oidc-spa 8.2.12 → 8.3.1

package/esm/core/loginSilent.js

@@ -6,8 +6,8 @@ import { getStateData, clearStateStore } from "./StateData";
 import { getDownlinkAndRtt } from "../tools/getDownlinkAndRtt";
 import { getIsDev } from "../tools/isDev";
 import { addOrUpdateSearchParam } from "../tools/urlSearchParams";
-import { initIframeMessageProtection } from "./iframeMessageProtection";
 import { getIsOnline } from "../tools/getIsOnline";
+import { getEvtIframeAuthResponse } from "./earlyInit";
 export async function loginSilent(params) {
     const { oidcClientTsUserManager, stateUrlParamValue_instance, configId, transformUrlBeforeRedirect, getExtraQueryParams, getExtraTokenParams, autoLogin, log } = params;
     delay_until_online: {
@@ -33,9 +33,6 @@ export async function loginSilent(params) {
         const dynamicDelay = rtt * 2.5 + BASE_DELAY_MS / (downlink + 1);
         return Math.max(BASE_DELAY_MS, dynamicDelay);
     })();
-    const { getIsReadyToReadPublicKeyMessage, startSessionStoragePublicKeyMaliciousWriteDetection, setSessionStoragePublicKey, decodeEncryptedAuth, getIsEncryptedAuthResponse, clearSessionStoragePublicKey } = await initIframeMessageProtection({
-        stateUrlParamValue: stateUrlParamValue_instance
-    });
     let clearTimeouts;
     {
         let hasLoggedWarningMessage = false;
@@ -65,41 +62,11 @@ export async function loginSilent(params) {
             }
         };
     }
-    let listener;
-    listener = async (event) => {
-        if (event.origin !== window.location.origin) {
-            return;
-        }
-        if (!getIsReadyToReadPublicKeyMessage({
-            stateUrlParamValue: stateUrlParamValue_instance,
-            message: event.data
-        })) {
+    const { unsubscribe: unsubscribe_evtIframeAuthResponse } = getEvtIframeAuthResponse().subscribe(authResponse => {
+        if (authResponse.state !== stateUrlParamValue_instance) {
             return;
         }
-        window.removeEventListener("message", listener, false);
-        setSessionStoragePublicKey();
-        const dEncryptedAuthResponse = new Deferred();
-        listener = event => {
-            if (event.origin !== window.location.origin) {
-                return;
-            }
-            const message = event.data;
-            if (!getIsEncryptedAuthResponse({
-                stateUrlParamValue: stateUrlParamValue_instance,
-                message
-            })) {
-                return;
-            }
-            window.removeEventListener("message", listener);
-            // NOTE: Acknowledge that we're also doing it later but
-            // since there's a aggressive write protection in place
-            // it's good to clear the key ASAP.
-            clearSessionStoragePublicKey();
-            dEncryptedAuthResponse.resolve(message);
-        };
-        window.addEventListener("message", listener, false);
-        const encryptedAuthResponse = await dEncryptedAuthResponse.pr;
-        const { authResponse } = await decodeEncryptedAuth({ encryptedAuthResponse });
+        unsubscribe_evtIframeAuthResponse();
         const stateData = getStateData({ stateUrlParamValue: authResponse.state });
         assert(stateData !== undefined, "765645");
         assert(stateData.context === "iframe", "250711");
@@ -109,8 +76,7 @@ export async function loginSilent(params) {
             outcome: "got auth response from iframe",
             authResponse
         });
-    };
-    window.addEventListener("message", listener, false);
+    });
     const transformUrl_oidcClientTs = (url) => {
         add_extra_query_params: {
             if (getExtraQueryParams === undefined) {
@@ -132,7 +98,6 @@ export async function loginSilent(params) {
         }
         return url;
     };
-    startSessionStoragePublicKeyMaliciousWriteDetection();
     oidcClientTsUserManager
         .signinSilent({
         state: id({
@@ -146,7 +111,7 @@ export async function loginSilent(params) {
         .then(oidcClientTsUser => {
         assert(oidcClientTsUser !== null, "oidcClientTsUser is not supposed to be null here");
         clearTimeouts({ wasSuccess: true });
-        window.removeEventListener("message", listener);
+        unsubscribe_evtIframeAuthResponse();
         dResult.resolve({
             outcome: "token refreshed using refresh token",
             oidcClientTsUser
@@ -156,9 +121,9 @@ export async function loginSilent(params) {
         // error than timeout so we fail silently and let the timeout expire.
     });
     dResult.pr.then(result => {
-        clearSessionStoragePublicKey();
         if (result.outcome === "timeout") {
             clearStateStore({ stateUrlParamValue: stateUrlParamValue_instance });
+            unsubscribe_evtIframeAuthResponse();
         }
     });
     return dResult.pr;

package/esm/core/loginSilent.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginSilent.js","sourceRoot":"","sources":["../../src/core/loginSilent.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAenD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAgBjC;IACG,MAAM,EACF,uBAAuB,EACvB,2BAA2B,EAC3B,QAAQ,EACR,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,SAAS,EACT,GAAG,EACN,GAAG,MAAM,CAAC;IAEX,kBAAkB,EAAE,CAAC;QACjB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,kBAAkB,CAAC;QAC7B,CAAC;QACD,GAAG,EAAE,CAAC,wFAAwF,CAAC,CAAC;QAChG,MAAM,QAAQ,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,QAAQ,EAAuB,CAAC;IAEpD,MAAM,cAAc,GAAW,CAAC,GAAG,EAAE;QACjC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QAEzB,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;QAE3C,6DAA6D;QAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,IAAK,CAAC;QAEjE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,aAAa,CAAC;QACzB,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC;QAEzC,oDAAoD;QACpD,8CAA8C;QAC9C,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAEhE,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACjD,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,EACF,gCAAgC,EAChC,mDAAmD,EACnD,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,EAC1B,4BAA4B,EAC/B,GAAG,MAAM,2BAA2B,CAAC;QAClC,kBAAkB,EAAE,2BAA2B;KAClD,CAAC,CAAC;IAEH,IAAI,aAAwD,CAAC;IAC7D,CAAC;QACG,IAAI,uBAAuB,GAAG,KAAK,CAAC;QAEpC,MAAM,QAAQ,GAAG;YACb,UAAU,CAAC,GAAG,EAAE;gBACZ,OAAO,CAAC,OAAO,CAAC;oBACZ,OAAO,EAAE,SAAS;iBACrB,CAAC,CAAC;YACP,CAAC,EAAE,cAAc,CAAC;YAClB,UAAU,CAAC,GAAG,EAAE;gBACZ,OAAO,CAAC,IAAI,CACR;oBACI,+DAA+D;oBAC/D,2CAA2C;oBAC3C,WAAW,IAAI,CAAC,KAAK,CACjB,cAAc,GAAG,IAAK,CACzB,sCAAsC;oBACvC,yFAAyF;iBAC5F,CAAC,IAAI,CAAC,GAAG,CAAC,CACd,CAAC;gBACF,uBAAuB,GAAG,IAAI,CAAC;YACnC,CAAC,EAAE,IAAK,CAAC;SACZ,CAAC;QAEF,aAAa,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;YAC/B,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC/B,IAAI,UAAU,IAAI,uBAAuB,EAAE,CAAC;gBACxC,OAAO,CAAC,GAAG,CACP;oBACI,iEAAiE;oBACjE,6CAA6C;iBAChD,CAAC,IAAI,CAAC,GAAG,CAAC,CACd,CAAC;YACN,CAAC;QACL,CAAC,CAAC;IACN,CAAC;IAED,IAAI,QAAuC,CAAC;IAE5C,QAAQ,GAAG,KAAK,EAAE,KAAmB,EAAE,EAAE;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC1C,OAAO;QACX,CAAC;QAED,IACI,CAAC,gCAAgC,CAAC;YAC9B,kBAAkB,EAAE,2BAA2B;YAC/C,OAAO,EAAE,KAAK,CAAC,IAAI;SACtB,CAAC,EACJ,CAAC;YACC,OAAO;QACX,CAAC;QAED,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAEvD,0BAA0B,EAAE,CAAC;QAE7B,MAAM,sBAAsB,GAAG,IAAI,QAAQ,EAAU,CAAC;QAEtD,QAAQ,GAAG,KAAK,CAAC,EAAE;YACf,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC1C,OAAO;YACX,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;YAE3B,IACI,CAAC,0BAA0B,CAAC;gBACxB,kBAAkB,EAAE,2BAA2B;gBAC/C,OAAO;aACV,CAAC,EACJ,CAAC;gBACC,OAAO;YACX,CAAC;YAED,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAEhD,uDAAuD;YACvD,uDAAuD;YACvD,mCAAmC;YACnC,4BAA4B,EAAE,CAAC;YAE/B,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAEpD,MAAM,qBAAqB,GAAG,MAAM,sBAAsB,CAAC,EAAE,CAAC;QAE9D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,mBAAmB,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAE9E,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,kBAAkB,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QAE3E,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEnD,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpC,OAAO,CAAC,OAAO,CAAC;YACZ,OAAO,EAAE,+BAA+B;YACxC,YAAY;SACf,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAEpD,MAAM,yBAAyB,GAAG,CAAC,GAAW,EAAE,EAAE;QAC9C,sBAAsB,EAAE,CAAC;YACrB,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,sBAAsB,CAAC;YACjC,CAAC;YAED,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAEtE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACtB,SAAS;gBACb,CAAC;gBACD,GAAG,GAAG,sBAAsB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;YACjF,CAAC;QACL,CAAC;QAED,mBAAmB,EAAE,CAAC;YAClB,IAAI,0BAA0B,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,mBAAmB,CAAC;YAC9B,CAAC;YACD,GAAG,GAAG,0BAA0B,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,GAAG,CAAC;IACf,CAAC,CAAC;IAEF,mDAAmD,EAAE,CAAC;IAEtD,uBAAuB;SAClB,YAAY,CAAC;QACV,KAAK,EAAE,EAAE,CAAmB;YACxB,OAAO,EAAE,QAAQ;YACjB,QAAQ;SACX,CAAC;QACF,6BAA6B,EAAE,cAAc,GAAG,IAAI;QACpD,gBAAgB,EACZ,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;QACtF,YAAY,EAAE,yBAAyB;KAC1C,CAAC;SACD,IAAI,CACD,gBAAgB,CAAC,EAAE;QACf,MAAM,CAAC,gBAAgB,KAAK,IAAI,EAAE,kDAAkD,CAAC,CAAC;QAEtF,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEhD,OAAO,CAAC,OAAO,CAAC;YACZ,OAAO,EAAE,qCAAqC;YAC9C,gBAAgB;SACnB,CAAC,CAAC;IACP,CAAC,EACD,GAAG,EAAE;QACD,yEAAyE;QACzE,qEAAqE;IACzE,CAAC,CACJ,CAAC;IAEN,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QACrB,4BAA4B,EAAE,CAAC;QAE/B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,eAAe,CAAC,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACzE,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"loginSilent.js","sourceRoot":"","sources":["../../src/core/loginSilent.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAevD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAgBjC;IACG,MAAM,EACF,uBAAuB,EACvB,2BAA2B,EAC3B,QAAQ,EACR,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,SAAS,EACT,GAAG,EACN,GAAG,MAAM,CAAC;IAEX,kBAAkB,EAAE,CAAC;QACjB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,kBAAkB,CAAC;QAC7B,CAAC;QACD,GAAG,EAAE,CAAC,wFAAwF,CAAC,CAAC;QAChG,MAAM,QAAQ,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,QAAQ,EAAuB,CAAC;IAEpD,MAAM,cAAc,GAAW,CAAC,GAAG,EAAE;QACjC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QAEzB,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;QAE3C,6DAA6D;QAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,IAAK,CAAC;QAEjE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,aAAa,CAAC;QACzB,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC;QAEzC,oDAAoD;QACpD,8CAA8C;QAC9C,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAEhE,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACjD,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,aAAwD,CAAC;IAC7D,CAAC;QACG,IAAI,uBAAuB,GAAG,KAAK,CAAC;QAEpC,MAAM,QAAQ,GAAG;YACb,UAAU,CAAC,GAAG,EAAE;gBACZ,OAAO,CAAC,OAAO,CAAC;oBACZ,OAAO,EAAE,SAAS;iBACrB,CAAC,CAAC;YACP,CAAC,EAAE,cAAc,CAAC;YAClB,UAAU,CAAC,GAAG,EAAE;gBACZ,OAAO,CAAC,IAAI,CACR;oBACI,+DAA+D;oBAC/D,2CAA2C;oBAC3C,WAAW,IAAI,CAAC,KAAK,CACjB,cAAc,GAAG,IAAK,CACzB,sCAAsC;oBACvC,yFAAyF;iBAC5F,CAAC,IAAI,CAAC,GAAG,CAAC,CACd,CAAC;gBACF,uBAAuB,GAAG,IAAI,CAAC;YACnC,CAAC,EAAE,IAAK,CAAC;SACZ,CAAC;QAEF,aAAa,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;YAC/B,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC/B,IAAI,UAAU,IAAI,uBAAuB,EAAE,CAAC;gBACxC,OAAO,CAAC,GAAG,CACP;oBACI,iEAAiE;oBACjE,6CAA6C;iBAChD,CAAC,IAAI,CAAC,GAAG,CAAC,CACd,CAAC;YACN,CAAC;QACL,CAAC,CAAC;IACN,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,iCAAiC,EAAE,GAAG,wBAAwB,EAAE,CAAC,SAAS,CAC3F,YAAY,CAAC,EAAE;QACX,IAAI,YAAY,CAAC,KAAK,KAAK,2BAA2B,EAAE,CAAC;YACrD,OAAO;QACX,CAAC;QAED,iCAAiC,EAAE,CAAC;QAEpC,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,kBAAkB,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QAE3E,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEnD,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpC,OAAO,CAAC,OAAO,CAAC;YACZ,OAAO,EAAE,+BAA+B;YACxC,YAAY;SACf,CAAC,CAAC;IACP,CAAC,CACJ,CAAC;IAEF,MAAM,yBAAyB,GAAG,CAAC,GAAW,EAAE,EAAE;QAC9C,sBAAsB,EAAE,CAAC;YACrB,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,sBAAsB,CAAC;YACjC,CAAC;YAED,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAEtE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACtB,SAAS;gBACb,CAAC;gBACD,GAAG,GAAG,sBAAsB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;YACjF,CAAC;QACL,CAAC;QAED,mBAAmB,EAAE,CAAC;YAClB,IAAI,0BAA0B,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,mBAAmB,CAAC;YAC9B,CAAC;YACD,GAAG,GAAG,0BAA0B,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,GAAG,CAAC;IACf,CAAC,CAAC;IAEF,uBAAuB;SAClB,YAAY,CAAC;QACV,KAAK,EAAE,EAAE,CAAmB;YACxB,OAAO,EAAE,QAAQ;YACjB,QAAQ;SACX,CAAC;QACF,6BAA6B,EAAE,cAAc,GAAG,IAAI;QACpD,gBAAgB,EACZ,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;QACtF,YAAY,EAAE,yBAAyB;KAC1C,CAAC;SACD,IAAI,CACD,gBAAgB,CAAC,EAAE;QACf,MAAM,CAAC,gBAAgB,KAAK,IAAI,EAAE,kDAAkD,CAAC,CAAC;QAEtF,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,iCAAiC,EAAE,CAAC;QAEpC,OAAO,CAAC,OAAO,CAAC;YACZ,OAAO,EAAE,qCAAqC;YAC9C,gBAAgB;SACnB,CAAC,CAAC;IACP,CAAC,EACD,GAAG,EAAE;QACD,yEAAyE;QACzE,qEAAqE;IACzE,CAAC,CACJ,CAAC;IAEN,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QACrB,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,eAAe,CAAC,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACrE,iCAAiC,EAAE,CAAC;QACxC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,EAAE,CAAC;AACtB,CAAC"}

package/esm/tools/Evt.js

@@ -1,19 +1,21 @@
 import { Deferred } from "./Deferred";
-import { assert, is } from "../tools/tsafe/assert";
 export function createEvt() {
-    const eventTarget = new EventTarget();
-    const KEY = "event";
+    const listeners = [];
     let postCount = 0;
     const evt = {
         subscribe: next => {
-            const listener = (e) => {
-                assert(is(e));
-                next(e.detail);
-            };
-            eventTarget.addEventListener(KEY, listener);
+            listeners.push(next);
+            let isActive = true;
             return {
                 unsubscribe: () => {
-                    eventTarget.removeEventListener(KEY, listener);
+                    if (!isActive) {
+                        return;
+                    }
+                    isActive = false;
+                    const i = listeners.indexOf(next);
+                    if (i >= 0) {
+                        listeners.splice(i, 1);
+                    }
                 }
             };
         },
@@ -27,7 +29,13 @@ export function createEvt() {
         },
         post: (data) => {
             postCount++;
-            eventTarget.dispatchEvent(new CustomEvent(KEY, { detail: data }));
+            const snapshot = listeners.slice();
+            for (const l of snapshot) {
+                try {
+                    l(data);
+                }
+                catch { }
+            }
         },
         get postCount() {
             return postCount;

package/esm/tools/Evt.js.map

@@ -1 +1 @@
-{"version":3,"file":"Evt.js","sourceRoot":"","sources":["../../src/tools/Evt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAC;AAYnD,MAAM,UAAU,SAAS;IACrB,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC;IAEpB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,MAAM,GAAG,GAAW;QAChB,SAAS,EAAE,IAAI,CAAC,EAAE;YACd,MAAM,QAAQ,GAAG,CAAC,CAAQ,EAAE,EAAE;gBAC1B,MAAM,CAAC,EAAE,CAAiB,CAAC,CAAC,CAAC,CAAC;gBAE9B,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACnB,CAAC,CAAC;YAEF,WAAW,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAE5C,OAAO;gBACH,WAAW,EAAE,GAAG,EAAE;oBACd,WAAW,CAAC,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACnD,CAAC;aACJ,CAAC;QACN,CAAC;QACD,OAAO,EAAE,GAAG,EAAE;YACV,MAAM,CAAC,GAAG,IAAI,QAAQ,EAAK,CAAC;YAE5B,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;gBACzC,WAAW,EAAE,CAAC;gBACd,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,CAAC,EAAE,CAAC;QAChB,CAAC;QACD,IAAI,EAAE,CAAC,IAAO,EAAE,EAAE;YACd,SAAS,EAAE,CAAC;YACZ,WAAW,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,SAAS;YACT,OAAO,SAAS,CAAC;QACrB,CAAC;KACJ,CAAC;IAEF,OAAO,GAAG,CAAC;AACf,CAAC"}
+{"version":3,"file":"Evt.js","sourceRoot":"","sources":["../../src/tools/Evt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAYtC,MAAM,UAAU,SAAS;IACrB,MAAM,SAAS,GAA6B,EAAE,CAAC;IAC/C,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,MAAM,GAAG,GAAW;QAChB,SAAS,EAAE,IAAI,CAAC,EAAE;YACd,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,QAAQ,GAAG,IAAI,CAAC;YACpB,OAAO;gBACH,WAAW,EAAE,GAAG,EAAE;oBACd,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACZ,OAAO;oBACX,CAAC;oBACD,QAAQ,GAAG,KAAK,CAAC;oBACjB,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAClC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACT,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC3B,CAAC;gBACL,CAAC;aACJ,CAAC;QACN,CAAC;QACD,OAAO,EAAE,GAAG,EAAE;YACV,MAAM,CAAC,GAAG,IAAI,QAAQ,EAAK,CAAC;YAC5B,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;gBACzC,WAAW,EAAE,CAAC;gBACd,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,EAAE,CAAC;QAChB,CAAC;QACD,IAAI,EAAE,CAAC,IAAO,EAAE,EAAE;YACd,SAAS,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACD,CAAC,CAAC,IAAI,CAAC,CAAC;gBACZ,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACd,CAAC;QACL,CAAC;QACD,IAAI,SAAS;YACT,OAAO,SAAS,CAAC;QACrB,CAAC;KACJ,CAAC;IAEF,OAAO,GAAG,CAAC;AACf,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "oidc-spa",
-    "version": "8.2.12",
-    "description": "Openidconnect client for Single Page Applications",
+    "version": "8.3.1",
+    "description": "OIDC Client for Client Centric Web Applications",
     "repository": {
         "type": "git",
         "url": "git://github.com/keycloakify/oidc-spa.git"

package/src/core/createOidc.ts

@@ -748,7 +748,14 @@ export async function createOidc_nonMemoized<
                     {
                         log?.(
                             `Handling login redirect auth response ${JSON.stringify(
-                                authResponse,
+                                {
+                                    ...authResponse,
+                                    ...(authResponse.code === undefined
+                                        ? undefined
+                                        : {
+                                              code: authResponse.code.slice(0, 20) + "..."
+                                          })
+                                },
                                 null,
                                 2
                             )}`

package/src/core/earlyInit.ts

@@ -1,23 +1,22 @@
 import { getStateData, getIsStatQueryParamValue } from "./StateData";
 import { assert, type Equals } from "../tools/tsafe/assert";
 import type { AuthResponse } from "./AuthResponse";
-import {
-    iframeMessageProtection_captureAndLockBuiltins,
-    postEncryptedAuthResponseToParent
-} from "./iframeMessageProtection";
 import { setOidcRequiredPostHydrationReplaceNavigationUrl } from "./requiredPostHydrationReplaceNavigationUrl";
 import { setBASE_URL } from "./BASE_URL";
 import { resolvePrShouldLoadApp } from "./prShouldLoadApp";
 import { isBrowser } from "../tools/isBrowser";
+import { createEvt, type Evt } from "../tools/Evt";
 
 let hasEarlyInitBeenCalled = false;
 
+const IFRAME_MESSAGE_PREFIX = "oidc-spa:cross-window-messaging:";
+
 export function oidcEarlyInit(params: {
-    freezeFetch: boolean;
-    freezeXMLHttpRequest: boolean;
-    // NOTE: Made optional just to avoid breaking change.
-    // Will be made mandatory next major.
+    freezeFetch?: boolean;
+    freezeXMLHttpRequest?: boolean;
     freezeWebSocket?: boolean;
+    freezePromise?: boolean;
+    safeMode?: boolean;
     isPostLoginRedirectManual?: boolean;
     BASE_URL?: string;
 }) {
@@ -34,7 +33,9 @@ export function oidcEarlyInit(params: {
     const {
         freezeFetch,
         freezeXMLHttpRequest,
-        freezeWebSocket = false,
+        freezeWebSocket,
+        freezePromise,
+        safeMode = false,
         isPostLoginRedirectManual = false,
         BASE_URL
     } = params;
@@ -42,52 +43,213 @@ export function oidcEarlyInit(params: {
     const { shouldLoadApp } = handleOidcCallback({ isPostLoginRedirectManual });
 
     if (shouldLoadApp) {
-        if (freezeXMLHttpRequest) {
-            const XMLHttpRequest_trusted = globalThis.XMLHttpRequest;
+        const createWriteError = (target: string) =>
+            new Error(
+                [
+                    `oidc-spa: Monkey patching of ${target} has been blocked for security reasons.`,
+                    "You can disable this restriction by setting `safeMode: false` in `oidcEarlyInit()`",
+                    "or in your Vite plugin configuration,",
+                    "but please note this will reduce security.",
+                    "If you believe this restriction is too strict, please open an issue at:",
+                    "https://github.com/keycloakify/oidc-spa",
+                    "We're still identifying real-world blockers and can safely add exceptions where needed.",
+                    "For now, we prefer to err on the side of hardening rather than exposure."
+                ].join(" ")
+            );
 
-            Object.freeze(XMLHttpRequest_trusted.prototype);
-            Object.freeze(XMLHttpRequest_trusted);
+        for (const name of [
+            "fetch",
+            "XMLHttpRequest",
+            "WebSocket",
+            "String",
+            "Object",
+            "Promise",
+            "Array",
+            "RegExp",
+            "TextEncoder",
+            "Uint8Array",
+            "Uint32Array",
+            "Response",
+            "Reflect",
+            "JSON",
+            "encodeURIComponent",
+            "decodeURIComponent",
+            "atob",
+            "btoa"
+        ] as const) {
+            const doSkip = (() => {
+                switch (name) {
+                    case "XMLHttpRequest":
+                        if (freezeXMLHttpRequest !== undefined) {
+                            return !freezeXMLHttpRequest;
+                        }
+                        break;
+                    case "fetch":
+                        if (freezeFetch !== undefined) {
+                            return !freezeFetch;
+                        }
+                        break;
+                    case "WebSocket":
+                        if (freezeWebSocket !== undefined) {
+                            return !freezeWebSocket;
+                        }
+                        break;
+                    case "Promise":
+                        if (freezePromise !== undefined) {
+                            return !freezePromise;
+                        }
+                        break;
+                }
 
-            Object.defineProperty(globalThis, "XMLHttpRequest", {
-                configurable: false,
-                writable: false,
-                enumerable: true,
-                value: XMLHttpRequest_trusted
-            });
-        }
+                return !safeMode;
+            })();
+
+            if (doSkip) {
+                continue;
+            }
 
-        if (freezeFetch) {
-            const fetch_trusted = globalThis.fetch;
+            const original = window[name];
+
+            if ("prototype" in original) {
+                for (const propertyName of Object.getOwnPropertyNames(original.prototype)) {
+                    if (name === "Object") {
+                        if (
+                            propertyName === "toString" ||
+                            propertyName === "constructor" ||
+                            propertyName === "valueOf"
+                        ) {
+                            continue;
+                        }
+                    }
+
+                    if (name === "Array") {
+                        if (propertyName === "constructor" || propertyName === "concat") {
+                            continue;
+                        }
+                    }
+
+                    const pd = Object.getOwnPropertyDescriptor(original.prototype, propertyName);
+
+                    assert(pd !== undefined);
+
+                    if (!pd.configurable) {
+                        continue;
+                    }
+
+                    Object.defineProperty(original.prototype, propertyName, {
+                        enumerable: pd.enumerable,
+                        configurable: false,
+                        ...("value" in pd
+                            ? {
+                                  get: () => pd.value,
+                                  set: () => {
+                                      throw createWriteError(`window.${name}.prototype.${propertyName}`);
+                                  }
+                              }
+                            : {
+                                  get: pd.get,
+                                  set:
+                                      pd.set ??
+                                      (() => {
+                                          throw createWriteError(
+                                              `window.${name}.prototype.${propertyName}`
+                                          );
+                                      })
+                              })
+                    });
+                }
+            }
 
-            Object.freeze(fetch_trusted);
+            Object.freeze(original);
 
-            Object.defineProperty(globalThis, "fetch", {
+            Object.defineProperty(window, name, {
                 configurable: false,
-                writable: false,
                 enumerable: true,
-                value: fetch_trusted
+                get: () => original,
+                set: () => {
+                    throw createWriteError(`window.${name}`);
+                }
             });
         }
 
-        if (freezeWebSocket) {
-            const WebSocket_trusted = globalThis.WebSocket;
+        if (safeMode) {
+            for (const name of ["call", "apply", "bind"] as const) {
+                const original = Function.prototype[name];
+
+                Object.defineProperty(Function.prototype, name, {
+                    configurable: false,
+                    enumerable: true,
+                    get: () => original,
+                    set: () => {
+                        throw createWriteError(`window.Function.prototype.${name});`);
+                    }
+                });
+            }
+        }
 
-            Object.freeze(WebSocket_trusted.prototype);
-            Object.freeze(WebSocket_trusted);
+        const _MessageEvent_prototype_data_get = (() => {
+            const pd = Object.getOwnPropertyDescriptor(MessageEvent.prototype, "data");
 
-            Object.defineProperty(globalThis, "WebSocket", {
-                configurable: false,
-                writable: false,
-                enumerable: true,
-                value: WebSocket_trusted
-            });
-        }
+            assert(pd !== undefined);
+
+            const { get } = pd;
+
+            assert(get !== undefined);
+
+            return get;
+        })();
+
+        const _MessageEvent_prototype_origin_get = (() => {
+            const pd = Object.getOwnPropertyDescriptor(MessageEvent.prototype, "origin");
+
+            assert(pd !== undefined);
+
+            const { get } = pd;
+
+            assert(get !== undefined);
+
+            return get;
+        })();
+
+        const _Event_prototype_stopImmediatePropagation_value = Event.prototype.stopImmediatePropagation;
+
+        const origin = window.location.origin;
+
+        window.addEventListener(
+            "message",
+            event => {
+                if (_MessageEvent_prototype_origin_get.call(event) !== origin) {
+                    return;
+                }
+
+                const eventData: unknown = _MessageEvent_prototype_data_get.call(event);
+
+                if (typeof eventData !== "string") {
+                    return;
+                }
+
+                if (!eventData.startsWith(IFRAME_MESSAGE_PREFIX)) {
+                    return;
+                }
+
+                _Event_prototype_stopImmediatePropagation_value.call(event);
+
+                const authResponse: AuthResponse = JSON.parse(
+                    eventData.slice(IFRAME_MESSAGE_PREFIX.length)
+                );
+
+                (evtIframeAuthResponse ??= createEvt()).post(authResponse);
+            },
+            {
+                capture: true,
+                once: false,
+                passive: false
+            }
+        );
 
         if (BASE_URL !== undefined) {
             setBASE_URL({ BASE_URL });
         }
-
-        iframeMessageProtection_captureAndLockBuiltins();
     }
 
     resolvePrShouldLoadApp({ shouldLoadApp });
@@ -95,6 +257,12 @@ export function oidcEarlyInit(params: {
     return { shouldLoadApp };
 }
 
+let evtIframeAuthResponse: Evt<AuthResponse> | undefined = undefined;
+
+export function getEvtIframeAuthResponse() {
+    return (evtIframeAuthResponse ??= createEvt());
+}
+
 let redirectAuthResponse: AuthResponse | undefined = undefined;
 
 export function getRedirectAuthResponse():
@@ -208,7 +376,19 @@ function handleOidcCallback(params: { isPostLoginRedirectManual?: boolean }): {
 
     switch (stateData.context) {
         case "iframe":
-            postEncryptedAuthResponseToParent({ authResponse });
+            if (parent !== top) {
+                const errorMessage = [
+                    "oidc-spa: For security reasons, refusing to post the auth response.",
+                    "If you want your app to be framable use sessionRestorationMethod: 'full page redirect'."
+                ].join(" ");
+                alert(errorMessage);
+
+                throw new Error(errorMessage);
+            }
+            parent.postMessage(
+                `${IFRAME_MESSAGE_PREFIX}${JSON.stringify(authResponse)}`,
+                location.origin
+            );
             return { shouldLoadApp: false };
         case "redirect": {
             redirectAuthResponse = authResponse;