
+    authorizationURL?: string;
+    /**
+     * Cloudflare OAuth Token URL
+     * @default 'https://dash.cloudflare.com/oauth2/token'
+     */
+    tokenURL?: string;
+    /**
+     * Cloudflare OIDC userinfo URL. Returns standard claims (`sub`, `iss`, `aud`, …);
+     * use `GET /client/v4/user` for email/name.
+     * @default 'https://dash.cloudflare.com/oauth2/userinfo'
+     */
+    userURL?: string;
+    /**
+     * Extra authorization parameters to provide to the authorization URL
+     */
+    authorizationParams?: Record<string, string>;
+    /**
+     * Redirect URL to allow overriding for situations like prod failing to determine public hostname
+     * @default process.env.NUXT_OAUTH_CLOUDFLARE_REDIRECT_URL or current URL
+     */
+    redirectURL?: string;
+}
+/**
+ * Claims returned by Cloudflare's `/oauth2/userinfo` endpoint. `sub` is the stable
+ * Cloudflare user ID; the rest are standard OIDC token claims. There is no email/name
+ * here — for richer profile data call `GET /client/v4/user` with the access token.
+ */
+export interface CloudflareUser {
+    /** Stable Cloudflare user ID. */
+    sub: string;
+    aud?: string[];
+    iss?: string;
+    iat?: number;
+    auth_time?: number;
+    rat?: number;
+}
+export interface CloudflareTokens {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    /** Present when scope includes `offline_access` */
+    refresh_token?: string;
+    scope: string;
+}
+export declare function defineOAuthCloudflareEventHandler({ config, onSuccess, onError }: OAuthConfig<OAuthCloudflareConfig, {
+    user: CloudflareUser;
+    tokens: CloudflareTokens;
+}>): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/lib/oauth/cloudflare.js

@@ -0,0 +1,72 @@
+import { eventHandler, getQuery, sendRedirect, createError } from "h3";
+import { withQuery } from "ufo";
+import { defu } from "defu";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleMissingConfiguration, handlePkceVerifier, handleState, requestAccessToken } from "../utils.js";
+import { useRuntimeConfig } from "#imports";
+export function defineOAuthCloudflareEventHandler({ config, onSuccess, onError }) {
+  return eventHandler(async (event) => {
+    config = defu(config, useRuntimeConfig(event).oauth?.cloudflare, {
+      authorizationURL: "https://dash.cloudflare.com/oauth2/auth",
+      tokenURL: "https://dash.cloudflare.com/oauth2/token",
+      userURL: "https://dash.cloudflare.com/oauth2/userinfo",
+      authorizationParams: {}
+    });
+    const query = getQuery(event);
+    if (query.error) {
+      const error = createError({
+        statusCode: 401,
+        message: `Cloudflare login failed: ${query.error_description || query.error}`,
+        data: query
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
+    if (!config.clientId) {
+      return handleMissingConfiguration(event, "cloudflare", ["clientId"], onError);
+    }
+    const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
+    const state = await handleState(event);
+    const pkce = await handlePkceVerifier(event);
+    if (!query.code) {
+      return sendRedirect(
+        event,
+        withQuery(config.authorizationURL, {
+          response_type: "code",
+          client_id: config.clientId,
+          redirect_uri: redirectURL,
+          scope: config.scope?.length ? config.scope.join(" ") : void 0,
+          ...config.authorizationParams,
+          code_challenge: pkce.code_challenge,
+          code_challenge_method: pkce.code_challenge_method,
+          state
+        })
+      );
+    }
+    if (!state || query.state !== state) {
+      return handleInvalidState(event, "cloudflare", onError);
+    }
+    const tokens = await requestAccessToken(config.tokenURL, {
+      body: {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        // Public (PKCE-only) clients authenticate with `none` and send no secret.
+        ...config.clientSecret ? { client_secret: config.clientSecret } : {},
+        redirect_uri: redirectURL,
+        code: query.code,
+        code_verifier: pkce.code_verifier
+      }
+    });
+    if (tokens.error) {
+      return handleAccessTokenErrorResponse(event, "cloudflare", tokens, onError);
+    }
+    const user = await $fetch(config.userURL, {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`
+      }
+    });
+    return onSuccess(event, {
+      user,
+      tokens
+    });
+  });
+}

package/dist/runtime/server/lib/oauth/cognito.js

@@ -39,7 +39,7 @@ export function defineOAuthCognitoEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "cognito", onError);
     }
     const tokens = await requestAccessToken(

package/dist/runtime/server/lib/oauth/discord.js

@@ -40,7 +40,7 @@ export function defineOAuthDiscordEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "discord", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/dropbox.js

@@ -36,7 +36,7 @@ export function defineOAuthDropboxEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "dropbox", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/facebook.d.ts

@@ -10,6 +10,12 @@ export interface OAuthFacebookConfig {
      * @default process.env.NUXT_OAUTH_FACEBOOK_CLIENT_SECRET
      */
     clientSecret?: string;
+    /**
+     * Facebook Graph API version used for default OAuth and /me URLs
+     * @default 'v25.0'
+     * @see https://developers.facebook.com/docs/graph-api/changelog/versions/
+     */
+    apiVersion?: string;
     /**
      * Facebook OAuth Scope
      * @default []
@@ -26,14 +32,19 @@ export interface OAuthFacebookConfig {
     fields?: string[];
     /**
      * Facebook OAuth Authorization URL
-     * @default 'https://www.facebook.com/v19.0/dialog/oauth'
+     * @default 'https://www.facebook.com/${apiVersion}/dialog/oauth'
      */
     authorizationURL?: string;
     /**
      * Facebook OAuth Token URL
-     * @default 'https://graph.facebook.com/v19.0/oauth/access_token'
+     * @default 'https://graph.facebook.com/${apiVersion}/oauth/access_token'
      */
     tokenURL?: string;
+    /**
+     * Facebook Graph API user profile URL
+     * @default 'https://graph.facebook.com/${apiVersion}/me'
+     */
+    userURL?: string;
     /**
      * Extra authorization parameters to provide to the authorization URL
      * @see https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/

package/dist/runtime/server/lib/oauth/facebook.js

@@ -1,6 +1,7 @@
 import { eventHandler, getQuery, sendRedirect, createError } from "h3";
 import { withQuery } from "ufo";
 import { defu } from "defu";
+import { subtle } from "uncrypto";
 import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, handleInvalidState, handleState, requestAccessToken } from "../utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineOAuthFacebookEventHandler({
@@ -9,9 +10,12 @@ export function defineOAuthFacebookEventHandler({
   onError
 }) {
   return eventHandler(async (event) => {
+    const apiVersion = config?.apiVersion || useRuntimeConfig(event).oauth?.facebook?.apiVersion || "v25.0";
     config = defu(config, useRuntimeConfig(event).oauth?.facebook, {
-      authorizationURL: "https://www.facebook.com/v19.0/dialog/oauth",
-      tokenURL: "https://graph.facebook.com/v19.0/oauth/access_token",
+      apiVersion,
+      authorizationURL: `https://www.facebook.com/${apiVersion}/dialog/oauth`,
+      tokenURL: `https://graph.facebook.com/${apiVersion}/oauth/access_token`,
+      userURL: `https://graph.facebook.com/${apiVersion}/me`,
       authorizationParams: {}
     });
     const query = getQuery(event);
@@ -42,7 +46,7 @@ export function defineOAuthFacebookEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "facebook", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {
@@ -60,8 +64,16 @@ export function defineOAuthFacebookEventHandler({
     const accessToken = tokens.access_token;
     config.fields = [...new Set(config.fields || ["id", "name"])];
     const fields = config.fields.join(",");
+    const encoder = new TextEncoder();
+    const key = await subtle.importKey("raw", encoder.encode(config.clientSecret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signature = await subtle.sign("HMAC", key, encoder.encode(accessToken));
+    const appsecretProof = Array.from(new Uint8Array(signature), (b) => b.toString(16).padStart(2, "0")).join("");
     const user = await $fetch(
-      `https://graph.facebook.com/v19.0/me?fields=${fields}&access_token=${accessToken}`
+      withQuery(config.userURL, {
+        fields,
+        access_token: accessToken,
+        appsecret_proof: appsecretProof
+      })
     );
     if (!user) {
       const error = createError({

package/dist/runtime/server/lib/oauth/gitea.js

@@ -63,7 +63,7 @@ export function defineOAuthGiteaEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "gitea", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/github.js

@@ -42,7 +42,7 @@ export function defineOAuthGitHubEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "github", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/gitlab.js

@@ -63,7 +63,7 @@ export function defineOAuthGitLabEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "gitlab", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/google.js

@@ -35,7 +35,7 @@ export function defineOAuthGoogleEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "google", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/heroku.js

@@ -45,7 +45,7 @@ export function defineOAuthHerokuEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "heroku", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/hubspot.js

@@ -33,7 +33,7 @@ export function defineOAuthHubspotEventHandler({ config, onSuccess, onError }) {
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "hubspot", onError);
     }
     const tokens = await requestAccessToken(

package/dist/runtime/server/lib/oauth/instagram.js

@@ -47,7 +47,7 @@ export function defineOAuthInstagramEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "instagram", onError);
     }
     const tokens = await requestAccessToken(config.tokenURL, {

package/dist/runtime/server/lib/oauth/keycloak.js

@@ -46,7 +46,7 @@ export function defineOAuthKeycloakEventHandler({
         })
       );
     }
-    if (query.state !== state) {
+    if (!state || query.state !== state) {
       return handleInvalidState(event, "keycloak", onError);
     }
     config.scope = config.scope || [];