nuxt-auth-utils 0.6.0 → 0.6.2

package/README.md

@@ -410,6 +410,38 @@ export default defineNuxtConfig({
 })
 ```
 
+#### Callback path
+
+The authorization server compares the redirect URI of the login request with the list published in the client metadata document. That document is served from `bluesky/client-metadata.json` under your app base URL (`app.baseURL`, `/` by default), so it cannot know where your login route lives.
+
+The module fills in `/auth/<provider>`, the path its playground uses, under that base URL. The login route is served under the base URL too, so a deployment that sets `app.baseURL` publishes the path its login route answers on:
+
+```text
+app.baseURL: '/my-app/'  ->  redirect_uris: ["https://example.com/my-app/auth/bluesky"]
+```
+
+Set `redirectUris` when your login route lives elsewhere; until you do, the module logs a warning in development. Both requests then use it:
+
+```ts
+export default defineNuxtConfig({
+  runtimeConfig: {
+    oauth: {
+      bluesky: {
+        redirectUris: ['/login/bluesky']
+      }
+    }
+  }
+})
+```
+
+Declare paths only, without the origin or the app base URL. The module prepends the base URL, like it does for `/auth/<provider>`, and leaves a path that already starts with it as is. It then prepends the origin of the request, because the URL origin must match the client ID:
+
+```text
+app.baseURL: '/my-app/', redirectUris: ['/login/bluesky']  ->  redirect_uris: ["https://example.com/my-app/login/bluesky"]
+```
+
+The `redirectUrl` option of `defineOAuthBlueskyEventHandler()` applies to the login request alone, also under the base URL. The metadata document cannot see it, so use `redirectUris` for a custom callback path.
+
 ### WebAuthn (passkey)
 
 WebAuthn (Web Authentication) is a web standard that enhances security by replacing passwords with passkeys using public key cryptography. Users can authenticate with biometric data (like fingerprints or facial recognition) or physical devices (like USB keys), reducing the risk of phishing and password breaches. This approach offers a more secure and user-friendly authentication method, supported by major browsers and platforms.
@@ -432,6 +464,37 @@ export default defineNuxtConfig({
 })
 ```
 
+#### Relying Party ID
+
+A passkey is bound to the domain that created it. By default, a passkey created on `example.com` cannot be used on `app.example.com`. Set `rpID` to the registrable parent domain to share passkeys between a domain and its subdomains:
+
+```ts
+export default defineNuxtConfig({
+  auth: {
+    webAuthn: {
+      rpID: 'example.com', // passkeys created on `example.com` also work on `app.example.com`
+      rpName: 'My App' // shown by the authenticator when creating a passkey
+    }
+  }
+})
+```
+
+Both options default to the hostname of the request. The module uses `rpID` to generate the options and to verify the response, and `rpName` only to label the passkey during registration. Both are read from `runtimeConfig`, which helps when one build serves several domains:
+
+```ts
+export default defineNuxtConfig({
+  runtimeConfig: {
+    webauthn: {
+      rpID: 'example.com'
+    }
+  }
+})
+```
+
+`NUXT_WEBAUTHN_RP_ID` and `NUXT_WEBAUTHN_RP_NAME` override both at runtime.
+
+When you define `getOptions`, the module calls it while generating the options and again while verifying the response. Return the same `rpID` in both calls, or verification fails with an `Unexpected RP ID hash` error. The expected origin is always the origin of the request, because that is what the browser sends back.
+
 #### Example
 
 In this example we will implement the very basic steps to register and authenticate a credential.
@@ -638,6 +701,7 @@ We leverage hooks to let you extend the session data with your own data or log w
 export default () => {
   // Called when the session is fetched during SSR for the Vue composable (/api/_auth/session)
   // Or when we call useUserSession().fetch()
+  // Not called for a visitor without a session cookie: they get an empty session and no cookie is set
   sessionHooks.hook('fetch', async (session, event) => {
     // extend User Session by calling your database
     // or
@@ -899,6 +963,34 @@ export default defineNuxtConfig({
 
 The browser then sends the session cookie to every subdomain of `example.com`, and each application can decrypt it.
 
+## Serve over plain HTTP
+
+The OAuth event handlers set short-lived cookies for the state, nonce and PKCE verifier. They are `Secure` except in development. Browsers ignore `Secure` cookies set over plain HTTP, except on `localhost`, so logging in to a built app served over plain HTTP, for example in an end-to-end test stack, fails with `state mismatch`.
+
+When `runtimeConfig.session.cookie.secure` is `false`, both the session cookie and these cookies are set without `Secure`. Nuxt only overrides declared options from environment variables, so declare it in your `nuxt.config.ts` to switch it at runtime:
+
+```ts
+export default defineNuxtConfig({
+  modules: ['nuxt-auth-utils'],
+  runtimeConfig: {
+    session: {
+      cookie: {
+        secure: true
+      }
+    }
+  }
+})
+```
+
+Then start the built app with `NUXT_SESSION_COOKIE_SECURE=false`:
+
+```bash
+NUXT_SESSION_COOKIE_SECURE=false node .output/server/index.mjs
+```
+
+> [!WARNING]
+> Only do this when the app is served over plain HTTP: without `Secure`, the cookies can be read or overwritten on the network. A proxy that terminates TLS is not a reason to disable it, as `Secure` applies to the browser's connection.
+
 ## More
 
 - [nuxt-authorization](https://github.com/barbapapazes/nuxt-authorization): Authorization module for managing permissions inside a Nuxt app, compatible with `nuxt-auth-utils`
@@ -936,13 +1028,13 @@ Releases are automated with [uppt](https://github.com/danielroe/uppt): every pus
 
 <!-- Badges -->
 [npm-version-src]: https://img.shields.io/npm/v/nuxt-auth-utils/latest.svg?style=flat&colorA=020420&colorB=00DC82
-[npm-version-href]: https://npmjs.com/package/nuxt-auth-utils
+[npm-version-href]: https://npmx.dev/package/nuxt-auth-utils
 
 [npm-downloads-src]: https://img.shields.io/npm/dm/nuxt-auth-utils.svg?style=flat&colorA=020420&colorB=00DC82
-[npm-downloads-href]: https://npm.chart.dev/nuxt-auth-utils
+[npm-downloads-href]: https://npmx.dev/package-stats/nuxt-auth-utils/v/latest?granularity=monthly
 
 [license-src]: https://img.shields.io/npm/l/nuxt-auth-utils.svg?style=flat&colorA=020420&colorB=00DC82
-[license-href]: https://npmjs.com/package/nuxt-auth-utils
+[license-href]: https://github.com/atinux/nuxt-auth-utils/blob/main/LICENSE
 
 [nuxt-src]: https://img.shields.io/badge/Nuxt-020420?logo=nuxt.js
 [nuxt-href]: https://nuxt.com

package/dist/module.d.mts

@@ -1,12 +1,28 @@
 import { ScryptConfig } from '@adonisjs/hash/types';
+import { GenerateRegistrationOptionsOpts, GenerateAuthenticationOptionsOpts } from '@simplewebauthn/server';
 import { SessionConfig } from 'nuxt/server';
+import { OAuthRuntimeConfig } from '../dist/runtime/types/oauth-runtime-config.js';
 
+interface WebAuthnOptions {
+    /**
+     * Relying Party ID the passkeys are bound to.
+     *
+     * Set the registrable parent domain (such as `example.com`) to create and use passkeys across subdomains.
+     * @default the request hostname
+     */
+    rpID?: string;
+    /**
+     * Relying Party name shown by the authenticator when creating a passkey
+     * @default the request hostname
+     */
+    rpName?: string;
+}
 interface ModuleOptions {
     /**
      * Enable WebAuthn (Passkeys)
      * @default false
      */
-    webAuthn?: boolean;
+    webAuthn?: boolean | WebAuthnOptions;
     /**
      * Enable atproto OAuth (Bluesky, etc.)
      * @default false
@@ -36,6 +52,24 @@ declare module 'nuxt/schema' {
          * Session configuration, the session is sealed with a secret derived from `appSecret` (`NUXT_APP_SECRET`)
          */
         session: Omit<SessionConfig, 'password'>;
+        /**
+         * WebAuthn settings, `rpID` and `rpName` are set from the `webAuthn` module option.
+         *
+         * Both can be overridden at runtime with `NUXT_WEBAUTHN_RP_ID` and `NUXT_WEBAUTHN_RP_NAME`.
+         *
+         * `register` and `authenticate` are merged into the options passed to
+         * `generateRegistrationOptions()` and `generateAuthenticationOptions()`.
+         */
+        webauthn: {
+            rpID: string;
+            rpName: string;
+            register: Partial<GenerateRegistrationOptionsOpts>;
+            authenticate: Partial<GenerateAuthenticationOptionsOpts>;
+        };
+        /**
+         * OAuth providers configuration, one key per provider (`github`, `google`, `keycloak`, ...).
+         */
+        oauth: OAuthRuntimeConfig;
     }
     interface PublicRuntimeConfig {
         auth: {
@@ -46,4 +80,4 @@ declare module 'nuxt/schema' {
 declare const _default: any;
 
 export { _default as default };
-export type { ModuleOptions };
+export type { ModuleOptions, WebAuthnOptions };

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=4.6.0"
   },
-  "version": "0.6.0",
+  "version": "0.6.2",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -91,7 +91,10 @@ const module$1 = defineNuxtModule({
     runtimeConfig.public.auth = defu(runtimeConfig.public.auth, {
       loadStrategy: options.loadStrategy ?? "server-first"
     });
+    const webAuthnOptions = typeof options.webAuthn === "object" ? options.webAuthn : void 0;
     runtimeConfig.webauthn = defu(runtimeConfig.webauthn, {
+      rpID: webAuthnOptions?.rpID ?? "",
+      rpName: webAuthnOptions?.rpName ?? "",
       register: {},
       authenticate: {}
     });
@@ -145,7 +148,7 @@ const module$1 = defineNuxtModule({
       clientId: "",
       clientSecret: "",
       connectionId: "",
-      screenHint: "",
+      screenHint: "sign-in",
       redirectURL: ""
     });
     runtimeConfig.oauth.microsoft = defu(runtimeConfig.oauth.microsoft, {
@@ -360,25 +363,25 @@ const module$1 = defineNuxtModule({
       redirectURL: "",
       baseURL: "",
       userURL: "",
-      scope: ""
+      scope: []
     });
     runtimeConfig.oauth.slack = defu(runtimeConfig.oauth.slack, {
       clientId: "",
       clientSecret: "",
       redirectURL: "",
-      scope: ""
+      scope: []
     });
     runtimeConfig.oauth.heroku = defu(runtimeConfig.oauth.heroku, {
       clientId: "",
       clientSecret: "",
       redirectURL: "",
-      scope: ""
+      scope: []
     });
     runtimeConfig.oauth.roblox = defu(runtimeConfig.oauth.roblox, {
       clientId: "",
       clientSecret: "",
       redirectURL: "",
-      scope: ""
+      scope: []
     });
     runtimeConfig.oauth.okta = defu(runtimeConfig.oauth.okta, {
       clientId: "",

package/dist/runtime/server/api/session.get.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nuxt/server").EventHandler<Promise<UserSession>>;
+declare const _default: import("nuxt/server").EventHandler<Promise<any>>;
 export default _default;

package/dist/runtime/server/api/session.get.js

@@ -1,6 +1,10 @@
-import { defineEventHandler } from "nuxt/server";
+import { defineEventHandler, getCookie } from "nuxt/server";
 import { getUserSession, sessionHooks } from "../utils/session.js";
+import { resolveSessionConfig } from "../lib/session.js";
 export default defineEventHandler(async (event) => {
+  if (!getCookie(event, resolveSessionConfig().name)) {
+    return {};
+  }
   const session = await getUserSession(event);
   if (Object.keys(session).length > 0) {
     await sessionHooks.callHookParallel("fetch", session, event);

package/dist/runtime/server/lib/atproto/bluesky.js

@@ -1,10 +1,12 @@
-import { defineEventHandler, createError, deleteCookie, getCookie, getQuery, sendRedirect, setCookie } from "nuxt/server";
+import { defineEventHandler, createError, deleteCookie, getCookie, getQuery, getRequestURL, sendRedirect, setCookie, useRuntimeConfig } from "nuxt/server";
 import { NodeOAuthClient, OAuthCallbackError, OAuthResolverError, OAuthResponseError } from "@atproto/oauth-client-node";
 import { Agent } from "@atproto/api";
+import { withoutBase } from "ufo";
 import { getAtprotoClientMetadata } from "../../utils/atproto.js";
 export function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }) {
   return defineEventHandler(async (event) => {
     const clientMetadata = getAtprotoClientMetadata(event, "bluesky", config);
+    if (import.meta.dev && !config?.redirectUrl) warnUnpublishedLoginPath(event, clientMetadata.redirect_uris[0]);
     const scopes = clientMetadata.scope?.split(" ") ?? [];
     const sessionStore = new SessionStore();
     const stateStore = new StateStore(event);
@@ -65,6 +67,17 @@ export function defineOAuthBlueskyEventHandler({ config, onSuccess, onError }) {
     }
   });
 }
+let warnedUnpublishedLoginPath = false;
+function warnUnpublishedLoginPath(event, redirectUri) {
+  if (warnedUnpublishedLoginPath) return;
+  const runtimeConfig = useRuntimeConfig();
+  if (runtimeConfig.oauth.bluesky.redirectUris?.length) return;
+  const loginPath = getRequestURL(event).pathname;
+  const callbackPath = new URL(redirectUri).pathname;
+  if (loginPath === callbackPath) return;
+  warnedUnpublishedLoginPath = true;
+  console.warn(`[nuxt-auth-utils] The Bluesky login route is served from \`${loginPath}\`, but Bluesky redirects back to \`${callbackPath}\`. Set \`runtimeConfig.oauth.bluesky.redirectUris\` to \`['${withoutBase(loginPath, runtimeConfig.app.baseURL)}']\`.`);
+}
 export class StateStore {
   constructor(event) {
     this.event = event;

package/dist/runtime/server/lib/oauth/heroku.js

@@ -32,7 +32,7 @@ export function defineOAuthHerokuEventHandler({
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     const state = await handleState(event);
     if (!query.code) {
-      config.scope = config.scope || ["identity"];
+      config.scope = config.scope?.length ? config.scope : ["identity"];
       return sendRedirect(
         event,
         withQuery(config.authorizationURL, {

package/dist/runtime/server/lib/oauth/hubspot.js

@@ -1,5 +1,4 @@
-import { defineEventHandler, getQuery, sendRedirect, useRuntimeConfig } from "nuxt/server";
-import { $fetch } from "ofetch";
+import { createError, defineEventHandler, getQuery, sendRedirect, useRuntimeConfig } from "nuxt/server";
 import { withQuery } from "ufo";
 import defu from "defu";
 import {
@@ -37,7 +36,7 @@ export function defineOAuthHubspotEventHandler({ config, onSuccess, onError }) {
       return handleInvalidState(event, "hubspot", onError);
     }
     const tokens = await requestAccessToken(
-      "https://api.hubapi.com/oauth/v1/token",
+      "https://api.hubapi.com/oauth/2026-09/token",
       {
         body: {
           client_id: config.clientId,
@@ -51,7 +50,29 @@ export function defineOAuthHubspotEventHandler({ config, onSuccess, onError }) {
     if (tokens.error) {
       return handleAccessTokenErrorResponse(event, "hubspot", tokens, onError);
     }
-    const info = await $fetch("https://api.hubapi.com/oauth/v1/access-tokens/" + tokens.access_token);
+    const info = await requestAccessToken(
+      "https://api.hubapi.com/oauth/2026-09/token/introspect",
+      {
+        params: {
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          token: tokens.access_token,
+          token_type_hint: "access_token"
+        }
+      }
+    );
+    if (info.error) {
+      return handleAccessTokenErrorResponse(event, "hubspot", info, onError);
+    }
+    if (!info.active) {
+      const error = createError({
+        status: 401,
+        message: "Hubspot login failed: the access token is not active",
+        data: info
+      });
+      if (!onError) throw error;
+      return onError(event, error);
+    }
     return onSuccess(event, {
       user: {
         id: info.user_id,

package/dist/runtime/server/lib/oauth/mastodon.js

@@ -2,7 +2,7 @@ import { createError, defineEventHandler, deleteCookie, getCookie, getQuery, sen
 import { withQuery } from "ufo";
 import { defu } from "defu";
 import { $fetch } from "ofetch";
-import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleState, isDevelopment, requestAccessToken } from "../utils.js";
+import { getOAuthRedirectURL, handleAccessTokenErrorResponse, handleInvalidState, handleState, isOAuthCookieSecure, requestAccessToken } from "../utils.js";
 const FLOW_COOKIE_NAME = "nuxt-auth-mastodon-flow";
 const appRegistry = /* @__PURE__ */ new Map();
 const pendingRegistrations = /* @__PURE__ */ new Map();
@@ -114,7 +114,7 @@ export function defineOAuthMastodonEventHandler({ config: userConfig, onSuccess,
       const flowState2 = { instance: instance2, clientId: app.client_id, clientSecret: app.client_secret };
       setCookie(event, FLOW_COOKIE_NAME, btoa(JSON.stringify(flowState2)), {
         httpOnly: true,
-        secure: !isDevelopment,
+        secure: isOAuthCookieSecure(),
         sameSite: "lax",
         maxAge: 60 * 10,
         path: "/"

package/dist/runtime/server/lib/oauth/salesforce.js

@@ -33,7 +33,7 @@ export function defineOAuthSalesforceEventHandler({
     const pkce = await handlePkceVerifier(event);
     const state = await handleState(event);
     if (!query.code) {
-      config.scope = config.scope || ["id"];
+      config.scope = config.scope?.length ? config.scope : ["id"];
       return sendRedirect(
         event,
         withQuery(config.authorizationURL, {

package/dist/runtime/server/lib/oauth/slack.js

@@ -32,7 +32,7 @@ export function defineOAuthSlackEventHandler({
     const redirectURL = config.redirectURL || getOAuthRedirectURL(event);
     const state = await handleState(event);
     if (!query.code) {
-      config.scope = config.scope || ["openid", "email", "profile"];
+      config.scope = config.scope?.length ? config.scope : ["openid", "email", "profile"];
       return sendRedirect(
         event,
         withQuery(config.authorizationURL, {

package/dist/runtime/server/lib/oauth/steam.js

@@ -12,10 +12,10 @@ export function defineOAuthSteamEventHandler({ config, onSuccess, onError }) {
     if (!config.apiKey) {
       return handleMissingConfiguration(event, "steam", ["apiKey"], onError);
     }
-    const url = getRequestURL(event);
+    const url = getRequestURL(event, { xForwardedProto: true });
     const state = await handleState(event, { isCallback: Boolean(query["openid.claimed_id"]) });
     if (!query["openid.claimed_id"]) {
-      const redirectURL = withQuery(config.redirectURL || getRequestURL(event).href, { state });
+      const redirectURL = withQuery(config.redirectURL || url.href, { state });
       const realm = url.port ? `${url.protocol}//${url.hostname}:${url.port}` : `${url.protocol}//${url.hostname}`;
       const steamOpenIdParams = {
         "openid.ns": "http://specs.openid.net/auth/2.0",

package/dist/runtime/server/lib/session.d.ts

@@ -0,0 +1,11 @@
+import type { SessionConfig } from 'nuxt/server';
+/**
+ * Name of the cookie the user session is sealed into.
+ */
+export declare const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
+/**
+ * The session config of the user session: the runtime config merged under `config`, without `password`.
+ */
+export declare function resolveSessionConfig(config?: Omit<SessionConfig, 'password'>): SessionConfig & {
+    name: string;
+};

package/dist/runtime/server/lib/session.js

@@ -0,0 +1,33 @@
+import { useRuntimeConfig } from "nuxt/server";
+import { defu } from "defu";
+export const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
+const APP_SESSION_COOKIE_NAME = "nuxt-session";
+export function resolveSessionConfig(config = {}) {
+  const runtimeConfig = useRuntimeConfig();
+  warnLegacySessionPassword(runtimeConfig);
+  const { password: _password, ...finalConfig } = defu(config, runtimeConfig.session, { name: USER_SESSION_COOKIE_NAME });
+  if (finalConfig.name === APP_SESSION_COOKIE_NAME) {
+    warnAppSessionName();
+    finalConfig.name = USER_SESSION_COOKIE_NAME;
+  }
+  if (finalConfig.cookie?.secure === "false") {
+    finalConfig.cookie = { ...finalConfig.cookie, secure: false };
+  }
+  return finalConfig;
+}
+let warnedAppSessionName = false;
+function warnAppSessionName() {
+  if (warnedAppSessionName) return;
+  warnedAppSessionName = true;
+  console.warn(`[nuxt-auth-utils] The session name \`${APP_SESSION_COOKIE_NAME}\` is the cookie of \`useSession()\` from \`nuxt/server\`, using \`${USER_SESSION_COOKIE_NAME}\` instead. Set another \`runtimeConfig.session.name\` (\`NUXT_SESSION_NAME\`) to rename the user session cookie.`);
+}
+let checkedLegacySessionPassword = false;
+function warnLegacySessionPassword(runtimeConfig) {
+  if (checkedLegacySessionPassword) return;
+  checkedLegacySessionPassword = true;
+  const envPrefix = runtimeConfig.nitro?.envPrefix || "NUXT_";
+  const envKey = `${envPrefix}SESSION_PASSWORD`;
+  if (globalThis.process?.env?.[envKey] || runtimeConfig.session?.password) {
+    console.warn(`[nuxt-auth-utils] \`${envKey}\` (\`runtimeConfig.session.password\`) is not used anymore. Set \`NUXT_APP_SECRET\` instead, for example with \`openssl rand -base64 32\`. Sessions are now sealed with a secret derived from \`appSecret\`.`);
+  }
+}

package/dist/runtime/server/lib/utils.d.ts

@@ -2,6 +2,7 @@ import type { RequestEvent } from 'nuxt/server';
 import * as jose from 'jose';
 import type { OAuthProvider, OnError } from '#auth-utils';
 export declare const isDevelopment: boolean;
+export declare function isOAuthCookieSecure(): boolean;
 export declare function getOAuthRedirectURL(event: RequestEvent): string;
 /**
  * Request an access token body.

package/dist/runtime/server/lib/utils.js

@@ -3,10 +3,14 @@ import { $fetch, FetchError } from "ofetch";
 import { snakeCase, upperFirst } from "scule";
 import * as jose from "jose";
 import { subtle, getRandomValues } from "uncrypto";
+import { resolveSessionConfig } from "./session.js";
 export const isDevelopment = process.env.NODE_ENV === "development";
+export function isOAuthCookieSecure() {
+  return !isDevelopment && resolveSessionConfig().cookie?.secure !== false;
+}
 const OAUTH_COOKIE_MAX_AGE = 60 * 10;
 export function getOAuthRedirectURL(event) {
-  const requestURL = getRequestURL(event);
+  const requestURL = getRequestURL(event, { xForwardedProto: true });
   return `${requestURL.protocol}//${requestURL.host}${requestURL.pathname}`;
 }
 export async function requestAccessToken(url, options) {
@@ -84,7 +88,7 @@ export async function handlePkceVerifier(event) {
     const verifier2 = encodeBase64Url(getRandomBytes());
     setCookie(event, "nuxt-auth-pkce", verifier2, {
       httpOnly: true,
-      secure: !isDevelopment,
+      secure: isOAuthCookieSecure(),
       sameSite: "lax",
       maxAge: OAUTH_COOKIE_MAX_AGE,
       path: "/"
@@ -114,7 +118,7 @@ export async function handleState(event, options = {}) {
   const sameSite = options.sameSite || "lax";
   setCookie(event, "nuxt-auth-state", state, {
     httpOnly: true,
-    secure: sameSite === "none" || !isDevelopment,
+    secure: sameSite === "none" || isOAuthCookieSecure(),
     sameSite,
     maxAge: OAUTH_COOKIE_MAX_AGE,
     path: "/"
@@ -134,7 +138,7 @@ export function handleNonce(event) {
   const nonce = encodeBase64Url(getRandomBytes());
   setCookie(event, "nuxt-auth-nonce", nonce, {
     httpOnly: true,
-    secure: !isDevelopment,
+    secure: isOAuthCookieSecure(),
     sameSite: "lax",
     maxAge: OAUTH_COOKIE_MAX_AGE,
     path: "/"

package/dist/runtime/server/lib/webauthn/authenticate.js

@@ -13,10 +13,11 @@ export function defineWebAuthnAuthenticateEventHandler({
   onError
 }) {
   return defineEventHandler(async (event) => {
-    const url = getRequestURL(event);
+    const url = getRequestURL(event, { xForwardedProto: true });
     const body = await readBody(event);
-    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig().webauthn.authenticate, {
-      rpID: url.hostname
+    const runtimeConfig = useRuntimeConfig();
+    const _config = defu(await getOptions?.(event, body) ?? {}, runtimeConfig.webauthn.authenticate, {
+      rpID: runtimeConfig.webauthn.rpID || url.hostname
     });
     if (!storeChallenge) {
       _config.challenge = "";
@@ -47,7 +48,7 @@ export function defineWebAuthnAuthenticateEventHandler({
         response: body.response,
         expectedChallenge,
         expectedOrigin: url.origin,
-        expectedRPID: url.hostname,
+        expectedRPID: _config.rpID,
         requireUserVerification: false,
         // TODO: make configurable https://simplewebauthn.dev/docs/advanced/passkeys#verifyauthenticationresponse
         credential: {

package/dist/runtime/server/lib/webauthn/register.js

@@ -13,7 +13,7 @@ export function defineWebAuthnRegisterEventHandler({
   onError
 }) {
   return defineEventHandler(async (event) => {
-    const url = getRequestURL(event);
+    const url = getRequestURL(event, { xForwardedProto: true });
     const body = await readBody(event);
     if (body.verify === void 0 || !body.user?.userName)
       throw createError({
@@ -24,9 +24,10 @@ export function defineWebAuthnRegisterEventHandler({
     if (validateUser) {
       user = await validateUserData(body.user, event, validateUser);
     }
-    const _config = defu(await getOptions?.(event, body) ?? {}, useRuntimeConfig().webauthn.register, {
-      rpID: url.hostname,
-      rpName: url.hostname,
+    const runtimeConfig = useRuntimeConfig();
+    const _config = defu(await getOptions?.(event, body) ?? {}, runtimeConfig.webauthn.register, {
+      rpID: runtimeConfig.webauthn.rpID || url.hostname,
+      rpName: runtimeConfig.webauthn.rpName || url.hostname,
       userName: user.userName,
       userDisplayName: user.displayName,
       authenticatorSelection: {
@@ -65,7 +66,7 @@ export function defineWebAuthnRegisterEventHandler({
         response: body.response,
         expectedChallenge,
         expectedOrigin: url.origin,
-        expectedRPID: url.hostname,
+        expectedRPID: _config.rpID,
         requireUserVerification: false,
         // TODO: make configurable https://simplewebauthn.dev/docs/advanced/passkeys#verifyregistrationresponse
         supportedAlgorithmIDs: _config.supportedAlgorithmIDs

package/dist/runtime/server/utils/atproto.js

@@ -1,22 +1,23 @@
 import { getRequestURL, useRuntimeConfig } from "nuxt/server";
-import { getOAuthRedirectURL } from "../lib/utils.js";
+import { withBase } from "ufo";
 import { getClientMetadataFilename } from "../../utils/atproto.js";
 export function getAtprotoClientMetadata(event, provider, config) {
-  const providerRuntimeConfig = useRuntimeConfig().oauth[provider];
+  const runtimeConfig = useRuntimeConfig();
+  const providerRuntimeConfig = runtimeConfig.oauth[provider];
   const scopes = [.../* @__PURE__ */ new Set(["atproto", ...config?.scope ?? [], ...providerRuntimeConfig.scope ?? []])];
   const scope = scopes.join(" ");
   const grantTypes = [.../* @__PURE__ */ new Set(["authorization_code", ...providerRuntimeConfig.grantTypes ?? []])];
-  const requestURL = getRequestURL(event);
+  const requestURL = getRequestURL(event, { xForwardedProto: true });
   const baseUrl = `${requestURL.protocol}//${requestURL.host}`;
-  const redirectURL = new URL(
-    config?.redirectUrl && baseUrl + config.redirectUrl || providerRuntimeConfig.redirectUris[0] && baseUrl + providerRuntimeConfig.redirectUris[0] || getOAuthRedirectURL(event)
-  );
+  const withAppBase = (path) => withBase(path, runtimeConfig.app.baseURL);
+  const callbackPaths = (providerRuntimeConfig.redirectUris?.length ? providerRuntimeConfig.redirectUris : [`/auth/${provider}`]).map(withAppBase);
+  const redirectURL = new URL(baseUrl + (config?.redirectUrl ? withAppBase(config.redirectUrl) : callbackPaths[0]));
   const dev = import.meta.dev;
   if (dev && redirectURL.hostname === "localhost") {
     redirectURL.hostname = "127.0.0.1";
   }
-  const redirectUris = (providerRuntimeConfig.redirectUris.length ? providerRuntimeConfig.redirectUris : [requestURL.pathname]).map((uri) => new URL(`${redirectURL.protocol}//${redirectURL.host}${uri}`).toString());
-  const clientId = dev ? `http://localhost?redirect_uri=${encodeURIComponent(redirectURL.toString())}&scope=${encodeURIComponent(scope)}` : `${baseUrl}/${getClientMetadataFilename("bluesky", providerRuntimeConfig)}`;
+  const redirectUris = callbackPaths.map((uri) => new URL(`${redirectURL.protocol}//${redirectURL.host}${uri}`).toString());
+  const clientId = dev ? `http://localhost?redirect_uri=${encodeURIComponent(redirectURL.toString())}&scope=${encodeURIComponent(scope)}` : `${baseUrl}${withBase(`/${getClientMetadataFilename(provider, providerRuntimeConfig)}`, runtimeConfig.app.baseURL)}`;
   const clientMetadata = {
     client_name: providerRuntimeConfig.clientName || void 0,
     client_uri: providerRuntimeConfig.clientUri || void 0,

package/dist/runtime/server/utils/session.d.ts

@@ -1,10 +1,7 @@
 import type { RequestEvent, SessionConfig } from 'nuxt/server';
 import type { OmitWithIndexSignature } from '../../types/utils.js';
 import type { LegacyH3Event, SessionEvent, UserSession, UserSessionRequired } from '#auth-utils';
-/**
- * Name of the cookie the user session is sealed into.
- */
-export declare const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
+export { USER_SESSION_COOKIE_NAME } from '../lib/session.js';
 type UserSessionData = OmitWithIndexSignature<UserSession, 'id'>;
 /**
  * Session options, the session is always sealed with a secret derived from `appSecret`.
@@ -66,4 +63,3 @@ export declare function requireUserSession(event: SessionEvent, opts?: {
     statusCode?: number;
     message?: string;
 }): Promise<UserSessionRequired>;
-export {};

package/dist/runtime/server/utils/session.js

@@ -1,7 +1,8 @@
-import { createError, defineEventHandler, useRuntimeConfig, useSession } from "nuxt/server";
+import { createError, defineEventHandler, useSession } from "nuxt/server";
 import { defu } from "defu";
 import { createHooks } from "hookable";
-export const USER_SESSION_COOKIE_NAME = "nuxt-auth-session";
+import { resolveSessionConfig } from "../lib/session.js";
+export { USER_SESSION_COOKIE_NAME } from "../lib/session.js";
 export const sessionHooks = createHooks();
 export async function getUserSession(event) {
   const session = await _useSession(event);
@@ -51,25 +52,11 @@ async function _useSession(event, config = {}, write = false) {
       message: "[nuxt-auth-utils] The user session is read-only in WebSocket handlers: `setUserSession`, `replaceUserSession` and `clearUserSession` need the event of an HTTP request."
     });
   }
-  const runtimeConfig = useRuntimeConfig();
-  warnLegacySessionPassword(runtimeConfig);
-  const { password: _password, ...finalConfig } = defu(config, runtimeConfig.session, { name: USER_SESSION_COOKIE_NAME });
-  if (finalConfig.name === APP_SESSION_COOKIE_NAME) {
-    warnAppSessionName();
-    finalConfig.name = USER_SESSION_COOKIE_NAME;
-  }
-  return useSession(sessionEvent, finalConfig);
+  return useSession(sessionEvent, resolveSessionConfig(config));
 }
 function toJSONData(data) {
   return JSON.parse(JSON.stringify(data));
 }
-const APP_SESSION_COOKIE_NAME = "nuxt-session";
-let warnedAppSessionName = false;
-function warnAppSessionName() {
-  if (warnedAppSessionName) return;
-  warnedAppSessionName = true;
-  console.warn(`[nuxt-auth-utils] The session name \`${APP_SESSION_COOKIE_NAME}\` is the cookie of \`useSession()\` from \`nuxt/server\`, using \`${USER_SESSION_COOKIE_NAME}\` instead. Set another \`runtimeConfig.session.name\` (\`NUXT_SESSION_NAME\`) to rename the user session cookie.`);
-}
 const toPortableEvent = defineEventHandler((event) => event);
 function toSessionEvent(event) {
   const input = event;
@@ -94,13 +81,3 @@ function toSessionEvent(event) {
     message: "[nuxt-auth-utils] The session utils need a request event, a WebSocket peer or a WebSocket upgrade request."
   });
 }
-let checkedLegacySessionPassword = false;
-function warnLegacySessionPassword(runtimeConfig) {
-  if (checkedLegacySessionPassword) return;
-  checkedLegacySessionPassword = true;
-  const envPrefix = runtimeConfig.nitro?.envPrefix || "NUXT_";
-  const envKey = `${envPrefix}SESSION_PASSWORD`;
-  if (globalThis.process?.env?.[envKey] || runtimeConfig.session?.password) {
-    console.warn(`[nuxt-auth-utils] \`${envKey}\` (\`runtimeConfig.session.password\`) is not used anymore. Set \`NUXT_APP_SECRET\` instead, for example with \`openssl rand -base64 32\`. Sessions are now sealed with a secret derived from \`appSecret\`.`);
-  }
-}

package/dist/runtime/types/atproto.d.ts

@@ -1,5 +1,5 @@
 import type { OAuthClientMetadata } from '@atproto/oauth-client-node';
-export interface AtprotoProviderClientMetadata {
+export type AtprotoProviderClientMetadata = {
     /**
      * The name of the client metadata file. This is used to construct the client ID.
      * @example 'client-metadata.json'
@@ -46,10 +46,12 @@ export interface AtprotoProviderClientMetadata {
      */
     responseTypes?: OAuthClientMetadata['response_types'];
     /**
-     * At least one redirect URI is required. The URL origin must match that of the `clientId`, so declare only the path.
+     * At least one redirect URI is required. The URL origin must match that of the `clientId`, so declare only the path. Paths are resolved under the app base URL.
+     *
+     * Empty by default, in which case `/auth/<provider>` under the app base URL is used.
      * @example ['/auth/callback']
      */
-    redirectUris: OAuthClientMetadata['redirect_uris'];
+    redirectUris?: `/${string}`[];
     /**
      * The token endpoint authentication method. `none` is the default, and the only supported value at this time.
      * @default 'none'
@@ -59,4 +61,4 @@ export interface AtprotoProviderClientMetadata {
      * DPoP is mandatory for all clients, so this must be present and true.
      */
     dpopBoundAccessTokens?: OAuthClientMetadata['dpop_bound_access_tokens'];
-}
+};

package/dist/runtime/types/index.d.ts

@@ -1,4 +1,4 @@
 export type { User, UserSession, UserSessionRequired, UserSessionComposable, SecureSessionData } from './session.js';
 export type { RequestEvent, SessionEvent, LegacyH3Event, WebSocketSessionEvent } from './event.js';
-export type { OAuthConfig, OAuthProvider, ATProtoProvider, OnError } from './oauth-config.js';
+export type { OAuthConfig, OAuthProvider, ATProtoProvider, OAuthRuntimeConfigExtension, OnError } from './oauth-config.js';
 export type { WebAuthnCredential, WebAuthnRegisterEventHandlerOptions, WebAuthnAuthenticateEventHandlerOptions, WebAuthnComposable, WebAuthnUser, } from './webauthn.js';

package/dist/runtime/types/oauth-config.d.ts

@@ -2,6 +2,20 @@ import type { NuxtError, RequestEvent } from 'nuxt/server';
 export type ATProtoProvider = 'bluesky';
 export type OAuthProvider = ATProtoProvider | 'atlassian' | 'auth0' | 'authentik' | 'azureb2c' | 'battledotnet' | 'cloudflare' | 'cognito' | 'discord' | 'dropbox' | 'facebook' | 'gitea' | 'github' | 'gitlab' | 'google' | 'hubspot' | 'instagram' | 'kick' | 'keycloak' | 'line' | 'linear' | 'linkedin' | 'mastodon' | 'microsoft' | 'paypal' | 'polar' | 'spotify' | 'seznam' | 'steam' | 'strava' | 'tiktok' | 'twitch' | 'vk' | 'wechat' | 'workos' | 'x' | 'xsuaa' | 'yandex' | 'zitadel' | 'apple' | 'livechat' | 'salesforce' | 'slack' | 'heroku' | 'roblox' | 'okta' | 'ory' | 'shopifyCustomer' | 'oidc' | 'osu' | 'riotgames' | 'box' | 'zendesk' | (string & {});
 export type OnError = (event: RequestEvent, error: NuxtError) => unknown;
+/**
+ * Augment this interface to type the runtime configuration of OAuth providers that are not
+ * shipped with the module, such as providers added by another module.
+ *
+ * ```ts
+ * declare module '#auth-utils' {
+ *   interface OAuthRuntimeConfigExtension {
+ *     myProvider: { clientId: string, clientSecret: string }
+ *   }
+ * }
+ * ```
+ */
+export interface OAuthRuntimeConfigExtension {
+}
 export interface OAuthConfig<TConfig, TResult = {
     user: any;
     tokens: any;

package/dist/runtime/types/oauth-runtime-config.d.ts

@@ -0,0 +1,119 @@
+import type { AtprotoProviderClientMetadata } from './atproto.js';
+import type { OAuthRuntimeConfigExtension } from './oauth-config.js';
+import type { LiveChatConfig } from '../server/lib/oauth/livechat.js';
+import type { OAuthAppleConfig } from '../server/lib/oauth/apple.js';
+import type { OAuthAtlassianConfig } from '../server/lib/oauth/atlassian.js';
+import type { OAuthAuth0Config } from '../server/lib/oauth/auth0.js';
+import type { OAuthAuthentikConfig } from '../server/lib/oauth/authentik.js';
+import type { OAuthAzureB2CConfig } from '../server/lib/oauth/azureb2c.js';
+import type { OAuthBattledotnetConfig } from '../server/lib/oauth/battledotnet.js';
+import type { OAuthBoxConfig } from '../server/lib/oauth/box.js';
+import type { OAuthCloudflareConfig } from '../server/lib/oauth/cloudflare.js';
+import type { OAuthCognitoConfig } from '../server/lib/oauth/cognito.js';
+import type { OAuthDiscordConfig } from '../server/lib/oauth/discord.js';
+import type { OAuthDropboxConfig } from '../server/lib/oauth/dropbox.js';
+import type { OAuthFacebookConfig } from '../server/lib/oauth/facebook.js';
+import type { OAuthGitHubConfig } from '../server/lib/oauth/github.js';
+import type { OAuthGitLabConfig } from '../server/lib/oauth/gitlab.js';
+import type { OAuthGiteaConfig } from '../server/lib/oauth/gitea.js';
+import type { OAuthGoogleConfig } from '../server/lib/oauth/google.js';
+import type { OAuthHerokuConfig } from '../server/lib/oauth/heroku.js';
+import type { OAuthHubspotConfig } from '../server/lib/oauth/hubspot.js';
+import type { OAuthInstagramConfig } from '../server/lib/oauth/instagram.js';
+import type { OAuthKeycloakConfig } from '../server/lib/oauth/keycloak.js';
+import type { OAuthKickConfig } from '../server/lib/oauth/kick.js';
+import type { OAuthLineConfig } from '../server/lib/oauth/line.js';
+import type { OAuthLinearConfig } from '../server/lib/oauth/linear.js';
+import type { OAuthLinkedInConfig } from '../server/lib/oauth/linkedin.js';
+import type { OAuthMastodonConfig } from '../server/lib/oauth/mastodon.js';
+import type { OAuthMicrosoftConfig } from '../server/lib/oauth/microsoft.js';
+import type { OAuthOidcConfig } from '../server/lib/oauth/oidc.js';
+import type { OAuthOktaConfig } from '../server/lib/oauth/okta.js';
+import type { OAuthOryConfig } from '../server/lib/oauth/ory.js';
+import type { OAuthOsuConfig } from '../server/lib/oauth/osu.js';
+import type { OAuthPaypalConfig } from '../server/lib/oauth/paypal.js';
+import type { OAuthPolarConfig } from '../server/lib/oauth/polar.js';
+import type { OAuthRiotGamesConfig } from '../server/lib/oauth/riotgames.js';
+import type { OAuthRobloxConfig } from '../server/lib/oauth/roblox.js';
+import type { OAuthSalesforceConfig } from '../server/lib/oauth/salesforce.js';
+import type { OAuthSeznamConfig } from '../server/lib/oauth/seznam.js';
+import type { OAuthShopifyCustomerConfig } from '../server/lib/oauth/shopifyCustomer.js';
+import type { OAuthSlackConfig } from '../server/lib/oauth/slack.js';
+import type { OAuthSpotifyConfig } from '../server/lib/oauth/spotify.js';
+import type { OAuthSteamConfig } from '../server/lib/oauth/steam.js';
+import type { OAuthStravaConfig } from '../server/lib/oauth/strava.js';
+import type { OAuthTikTokConfig } from '../server/lib/oauth/tiktok.js';
+import type { OAuthTwitchConfig } from '../server/lib/oauth/twitch.js';
+import type { OAuthVKConfig } from '../server/lib/oauth/vk.js';
+import type { OAuthWechatConfig } from '../server/lib/oauth/wechat.js';
+import type { OAuthWorkOSConfig } from '../server/lib/oauth/workos.js';
+import type { OAuthXConfig } from '../server/lib/oauth/x.js';
+import type { OAuthXSUAAConfig } from '../server/lib/oauth/xsuaa.js';
+import type { OAuthYandexConfig } from '../server/lib/oauth/yandex.js';
+import type { OAuthZendeskConfig } from '../server/lib/oauth/zendesk.js';
+import type { OAuthZitadelConfig } from '../server/lib/oauth/zitadel.js';
+/**
+ * Runtime configuration of every OAuth provider supported by the module, exposed as `runtimeConfig.oauth`.
+ *
+ * Keys are the provider names accepted by `defineOAuth<Provider>EventHandler()`, and they are always
+ * set by the module, so server code can read them without checking for `undefined`. In `nuxt.config`,
+ * `runtimeConfig` is deep-partial, so you only write the providers you use.
+ * Providers contributed by other modules can add themselves through the `OAuthRuntimeConfigExtension`
+ * interface, and any other key stays `unknown`.
+ */
+export interface OAuthRuntimeConfig extends OAuthRuntimeConfigExtension {
+    [provider: string]: unknown;
+    apple: OAuthAppleConfig;
+    atlassian: OAuthAtlassianConfig;
+    auth0: OAuthAuth0Config;
+    authentik: OAuthAuthentikConfig;
+    azureb2c: OAuthAzureB2CConfig;
+    battledotnet: OAuthBattledotnetConfig;
+    bluesky: AtprotoProviderClientMetadata;
+    box: OAuthBoxConfig;
+    cloudflare: OAuthCloudflareConfig;
+    cognito: OAuthCognitoConfig;
+    discord: OAuthDiscordConfig;
+    dropbox: OAuthDropboxConfig;
+    facebook: OAuthFacebookConfig;
+    gitea: OAuthGiteaConfig;
+    github: OAuthGitHubConfig;
+    gitlab: OAuthGitLabConfig;
+    google: OAuthGoogleConfig;
+    heroku: OAuthHerokuConfig;
+    hubspot: OAuthHubspotConfig;
+    instagram: OAuthInstagramConfig;
+    keycloak: OAuthKeycloakConfig;
+    kick: OAuthKickConfig;
+    line: OAuthLineConfig;
+    linear: OAuthLinearConfig;
+    linkedin: OAuthLinkedInConfig;
+    livechat: LiveChatConfig;
+    mastodon: OAuthMastodonConfig;
+    microsoft: OAuthMicrosoftConfig;
+    oidc: OAuthOidcConfig;
+    okta: OAuthOktaConfig;
+    ory: OAuthOryConfig;
+    osu: OAuthOsuConfig;
+    paypal: OAuthPaypalConfig;
+    polar: OAuthPolarConfig;
+    riotgames: OAuthRiotGamesConfig;
+    roblox: OAuthRobloxConfig;
+    salesforce: OAuthSalesforceConfig;
+    seznam: OAuthSeznamConfig;
+    shopifyCustomer: OAuthShopifyCustomerConfig;
+    slack: OAuthSlackConfig;
+    spotify: OAuthSpotifyConfig;
+    steam: OAuthSteamConfig;
+    strava: OAuthStravaConfig;
+    tiktok: OAuthTikTokConfig;
+    twitch: OAuthTwitchConfig;
+    vk: OAuthVKConfig;
+    wechat: OAuthWechatConfig;
+    workos: OAuthWorkOSConfig;
+    x: OAuthXConfig;
+    xsuaa: OAuthXSUAAConfig;
+    yandex: OAuthYandexConfig;
+    zendesk: OAuthZendeskConfig;
+    zitadel: OAuthZitadelConfig;
+}

package/dist/runtime/types/session.d.ts

@@ -1,4 +1,5 @@
 import type { ComputedRef, Ref } from 'vue';
+import type { OmitWithIndexSignature } from './utils.js';
 export interface User {
 }
 export interface SecureSessionData {
@@ -38,9 +39,11 @@ export interface UserSessionComposable {
      */
     user: ComputedRef<User | null>;
     /**
-     * The session object.
+     * The session object, without `id` for a visitor who has no session yet.
      */
-    session: Ref<UserSession | null>;
+    session: Ref<(OmitWithIndexSignature<UserSession, 'id'> & {
+        id?: string;
+    }) | null>;
     /**
      * Fetch the user session from the server.
      */

package/dist/runtime/utils/atproto.js

@@ -10,8 +10,7 @@ export const atprotoProviderDefaultClientMetadata = {
   grantTypes: ["authorization_code"],
   responseTypes: ["code"],
   applicationType: "web",
-  // @ts-expect-error TypeScript is too smart for its own good
-  redirectUris: void 0,
+  redirectUris: [],
   dpopBoundAccessTokens: true,
   tokenEndpointAuthMethod: "none"
 };

package/dist/types.d.mts

@@ -1,3 +1,3 @@
 export { default } from './module.mjs'
 
-export { type ModuleOptions } from './module.mjs'
+export { type ModuleOptions, type WebAuthnOptions } from './module.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": {
     "type": "git",