nuxt-auth-utils 0.6.0 → 0.6.1

package/README.md

@@ -638,6 +638,7 @@ We leverage hooks to let you extend the session data with your own data or log w
 export default () => {
   // Called when the session is fetched during SSR for the Vue composable (/api/_auth/session)
   // Or when we call useUserSession().fetch()
+  // Not called for a visitor without a session cookie: they get an empty session and no cookie is set
   sessionHooks.hook('fetch', async (session, event) => {
     // extend User Session by calling your database
     // or
@@ -899,6 +900,34 @@ export default defineNuxtConfig({
 
 The browser then sends the session cookie to every subdomain of `example.com`, and each application can decrypt it.
 
+## Serve over plain HTTP
+
+The OAuth event handlers set short-lived cookies for the state, nonce and PKCE verifier. They are `Secure` except in development. Browsers ignore `Secure` cookies set over plain HTTP, except on `localhost`, so logging in to a built app served over plain HTTP, for example in an end-to-end test stack, fails with `state mismatch`.
+
+When `runtimeConfig.session.cookie.secure` is `false`, both the session cookie and these cookies are set without `Secure`. Nuxt only overrides declared options from environment variables, so declare it in your `nuxt.config.ts` to switch it at runtime:
+
+```ts
+export default defineNuxtConfig({
+  modules: ['nuxt-auth-utils'],
+  runtimeConfig: {
+    session: {
+      cookie: {
+        secure: true
+      }
+    }
+  }
+})
+```
+
+Then start the built app with `NUXT_SESSION_COOKIE_SECURE=false`:
+
+```bash
+NUXT_SESSION_COOKIE_SECURE=false node .output/server/index.mjs
+```
+
+> [!WARNING]
+> Only do this when the app is served over plain HTTP: without `Secure`, the cookies can be read or overwritten on the network. A proxy that terminates TLS is not a reason to disable it, as `Secure` applies to the browser's connection.
+
 ## More
 
 - [nuxt-authorization](https://github.com/barbapapazes/nuxt-authorization): Authorization module for managing permissions inside a Nuxt app, compatible with `nuxt-auth-utils`

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=4.6.0"
   },
-  "version": "0.6.0",
+  "version": "0.6.1",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/runtime/server/api/session.get.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nuxt/server").EventHandler<Promise<UserSession>>;
+declare const _default: import("nuxt/server").EventHandler<Promise<any>>;
 export default _default;

package/dist/runtime/server/api/session.get.js

@@ -1,6 +1,10 @@
-import { defineEventHandler } from "nuxt/server";
+import { defineEventHandler, getCookie } from "nuxt/server";
 import { getUserSession, sessionHooks } from "../utils/session.js";
+import { resolveSessionConfig } from "../lib/session.js";
 export default defineEventHandler(async (event) => {
+  if (!getCookie(event, resolveSessionConfig().name)) {
+    return {};
+  }
   const session = await getUserSession(event);
   if (Object.keys(session).length > 0) {
     await sessionHooks.callHookParallel("fetch", session, event);

package/dist/runtime/server/lib/oauth/mastodon.js

@@ -2,7 +2,7 @@ import { createError, defineEventHandler, deleteCookie, getCookie, getQuery, sen
 import { withQuery } from "ufo";
 import { defu } from "defu";
 import { $fetch } from "ofetch";
-import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleState, isDevelopment, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleState, isOAuthCookieSecure, requestAccessToken } from "../utils.js";
 const FLOW_COOKIE_NAME = "nuxt-auth-mastodon-flow";
 const appRegistry = /* @__PURE__ */ new Map();
 const pendingRegistrations = /* @__PURE__ */ new Map();
@@ -114,7 +114,7 @@ export function defineOAuthMastodonEventHandler({ config: userConfig, onSuccess,
       const flowState2 = { instance: instance2, clientId: app.client_id, clientSecret: app.client_secret };
       setCookie(event, FLOW_COOKIE_NAME, btoa(JSON.stringify(flowState2)), {
         httpOnly: true,
-        secure: !isDevelopment,
+        secure: isOAuthCookieSecure(),
         sameSite: "lax",
         maxAge: 60 * 10,
         path: "/"

package/dist/runtime/server/lib/oauth/steam.js

@@ -12,10 +12,10 @@ export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
     if (!config.apiKey) {
       return handleMissingConfiguration(event, "steam", ["apiKey"], onError);
     }
-    const url = getRequestURL(event);
+    const url = getRequestURL(event, { xForwardedProto: true });
     const state = await handleState(event, { isCallback: Boolean(query["openid.claimed_id"]) });
     if (!query["openid.claimed_id"]) {
-      const redirectURL = withQuery(config.redirectURL || getRequestURL(event).href, { state });
+      const redirectURL = withQuery(config.redirectURL || url.href, { state });
       const realm = url.port ? `${url.protocol}//${url.hostname}:${url.port}` : `${url.protocol}//${url.hostname}`;
       const steamOpenIdParams = {
         "openid.ns": "http://specs.openid.net/auth/2.0",

package/dist/runtime/server/lib/session.d.ts

@@ -0,0 +1,11 @@
+import type { SessionConfig } from 'nuxt/server';
+/**
+ * Name of the cookie the user session is sealed into.
+ */
+export declare const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
+/**
+ * The session config of the user session: the runtime config merged under `config`, without `password`.
+ */
+export declare function resolveSessionConfig(config?: Omit<SessionConfig, 'password'>): SessionConfig & {
+    name: string;
+};

package/dist/runtime/server/lib/session.js

@@ -0,0 +1,33 @@
+import { useRuntimeConfig } from "nuxt/server";
+import { defu } from "defu";
+export const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
+const APP_SESSION_COOKIE_NAME = "nuxt-session";
+export function resolveSessionConfig(config = {}) {
+  const runtimeConfig = useRuntimeConfig();
+  warnLegacySessionPassword(runtimeConfig);
+  const { password: _password, ...finalConfig } = defu(config, runtimeConfig.session, { name: USER_SESSION_COOKIE_NAME });
+  if (finalConfig.name === APP_SESSION_COOKIE_NAME) {
+    warnAppSessionName();
+    finalConfig.name = USER_SESSION_COOKIE_NAME;
+  }
+  if (finalConfig.cookie?.secure === "false") {
+    finalConfig.cookie = { ...finalConfig.cookie, secure: false };
+  }
+  return finalConfig;
+}
+let warnedAppSessionName = false;
+function warnAppSessionName() {
+  if (warnedAppSessionName) return;
+  warnedAppSessionName = true;
+  console.warn(`[nuxt-auth-utils] The session name \`${APP_SESSION_COOKIE_NAME}\` is the cookie of \`useSession()\` from \`nuxt/server\`, using \`${USER_SESSION_COOKIE_NAME}\` instead. Set another \`runtimeConfig.session.name\` (\`NUXT_SESSION_NAME\`) to rename the user session cookie.`);
+}
+let checkedLegacySessionPassword = false;
+function warnLegacySessionPassword(runtimeConfig) {
+  if (checkedLegacySessionPassword) return;
+  checkedLegacySessionPassword = true;
+  const envPrefix = runtimeConfig.nitro?.envPrefix || "NUXT_";
+  const envKey = `${envPrefix}SESSION_PASSWORD`;
+  if (globalThis.process?.env?.[envKey] || runtimeConfig.session?.password) {
+    console.warn(`[nuxt-auth-utils] \`${envKey}\` (\`runtimeConfig.session.password\`) is not used anymore. Set \`NUXT_APP_SECRET\` instead, for example with \`openssl rand -base64 32\`. Sessions are now sealed with a secret derived from \`appSecret\`.`);
+  }
+}

package/dist/runtime/server/lib/utils.d.ts

@@ -2,6 +2,7 @@ import type { RequestEvent } from 'nuxt/server';
 import * as jose from 'jose';
 import type { OAuthProvider, OnError } from '#auth-utils';
 export declare const isDevelopment: boolean;
+export declare function isOAuthCookieSecure(): boolean;
 export declare function getOAuthRedirectURL(event: RequestEvent): string;
 /**
  * Request an access token body.

package/dist/runtime/server/lib/utils.js

@@ -3,10 +3,14 @@ import { $fetch, FetchError } from "ofetch";
 import { snakeCase, upperFirst } from "scule";
 import * as jose from "jose";
 import { subtle, getRandomValues } from "uncrypto";
+import { resolveSessionConfig } from "./session.js";
 export const isDevelopment = process.env.NODE_ENV === "development";
+export function isOAuthCookieSecure() {
+  return !isDevelopment && resolveSessionConfig().cookie?.secure !== false;
+}
 const OAUTH_COOKIE_MAX_AGE = 60 * 10;
 export function getOAuthRedirectURL(event) {
-  const requestURL = getRequestURL(event);
+  const requestURL = getRequestURL(event, { xForwardedProto: true });
   return `${requestURL.protocol}//${requestURL.host}${requestURL.pathname}`;
 }
 export async function requestAccessToken(url, options) {
@@ -84,7 +88,7 @@ export async function handlePkceVerifier(event) {
     const verifier2 = encodeBase64Url(getRandomBytes());
     setCookie(event, "nuxt-auth-pkce", verifier2, {
       httpOnly: true,
-      secure: !isDevelopment,
+      secure: isOAuthCookieSecure(),
       sameSite: "lax",
       maxAge: OAUTH_COOKIE_MAX_AGE,
       path: "/"
@@ -114,7 +118,7 @@ export async function handleState(event, options = {}) {
   const sameSite = options.sameSite || "lax";
   setCookie(event, "nuxt-auth-state", state, {
     httpOnly: true,
-    secure: sameSite === "none" || !isDevelopment,
+    secure: sameSite === "none" || isOAuthCookieSecure(),
     sameSite,
     maxAge: OAUTH_COOKIE_MAX_AGE,
     path: "/"
@@ -134,7 +138,7 @@ export function handleNonce(event) {
   const nonce = encodeBase64Url(getRandomBytes());
   setCookie(event, "nuxt-auth-nonce", nonce, {
     httpOnly: true,
-    secure: !isDevelopment,
+    secure: isOAuthCookieSecure(),
     sameSite: "lax",
     maxAge: OAUTH_COOKIE_MAX_AGE,
     path: "/"

package/dist/runtime/server/lib/webauthn/authenticate.js

@@ -13,7 +13,7 @@ export function defineWebAuthnAuthenticateEventHandler({
   onError
 }) {
   return defineEventHandler(async (event) => {
-    const url = getRequestURL(event);
+    const url = getRequestURL(event, { xForwardedProto: true });
     const body = await readBody(event);
     const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig().webauthn.authenticate, {
       rpID: url.hostname

package/dist/runtime/server/lib/webauthn/register.js

@@ -13,7 +13,7 @@ export function defineWebAuthnRegisterEventHandler({
   onError
 }) {
   return defineEventHandler(async (event) => {
-    const url = getRequestURL(event);
+    const url = getRequestURL(event, { xForwardedProto: true });
     const body = await readBody(event);
     if (body.verify === void 0 || !body.user?.userName)
       throw createError({

package/dist/runtime/server/utils/atproto.js

@@ -6,7 +6,7 @@ export function getAtprotoClientMetadata(event, provider, config) {
   const scopes = [.../* @__PURE__ */ new Set(["atproto", ...config?.scope ?? [], ...providerRuntimeConfig.scope ?? []])];
   const scope = scopes.join(" ");
   const grantTypes = [.../* @__PURE__ */ new Set(["authorization_code", ...providerRuntimeConfig.grantTypes ?? []])];
-  const requestURL = getRequestURL(event);
+  const requestURL = getRequestURL(event, { xForwardedProto: true });
   const baseUrl = `${requestURL.protocol}//${requestURL.host}`;
   const redirectURL = new URL(
     config?.redirectUrl && baseUrl + config.redirectUrl || providerRuntimeConfig.redirectUris[0] && baseUrl + providerRuntimeConfig.redirectUris[0] || getOAuthRedirectURL(event)

package/dist/runtime/server/utils/session.d.ts

@@ -1,10 +1,7 @@
 import type { RequestEvent, SessionConfig } from 'nuxt/server';
 import type { OmitWithIndexSignature } from '../../types/utils.js';
 import type { LegacyH3Event, SessionEvent, UserSession, UserSessionRequired } from '#auth-utils';
-/**
- * Name of the cookie the user session is sealed into.
- */
-export declare const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
+export { USER_SESSION_COOKIE_NAME } from '../lib/session.js';
 type UserSessionData = OmitWithIndexSignature<UserSession, 'id'>;
 /**
  * Session options, the session is always sealed with a secret derived from `appSecret`.
@@ -66,4 +63,3 @@ export declare function requireUserSession(event: SessionEvent, opts?: {
     statusCode?: number;
     message?: string;
 }): Promise<UserSessionRequired>;
-export {};

package/dist/runtime/server/utils/session.js

@@ -1,7 +1,8 @@
-import { createError, defineEventHandler, useRuntimeConfig, useSession } from "nuxt/server";
+import { createError, defineEventHandler, useSession } from "nuxt/server";
 import { defu } from "defu";
 import { createHooks } from "hookable";
-export const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
+import { resolveSessionConfig } from "../lib/session.js";
+export { USER_SESSION_COOKIE_NAME } from "../lib/session.js";
 export const sessionHooks = createHooks();
 export async function getUserSession(event) {
   const session = await _useSession(event);
@@ -51,25 +52,11 @@ async function _useSession(event, config = {}, write = false) {
       message: "[nuxt-auth-utils] The user session is read-only in WebSocket handlers: `setUserSession`, `replaceUserSession` and `clearUserSession` need the event of an HTTP request."
     });
   }
-  const runtimeConfig = useRuntimeConfig();
-  warnLegacySessionPassword(runtimeConfig);
-  const { password: _password, ...finalConfig } = defu(config, runtimeConfig.session, { name: USER_SESSION_COOKIE_NAME });
-  if (finalConfig.name === APP_SESSION_COOKIE_NAME) {
-    warnAppSessionName();
-    finalConfig.name = USER_SESSION_COOKIE_NAME;
-  }
-  return useSession(sessionEvent, finalConfig);
+  return useSession(sessionEvent, resolveSessionConfig(config));
 }
 function toJSONData(data) {
   return JSON.parse(JSON.stringify(data));
 }
-const APP_SESSION_COOKIE_NAME = "nuxt-session";
-let warnedAppSessionName = false;
-function warnAppSessionName() {
-  if (warnedAppSessionName) return;
-  warnedAppSessionName = true;
-  console.warn(`[nuxt-auth-utils] The session name \`${APP_SESSION_COOKIE_NAME}\` is the cookie of \`useSession()\` from \`nuxt/server\`, using \`${USER_SESSION_COOKIE_NAME}\` instead. Set another \`runtimeConfig.session.name\` (\`NUXT_SESSION_NAME\`) to rename the user session cookie.`);
-}
 const toPortableEvent = defineEventHandler((event) => event);
 function toSessionEvent(event) {
   const input = event;
@@ -94,13 +81,3 @@ function toSessionEvent(event) {
     message: "[nuxt-auth-utils] The session utils need a request event, a WebSocket peer or a WebSocket upgrade request."
   });
 }
-let checkedLegacySessionPassword = false;
-function warnLegacySessionPassword(runtimeConfig) {
-  if (checkedLegacySessionPassword) return;
-  checkedLegacySessionPassword = true;
-  const envPrefix = runtimeConfig.nitro?.envPrefix || "NUXT_";
-  const envKey = `${envPrefix}SESSION_PASSWORD`;
-  if (globalThis.process?.env?.[envKey] || runtimeConfig.session?.password) {
-    console.warn(`[nuxt-auth-utils] \`${envKey}\` (\`runtimeConfig.session.password\`) is not used anymore. Set \`NUXT_APP_SECRET\` instead, for example with \`openssl rand -base64 32\`. Sessions are now sealed with a secret derived from \`appSecret\`.`);
-  }
-}

package/dist/runtime/types/session.d.ts

@@ -1,4 +1,5 @@
 import type { ComputedRef, Ref } from 'vue';
+import type { OmitWithIndexSignature } from './utils.js';
 export interface User {
 }
 export interface SecureSessionData {
@@ -38,9 +39,11 @@ export interface UserSessionComposable {
      */
     user: ComputedRef<User | null>;
     /**
-     * The session object.
+     * The session object, without `id` for a visitor who has no session yet.
      */
-    session: Ref<UserSession | null>;
+    session: Ref<(OmitWithIndexSignature<UserSession, 'id'> & {
+        id?: string;
+    }) | null>;
     /**
      * Fetch the user session from the server.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",