oidc-login 1.1.0 → 1.1.1

package/dist/index.mjs

@@ -182,14 +182,18 @@ async function discover({ issuer, clientId, clientSecret, clientAuthentication,
 		...fetch ? { [client.customFetch]: fetch } : {},
 		...insecure ? { execute: [client.allowInsecureRequests] } : {}
 	});
-	const { authorization_endpoint, token_endpoint } = config.serverMetadata();
-	if (![authorization_endpoint, token_endpoint].every((endpoint) => isEndpointUrl(endpoint, insecure))) throw new Error("The issuer metadata has no valid authorization or token endpoint.");
+	const { authorization_endpoint, token_endpoint, userinfo_endpoint, jwks_uri } = config.serverMetadata();
+	if (![authorization_endpoint, token_endpoint].every((endpoint) => isEndpointUrl(endpoint, insecure)) || ![userinfo_endpoint, jwks_uri].every((endpoint) => endpoint === void 0 || isEndpointUrl(endpoint, insecure))) throw new Error("The issuer metadata has an invalid endpoint.");
 	return config;
 }
-/** Checks that an endpoint from the issuer metadata is an absolute URL with an allowed protocol. */
+/**
+* Checks that an endpoint from the issuer metadata is an absolute URL with an allowed protocol.
+*
+* A plain HTTP issuer on a loopback host may name HTTPS endpoints or plain HTTP endpoints on loopback hosts, so that the client secret and tokens do not leave the machine unencrypted.
+*/
 function isEndpointUrl(value, insecure) {
 	if (typeof value !== "string" || !URL.canParse(value)) return false;
-	const { protocol } = new URL(value);
-	return protocol === "https:" || insecure && protocol === "http:";
+	const { protocol, hostname } = new URL(value);
+	return protocol === "https:" || insecure && protocol === "http:" && isLoopbackHostname(hostname);
 }
 export { OidcLoginError, createOidcLogin, isSecureIssuerUrl };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oidc-login",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "OpenID Connect login flow for web apps on top of openid-client",
   "homepage": "https://github.com/IlyaSemenov/oidc-login#readme",
   "bugs": "https://github.com/IlyaSemenov/oidc-login/issues",