oidc-spa 8.4.8 → 8.5.2

package/core/oidcClientTsUserToTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidcClientTsUserToTokens.js","sourceRoot":"","sources":["../src/core/oidcClientTsUserToTokens.ts"],"names":[],"mappings":";;AAQA,4DA2OC;AAlPD,kDAA+C;AAC/C,0CAAuC;AACvC,8EAA2E;AAC3E,kDAA+C;AAE/C,0DAAuD;AAEvD,SAAgB,wBAAwB,CAAiD,MAQxF;IACG,MAAM,EACF,gBAAgB,EAChB,oBAAoB,EACpB,gCAAgC,EAChC,uBAAuB,EACvB,GAAG,EACN,GAAG,MAAM,CAAC;IAEX,MAAM,WAAW,GAAG,uBAAuB,KAAK,SAAS,CAAC;IAE1D,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,CAAC;IAElD,MAAM,YAAY,GAAG,gBAAgB,CAAC,aAAa,CAAC;IAEpD,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC;IAE1C,IAAA,eAAM,EAAC,OAAO,KAAK,SAAS,EAAE,yCAAyC,CAAC,CAAC;IAEzE,MAAM,uBAAuB,GAAG,IAAA,qBAAS,EAA0C,OAAO,CAAC,CAAC;IAE5F,IAAI,WAAW,EAAE,CAAC;QACd,GAAG,EAAE,CACD;YACI,kBAAkB;YAClB,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0CAA0C;YACpF,IAAI,CAAC,SAAS,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;SACnD,CAAC,IAAI,CAAC,EAAE,CAAC,CACb,CAAC;IACN,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;QACzB,IAAI,cAA8B,CAAC;QAEnC,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrC,cAAc,GAAG,oBAAoB,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAErE,IAAI,WAAW,EAAE,CAAC;gBACd,GAAG,EAAE,CACD;oBACI,yDAAyD;oBACzD,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;iBAC1C,CAAC,IAAI,CAAC,EAAE,CAAC,CACb,CAAC;YACN,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,mBAAmB;YACnB,cAAc,GAAG,uBAAuB,CAAC;QAC7C,CAAC;QAED,IACI,uBAAuB,KAAK,SAAS;YACrC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAC5E,CAAC;YACC,2EAA2E;YAC3E,OAAO,uBAAuB,CAAC;QACnC,CAAC;QAED,OAAO,cAAc,CAAC;IAC1B,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;QACvB,0DAA0D;QAC1D,2DAA2D;QAC3D,6BAA6B;QAC7B,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;YACvB,IAAI,GAAuB,CAAC;YAE5B,IAAI,CAAC;gBACD,MAAM,cAAc,GAAG,uBAAuB,CAAC,GAAG,CAAC;gBACnD,IAAA,eAAM,EAAC,cAAc,KAAK,SAAS,IAAI,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC;gBAC3E,GAAG,GAAG,cAAc,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACL,GAAG,GAAG,SAAS,CAAC;YACpB,CAAC;YAED,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACpB,OAAO,SAAS,CAAC;YACrB,CAAC;YAED,OAAO,GAAG,CAAC;QACf,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,YAAY,GAAG,IAAI,CAAC;IAC/B,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,aAAa,GAAuC;QACtD,GAAG,CAAC,gCAAgC;YAChC,CAAC,CAAC;gBACI,WAAW,EAAE,OAAO;gBACpB,yBAAyB,EAAE,CAAC,GAAG,EAAE;oBAC7B,MAAM,cAAc,GAAG,IAAA,iDAAuB,EAAC,OAAO,CAAC,CAAC;oBAExD,IAAA,eAAM,EACF,cAAc,KAAK,SAAS,EAC5B,oGAAoG,CACvG,CAAC;oBAEF,OAAO,cAAc,CAAC;gBAC1B,CAAC,CAAC,EAAE;aACP;YACH,CAAC,CAAC;gBACI,WAAW;gBACX,yBAAyB,EAAE,CAAC,GAAG,EAAE;oBAC7B,aAAa,EAAE,CAAC;wBACZ,MAAM,cAAc,GAAG,IAAA,iDAAuB,EAAC,WAAW,CAAC,CAAC;wBAE5D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;4BAC/B,MAAM,aAAa,CAAC;wBACxB,CAAC;wBAED,OAAO,cAAc,CAAC;oBAC1B,CAAC;oBAED,mCAAmC,EAAE,CAAC;wBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,wBAAwB,CAAC;wBAEjE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;4BAC3B,MAAM,mCAAmC,CAAC;wBAC9C,CAAC;wBAED,IAAA,eAAM,EAAC,OAAO,UAAU,KAAK,QAAQ,EAAE,SAAS,CAAC,CAAC;wBAElD,OAAO,UAAU,GAAG,IAAI,CAAC;oBAC7B,CAAC;oBAED,mCAAmC,EAAE,CAAC;wBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,wBAAwB,CAAC;wBAEjE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;4BAC3B,MAAM,mCAAmC,CAAC;wBAC9C,CAAC;wBAED,IAAA,eAAM,EAAC,OAAO,UAAU,KAAK,QAAQ,EAAE,WAAW,CAAC,CAAC;wBAEpD,OAAO,YAAY,GAAG,UAAU,GAAG,IAAK,CAAC;oBAC7C,CAAC;oBAED,IAAA,eAAM,EAAC,KAAK,EAAE,4CAA4C,CAAC,CAAC;gBAChE,CAAC,CAAC,EAAE;aACP,CAAC;QACR,OAAO;QACP,cAAc;QACd,uBAAuB;QACvB,YAAY;QACZ,gBAAgB,EAAE,CAAC,GAAG,EAAE;YACpB,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,mCAAmC,CAAC;YAChF,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,GAAG,kBAAkB,CAAC,CAAC;QAClE,CAAC,CAAC,EAAE;KACP,CAAC;IAEF,MAAM,MAAM,GACR,YAAY,KAAK,SAAS;QACtB,CAAC,CAAC,IAAA,OAAE,EAAkD;YAChD,GAAG,aAAa;YAChB,eAAe,EAAE,KAAK;SACzB,CAAC;QACJ,CAAC,CAAC,IAAA,OAAE,EAA+C;YAC7C,GAAG,aAAa;YAChB,eAAe,EAAE,IAAI;YACrB,YAAY;YACZ,0BAA0B,EAAE,CAAC,GAAG,EAAE;gBAC9B,mCAAmC,EAAE,CAAC;oBAClC,MAAM,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,CAAC,wBAAwB,CAAC;oBAEzE,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;wBACnC,MAAM,mCAAmC,CAAC;oBAC9C,CAAC;oBAED,IAAA,eAAM,EAAC,OAAO,kBAAkB,KAAK,QAAQ,EAAE,SAAS,CAAC,CAAC;oBAE1D,IAAI,kBAAkB,KAAK,CAAC,EAAE,CAAC;wBAC3B,OAAO,6BAAa,CAAC;oBACzB,CAAC;oBAED,OAAO,kBAAkB,GAAG,IAAI,CAAC;gBACrC,CAAC;gBAED,mCAAmC,EAAE,CAAC;oBAClC,MAAM,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,CAAC,wBAAwB,CAAC;oBAEzE,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;wBACnC,MAAM,mCAAmC,CAAC;oBAC9C,CAAC;oBAED,IAAA,eAAM,EAAC,OAAO,kBAAkB,KAAK,QAAQ,EAAE,YAAY,CAAC,CAAC;oBAE7D,IAAI,kBAAkB,KAAK,CAAC,EAAE,CAAC;wBAC3B,OAAO,6BAAa,CAAC;oBACzB,CAAC;oBAED,OAAO,YAAY,GAAG,kBAAkB,GAAG,IAAI,CAAC;gBACpD,CAAC;gBAED,aAAa,EAAE,CAAC;oBACZ,MAAM,cAAc,GAAG,IAAA,iDAAuB,EAAC,YAAY,CAAC,CAAC;oBAE7D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;wBAC/B,MAAM,aAAa,CAAC;oBACxB,CAAC;oBAED,OAAO,cAAc,CAAC;gBAC1B,CAAC;gBAED,OAAO,SAAS,CAAC;YACrB,CAAC,CAAC,EAAE;SACP,CAAC,CAAC;IAEb,IACI,WAAW;QACX,MAAM,CAAC,eAAe;QACtB,MAAM,CAAC,0BAA0B,KAAK,SAAS;QAC/C,MAAM,CAAC,0BAA0B,GAAG,MAAM,CAAC,yBAAyB,EACtE,CAAC;QACC,OAAO,CAAC,IAAI,CACR;YACI,oFAAoF;YACpF,uDAAuD;SAC1D,CAAC,IAAI,CAAC,GAAG,CAAC,CACd,CAAC;IACN,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC"}
+{"version":3,"file":"oidcClientTsUserToTokens.js","sourceRoot":"","sources":["../src/core/oidcClientTsUserToTokens.ts"],"names":[],"mappings":";;AASA,4DAwPC;AAhQD,kDAA+C;AAC/C,0CAAuC;AACvC,8EAA2E;AAC3E,kDAA+C;AAE/C,0DAAuD;AACvD,iFAAsG;AAEtG,SAAgB,wBAAwB,CAAiD,MASxF;IACG,MAAM,EACF,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,EACpB,gCAAgC,EAChC,uBAAuB,EACvB,GAAG,EACN,GAAG,MAAM,CAAC;IAEX,MAAM,WAAW,GAAG,uBAAuB,KAAK,SAAS,CAAC;IAE1D,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,CAAC;IAElD,MAAM,YAAY,GAAG,gBAAgB,CAAC,aAAa,CAAC;IAEpD,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC;IAE1C,IAAA,eAAM,EAAC,OAAO,KAAK,SAAS,EAAE,yCAAyC,CAAC,CAAC;IAEzE,MAAM,uBAAuB,GAAG,IAAA,qBAAS,EAA0C,OAAO,CAAC,CAAC;IAE5F,IAAI,WAAW,EAAE,CAAC;QACd,GAAG,EAAE,CACD;YACI,kBAAkB;YAClB,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0CAA0C;YACpF,IAAI,CAAC,SAAS,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;SACnD,CAAC,IAAI,CAAC,EAAE,CAAC,CACb,CAAC;IACN,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;QACzB,IAAI,cAA8B,CAAC;QAEnC,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrC,cAAc,GAAG,oBAAoB,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAErE,IAAI,WAAW,EAAE,CAAC;gBACd,GAAG,EAAE,CACD;oBACI,yDAAyD;oBACzD,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;iBAC1C,CAAC,IAAI,CAAC,EAAE,CAAC,CACb,CAAC;YACN,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,mBAAmB;YACnB,cAAc,GAAG,uBAAuB,CAAC;QAC7C,CAAC;QAED,IACI,uBAAuB,KAAK,SAAS;YACrC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAC5E,CAAC;YACC,2EAA2E;YAC3E,OAAO,uBAAuB,CAAC;QACnC,CAAC;QAED,OAAO,cAAc,CAAC;IAC1B,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;QACvB,0DAA0D;QAC1D,2DAA2D;QAC3D,6BAA6B;QAC7B,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;YACvB,IAAI,GAAuB,CAAC;YAE5B,IAAI,CAAC;gBACD,MAAM,cAAc,GAAG,uBAAuB,CAAC,GAAG,CAAC;gBACnD,IAAA,eAAM,EAAC,cAAc,KAAK,SAAS,IAAI,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC;gBAC3E,GAAG,GAAG,cAAc,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACL,GAAG,GAAG,SAAS,CAAC;YACpB,CAAC;YAED,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACpB,OAAO,SAAS,CAAC;YACrB,CAAC;YAED,OAAO,GAAG,CAAC;QACf,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,YAAY,GAAG,IAAI,CAAC;IAC/B,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,aAAa,GAAuC;QACtD,GAAG,CAAC,gCAAgC;YAChC,CAAC,CAAC;gBACI,WAAW,EAAE,OAAO;gBACpB,yBAAyB,EAAE,CAAC,GAAG,EAAE;oBAC7B,MAAM,cAAc,GAAG,IAAA,iDAAuB,EAAC,OAAO,CAAC,CAAC;oBAExD,IAAA,eAAM,EACF,cAAc,KAAK,SAAS,EAC5B,oGAAoG,CACvG,CAAC;oBAEF,OAAO,cAAc,CAAC;gBAC1B,CAAC,CAAC,EAAE;aACP;YACH,CAAC,CAAC;gBACI,WAAW;gBACX,yBAAyB,EAAE,CAAC,GAAG,EAAE;oBAC7B,aAAa,EAAE,CAAC;wBACZ,MAAM,cAAc,GAAG,IAAA,iDAAuB,EAAC,WAAW,CAAC,CAAC;wBAE5D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;4BAC/B,MAAM,aAAa,CAAC;wBACxB,CAAC;wBAED,OAAO,cAAc,CAAC;oBAC1B,CAAC;oBAED,mCAAmC,EAAE,CAAC;wBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,wBAAwB,CAAC;wBAEjE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;4BAC3B,MAAM,mCAAmC,CAAC;wBAC9C,CAAC;wBAED,IAAA,eAAM,EAAC,OAAO,UAAU,KAAK,QAAQ,EAAE,SAAS,CAAC,CAAC;wBAElD,OAAO,UAAU,GAAG,IAAI,CAAC;oBAC7B,CAAC;oBAED,mCAAmC,EAAE,CAAC;wBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,wBAAwB,CAAC;wBAEjE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;4BAC3B,MAAM,mCAAmC,CAAC;wBAC9C,CAAC;wBAED,IAAA,eAAM,EAAC,OAAO,UAAU,KAAK,QAAQ,EAAE,WAAW,CAAC,CAAC;wBAEpD,OAAO,YAAY,GAAG,UAAU,GAAG,IAAK,CAAC;oBAC7C,CAAC;oBAED,IAAA,eAAM,EAAC,KAAK,EAAE,4CAA4C,CAAC,CAAC;gBAChE,CAAC,CAAC,EAAE;aACP,CAAC;QACR,OAAO;QACP,cAAc;QACd,uBAAuB;QACvB,YAAY;QACZ,gBAAgB,EAAE,CAAC,GAAG,EAAE;YACpB,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,mCAAmC,CAAC;YAChF,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,GAAG,kBAAkB,CAAC,CAAC;QAClE,CAAC,CAAC,EAAE;KACP,CAAC;IAEF,MAAM,MAAM,GACR,YAAY,KAAK,SAAS;QACtB,CAAC,CAAC,IAAA,OAAE,EAAkD;YAChD,GAAG,aAAa;YAChB,eAAe,EAAE,KAAK;SACzB,CAAC;QACJ,CAAC,CAAC,IAAA,OAAE,EAA+C;YAC7C,GAAG,aAAa;YAChB,eAAe,EAAE,IAAI;YACrB,YAAY;YACZ,0BAA0B,EAAE,CAAC,GAAG,EAAE;gBAC9B,mCAAmC,EAAE,CAAC;oBAClC,MAAM,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,CAAC,wBAAwB,CAAC;oBAEzE,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;wBACnC,MAAM,mCAAmC,CAAC;oBAC9C,CAAC;oBAED,IAAA,eAAM,EAAC,OAAO,kBAAkB,KAAK,QAAQ,EAAE,SAAS,CAAC,CAAC;oBAE1D,IAAI,kBAAkB,KAAK,CAAC,EAAE,CAAC;wBAC3B,OAAO,6BAAa,CAAC;oBACzB,CAAC;oBAED,OAAO,kBAAkB,GAAG,IAAI,CAAC;gBACrC,CAAC;gBAED,mCAAmC,EAAE,CAAC;oBAClC,MAAM,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,CAAC,wBAAwB,CAAC;oBAEzE,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;wBACnC,MAAM,mCAAmC,CAAC;oBAC9C,CAAC;oBAED,IAAA,eAAM,EAAC,OAAO,kBAAkB,KAAK,QAAQ,EAAE,YAAY,CAAC,CAAC;oBAE7D,IAAI,kBAAkB,KAAK,CAAC,EAAE,CAAC;wBAC3B,OAAO,6BAAa,CAAC;oBACzB,CAAC;oBAED,OAAO,YAAY,GAAG,kBAAkB,GAAG,IAAI,CAAC;gBACpD,CAAC;gBAED,aAAa,EAAE,CAAC;oBACZ,MAAM,cAAc,GAAG,IAAA,iDAAuB,EAAC,YAAY,CAAC,CAAC;oBAE7D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;wBAC/B,MAAM,aAAa,CAAC;oBACxB,CAAC;oBAED,OAAO,cAAc,CAAC;gBAC1B,CAAC;gBAED,OAAO,SAAS,CAAC;YACrB,CAAC,CAAC,EAAE;SACP,CAAC,CAAC;IAEb,IAAI,IAAA,4DAA6B,GAAE,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,IAAA,oDAAqB,EAAC;YACvC,QAAQ;YACR,MAAM;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;QAC9C,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QACtC,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;IACpD,CAAC;IAED,IACI,WAAW;QACX,MAAM,CAAC,eAAe;QACtB,MAAM,CAAC,0BAA0B,KAAK,SAAS;QAC/C,MAAM,CAAC,0BAA0B,GAAG,MAAM,CAAC,yBAAyB,EACtE,CAAC;QACC,OAAO,CAAC,IAAI,CACR;YACI,oFAAoF;YACpF,uDAAuD;SAC1D,CAAC,IAAI,CAAC,GAAG,CAAC,CACd,CAAC;IACN,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/core/tokenExfiltrationDefense.d.ts

@@ -0,0 +1,6 @@
+type Params = {
+    resourceServersAllowedHostnames: string[] | undefined;
+    serviceWorkersAllowedHostnames: string[] | undefined;
+};
+export declare function enableTokenExfiltrationDefense(params: Params): void;
+export {};

package/core/tokenExfiltrationDefense.js

@@ -0,0 +1,616 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enableTokenExfiltrationDefense = enableTokenExfiltrationDefense;
+const assert_1 = require("../tools/tsafe/assert");
+const tokenPlaceholderSubstitution_1 = require("./tokenPlaceholderSubstitution");
+const isHostnameAuthorized_1 = require("../tools/isHostnameAuthorized");
+const viteHashedJsAssetPathRegExp = /\/assets\/[^/]+-[a-zA-Z0-9_-]{8}\.js$/;
+function enableTokenExfiltrationDefense(params) {
+    const { resourceServersAllowedHostnames = [], serviceWorkersAllowedHostnames = [] } = params;
+    (0, tokenPlaceholderSubstitution_1.markTokenSubstitutionAdEnabled)();
+    patchFetchApiToSubstituteTokenPlaceholder({ resourceServersAllowedHostnames });
+    patchXMLHttpRequestApiToSubstituteTokenPlaceholder({ resourceServersAllowedHostnames });
+    patchWebSocketApiToSubstituteTokenPlaceholder({ resourceServersAllowedHostnames });
+    patchEventSourceApiToSubstituteTokenPlaceholder({ resourceServersAllowedHostnames });
+    patchNavigatorSendBeaconApiToSubstituteTokenPlaceholder({ resourceServersAllowedHostnames });
+    restrictServiceWorkerRegistration({ serviceWorkersAllowedHostnames });
+    runMonkeyPatchingPrevention();
+}
+function patchFetchApiToSubstituteTokenPlaceholder(params) {
+    const { resourceServersAllowedHostnames } = params;
+    const fetch_actual = window.fetch;
+    window.fetch = async function fetch(input, init) {
+        const request = input instanceof Request ? input : new Request(input, init);
+        prevent_fetching_of_hashed_js_assets: {
+            const { pathname } = new URL(request.url, window.location.href);
+            if (!viteHashedJsAssetPathRegExp.test(pathname)) {
+                break prevent_fetching_of_hashed_js_assets;
+            }
+            throw new Error("oidc-spa: Blocked request to hashed js static asset.");
+        }
+        let didSubstitute = false;
+        const headers = new Headers();
+        request.headers.forEach((value, key) => {
+            const nextValue = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(value);
+            if (nextValue !== value) {
+                didSubstitute = true;
+            }
+            headers.set(key, nextValue);
+        });
+        let body;
+        handle_body: {
+            from_init: {
+                if (!init) {
+                    break from_init;
+                }
+                if (!init.body) {
+                    break from_init;
+                }
+                if (input instanceof Request && input.body !== null) {
+                    break from_init;
+                }
+                if (typeof init.body === "string") {
+                    body = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(init.body);
+                    if (init.body !== body) {
+                        didSubstitute = true;
+                    }
+                    break handle_body;
+                }
+                if (init.body instanceof URLSearchParams) {
+                    let didUrlSearchParamsSubstitute = false;
+                    const next = new URLSearchParams();
+                    init.body.forEach((value, key) => {
+                        const nextValue = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(value);
+                        if (nextValue !== value) {
+                            didUrlSearchParamsSubstitute = true;
+                        }
+                        next.append(key, nextValue);
+                    });
+                    if (didUrlSearchParamsSubstitute) {
+                        didSubstitute = true;
+                    }
+                    body = didUrlSearchParamsSubstitute ? next : init.body;
+                    break handle_body;
+                }
+                if (init.body instanceof FormData) {
+                    let didFormDataSubstitute = false;
+                    const next = new FormData();
+                    init.body.forEach((value, key) => {
+                        if (typeof value === "string") {
+                            const nextValue = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(value);
+                            if (nextValue !== value) {
+                                didFormDataSubstitute = true;
+                            }
+                            next.append(key, nextValue);
+                            return;
+                        }
+                        next.append(key, value);
+                    });
+                    if (didFormDataSubstitute) {
+                        didSubstitute = true;
+                    }
+                    body = didFormDataSubstitute ? next : init.body;
+                    break handle_body;
+                }
+                if (init.body instanceof Blob) {
+                    break from_init;
+                }
+                body = init.body;
+                break handle_body;
+            }
+            if (request.body === null) {
+                body = undefined;
+                break handle_body;
+            }
+            const shouldInspectBody = (() => {
+                let ct = request.headers.get("Content-Type");
+                if (ct === null) {
+                    return false;
+                }
+                ct = ct.toLocaleLowerCase();
+                if (!ct.startsWith("application/json") &&
+                    !ct.startsWith("application/x-www-form-urlencoded")) {
+                    return false;
+                }
+                const len_str = request.headers.get("Content-Length");
+                if (!len_str) {
+                    return false;
+                }
+                const len = parseInt(len_str, 10);
+                if (!Number.isFinite(len) || len > 100000) {
+                    return false;
+                }
+                return true;
+            })();
+            if (!shouldInspectBody) {
+                body = request.body;
+                break handle_body;
+            }
+            const bodyText = await request.clone().text();
+            const nextBodyText = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(bodyText);
+            if (nextBodyText !== bodyText) {
+                didSubstitute = true;
+            }
+            body = nextBodyText;
+        }
+        block_authed_request_to_unauthorized_hostnames: {
+            if (!didSubstitute) {
+                break block_authed_request_to_unauthorized_hostnames;
+            }
+            const { hostname } = new URL(request.url, window.location.href);
+            if ((0, isHostnameAuthorized_1.getIsHostnameAuthorized)({
+                allowedHostnames: resourceServersAllowedHostnames,
+                extendAuthorizationToParentDomain: true,
+                hostname
+            })) {
+                break block_authed_request_to_unauthorized_hostnames;
+            }
+            throw new Error([
+                `oidc-spa: Blocked authed request to ${hostname}.`,
+                `To authorize this request add "${hostname}" to`,
+                "`resourceServersAllowedHostnames`."
+            ].join(" "));
+        }
+        const nextInit = {
+            method: request.method,
+            headers,
+            body,
+            mode: request.mode,
+            credentials: request.credentials,
+            cache: request.cache,
+            redirect: request.redirect,
+            referrer: request.referrer,
+            referrerPolicy: request.referrerPolicy,
+            integrity: request.integrity,
+            keepalive: request.keepalive,
+            signal: request.signal
+        };
+        {
+            //@ts-expect-error
+            const duplex = init?.duplex ?? (input instanceof Request ? input.duplex : undefined);
+            if (duplex !== undefined) {
+                //@ts-expect-error
+                nextInit.duplex = duplex;
+            }
+        }
+        return fetch_actual(request.url, nextInit);
+    };
+}
+function patchXMLHttpRequestApiToSubstituteTokenPlaceholder(params) {
+    const { resourceServersAllowedHostnames } = params;
+    const open_actual = XMLHttpRequest.prototype.open;
+    const send_actual = XMLHttpRequest.prototype.send;
+    const setRequestHeader_actual = XMLHttpRequest.prototype.setRequestHeader;
+    const xhrDataSymbol = Symbol("oidc-spa XMLHttpRequest data");
+    const getXhrData = (xhr) => {
+        const xhr_any = xhr;
+        if (xhr_any[xhrDataSymbol] !== undefined) {
+            return xhr_any[xhrDataSymbol];
+        }
+        const data = {
+            url: "",
+            didSubstitute: false
+        };
+        xhr_any[xhrDataSymbol] = data;
+        return data;
+    };
+    XMLHttpRequest.prototype.open = function open(method, url, async, username, password) {
+        const xhrData = getXhrData(this);
+        xhrData.url = typeof url === "string" ? url : url.href;
+        xhrData.didSubstitute = false;
+        if (async === undefined) {
+            return open_actual.bind(this)(method, url);
+        }
+        else {
+            return open_actual.call(this, method, url, async, username, password);
+        }
+    };
+    XMLHttpRequest.prototype.setRequestHeader = function setRequestHeader(name, value) {
+        const xhrData = getXhrData(this);
+        const nextValue = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(value);
+        if (nextValue !== value) {
+            xhrData.didSubstitute = true;
+        }
+        return setRequestHeader_actual.call(this, name, nextValue);
+    };
+    XMLHttpRequest.prototype.send = function send(body) {
+        const xhrData = getXhrData(this);
+        prevent_fetching_of_hashed_js_assets: {
+            const { pathname } = new URL(xhrData.url, window.location.href);
+            if (!viteHashedJsAssetPathRegExp.test(pathname)) {
+                break prevent_fetching_of_hashed_js_assets;
+            }
+            throw new Error("oidc-spa: Blocked request to hashed static asset.");
+        }
+        let nextBody = body;
+        if (typeof body === "string") {
+            const nextBodyText = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(body);
+            if (nextBodyText !== body) {
+                xhrData.didSubstitute = true;
+            }
+            nextBody = nextBodyText;
+        }
+        block_authed_request_to_unauthorized_hostnames: {
+            if (!xhrData.didSubstitute) {
+                break block_authed_request_to_unauthorized_hostnames;
+            }
+            const { hostname } = new URL(xhrData.url, window.location.href);
+            if ((0, isHostnameAuthorized_1.getIsHostnameAuthorized)({
+                allowedHostnames: resourceServersAllowedHostnames,
+                extendAuthorizationToParentDomain: true,
+                hostname
+            })) {
+                break block_authed_request_to_unauthorized_hostnames;
+            }
+            throw new Error([
+                `oidc-spa: Blocked authed request to ${hostname}.`,
+                `To authorize this request add "${hostname}" to`,
+                "`resourceServersAllowedHostnames`."
+            ].join(" "));
+        }
+        return send_actual.call(this, nextBody);
+    };
+}
+function patchWebSocketApiToSubstituteTokenPlaceholder(params) {
+    const { resourceServersAllowedHostnames } = params;
+    const WebSocket_actual = window.WebSocket;
+    const send_actual = WebSocket_actual.prototype.send;
+    const wsDataByWs = new WeakMap();
+    const WebSocketPatched = function WebSocket(url, protocols) {
+        const urlStr = typeof url === "string" ? url : url.href;
+        const nextUrl = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(urlStr);
+        let didSubstitute = nextUrl !== urlStr;
+        const nextProtocols = (() => {
+            if (protocols === undefined) {
+                return protocols;
+            }
+            if (typeof protocols === "string") {
+                const next = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(protocols);
+                if (next !== protocols) {
+                    didSubstitute = true;
+                }
+                return next;
+            }
+            let didProtocolsSubstitute = false;
+            const next = protocols.map(protocol => {
+                const nextProtocol = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(protocol);
+                if (nextProtocol !== protocol) {
+                    didProtocolsSubstitute = true;
+                }
+                return nextProtocol;
+            });
+            if (didProtocolsSubstitute) {
+                didSubstitute = true;
+            }
+            return next;
+        })();
+        const { hostname, pathname } = new URL(nextUrl, window.location.href);
+        block_authed_request_to_unauthorized_hostnames: {
+            if (!didSubstitute) {
+                break block_authed_request_to_unauthorized_hostnames;
+            }
+            if ((0, isHostnameAuthorized_1.getIsHostnameAuthorized)({
+                allowedHostnames: resourceServersAllowedHostnames,
+                extendAuthorizationToParentDomain: true,
+                hostname
+            })) {
+                break block_authed_request_to_unauthorized_hostnames;
+            }
+            throw new Error([
+                `oidc-spa: Blocked authed request to ${hostname}.`,
+                `To authorize this request add "${hostname}" to`,
+                "`resourceServersAllowedHostnames`."
+            ].join(" "));
+        }
+        const ws = new WebSocket_actual(nextUrl, nextProtocols);
+        wsDataByWs.set(ws, {
+            url: nextUrl,
+            hostname,
+            pathname,
+            didSubstitute
+        });
+        return ws;
+    };
+    WebSocketPatched.prototype = WebSocket_actual.prototype;
+    for (const name of ["CONNECTING", "OPEN", "CLOSING", "CLOSED"]) {
+        Object.defineProperty(WebSocketPatched, name, {
+            value: WebSocket_actual[name],
+            writable: false,
+            enumerable: true,
+            configurable: false
+        });
+    }
+    window.WebSocket = WebSocketPatched;
+    WebSocket_actual.prototype.send = function send(data) {
+        const wsData = wsDataByWs.get(this);
+        if (wsData === undefined) {
+            // NOTE: This can happen for Vite's dev server websocket
+            return send_actual.call(this, data);
+        }
+        let nextData = data;
+        if (typeof data === "string") {
+            const nextDataText = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(data);
+            if (nextDataText !== data) {
+                wsData.didSubstitute = true;
+            }
+            nextData = nextDataText;
+        }
+        block_authed_request_to_unauthorized_hostnames: {
+            if (!wsData.didSubstitute) {
+                break block_authed_request_to_unauthorized_hostnames;
+            }
+            if ((0, isHostnameAuthorized_1.getIsHostnameAuthorized)({
+                allowedHostnames: resourceServersAllowedHostnames,
+                extendAuthorizationToParentDomain: true,
+                hostname: wsData.hostname
+            })) {
+                break block_authed_request_to_unauthorized_hostnames;
+            }
+            throw new Error([
+                `oidc-spa: Blocked authed request to ${wsData.hostname}.`,
+                `To authorize this request add "${wsData.hostname}" to`,
+                "`resourceServersAllowedHostnames`."
+            ].join(" "));
+        }
+        prevent_fetching_of_hashed_js_assets: {
+            if (!viteHashedJsAssetPathRegExp.test(wsData.pathname)) {
+                break prevent_fetching_of_hashed_js_assets;
+            }
+            throw new Error("oidc-spa: Blocked request to hashed static asset.");
+        }
+        return send_actual.call(this, nextData);
+    };
+}
+function patchEventSourceApiToSubstituteTokenPlaceholder(params) {
+    const { resourceServersAllowedHostnames } = params;
+    const EventSource_actual = window.EventSource;
+    if (EventSource_actual === undefined) {
+        return;
+    }
+    const EventSourcePatched = function EventSource(url, eventSourceInitDict) {
+        const urlStr = typeof url === "string" ? url : url.href;
+        const nextUrl = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(urlStr);
+        const didSubstitute = nextUrl !== urlStr;
+        const { hostname } = new URL(nextUrl, window.location.href);
+        block_authed_request_to_unauthorized_hostnames: {
+            if (!didSubstitute) {
+                break block_authed_request_to_unauthorized_hostnames;
+            }
+            if ((0, isHostnameAuthorized_1.getIsHostnameAuthorized)({
+                allowedHostnames: resourceServersAllowedHostnames,
+                extendAuthorizationToParentDomain: true,
+                hostname
+            })) {
+                break block_authed_request_to_unauthorized_hostnames;
+            }
+            throw new Error([
+                `oidc-spa: Blocked authed request to ${hostname}.`,
+                `To authorize this request add "${hostname}" to`,
+                "`resourceServersAllowedHostnames`."
+            ].join(" "));
+        }
+        return new EventSource_actual(nextUrl, eventSourceInitDict);
+    };
+    EventSourcePatched.prototype = EventSource_actual.prototype;
+    if ("CONNECTING" in EventSource_actual) {
+        for (const name of ["CONNECTING", "OPEN", "CLOSED"]) {
+            Object.defineProperty(EventSourcePatched, name, {
+                value: EventSource_actual[name],
+                writable: false,
+                enumerable: true,
+                configurable: false
+            });
+        }
+    }
+    window.EventSource = EventSourcePatched;
+}
+function patchNavigatorSendBeaconApiToSubstituteTokenPlaceholder(params) {
+    const { resourceServersAllowedHostnames } = params;
+    const sendBeacon_actual = navigator.sendBeacon?.bind(navigator);
+    if (sendBeacon_actual === undefined) {
+        return;
+    }
+    navigator.sendBeacon = function sendBeacon(url, data) {
+        const urlStr = typeof url === "string" ? url : url.href;
+        const nextUrl = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(urlStr);
+        let didSubstitute = nextUrl !== urlStr;
+        const { hostname } = new URL(nextUrl, window.location.href);
+        let nextData = data;
+        if (typeof data === "string") {
+            const next = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(data);
+            if (next !== data) {
+                didSubstitute = true;
+            }
+            nextData = next;
+        }
+        else if (data instanceof URLSearchParams) {
+            let didUrlSearchParamsSubstitute = false;
+            const next = new URLSearchParams();
+            data.forEach((value, key) => {
+                const nextValue = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(value);
+                if (nextValue !== value) {
+                    didUrlSearchParamsSubstitute = true;
+                }
+                next.append(key, nextValue);
+            });
+            if (didUrlSearchParamsSubstitute) {
+                didSubstitute = true;
+                nextData = next;
+            }
+        }
+        else if (data instanceof FormData) {
+            let didFormDataSubstitute = false;
+            const next = new FormData();
+            data.forEach((value, key) => {
+                if (typeof value === "string") {
+                    const nextValue = (0, tokenPlaceholderSubstitution_1.substitutePlaceholderByRealToken)(value);
+                    if (nextValue !== value) {
+                        didFormDataSubstitute = true;
+                    }
+                    next.append(key, nextValue);
+                    return;
+                }
+                next.append(key, value);
+            });
+            if (didFormDataSubstitute) {
+                didSubstitute = true;
+                nextData = next;
+            }
+        }
+        block_authed_request_to_unauthorized_hostnames: {
+            if (!didSubstitute) {
+                break block_authed_request_to_unauthorized_hostnames;
+            }
+            if ((0, isHostnameAuthorized_1.getIsHostnameAuthorized)({
+                allowedHostnames: resourceServersAllowedHostnames,
+                extendAuthorizationToParentDomain: true,
+                hostname
+            })) {
+                break block_authed_request_to_unauthorized_hostnames;
+            }
+            throw new Error([
+                `oidc-spa: Blocked authed request to ${hostname}.`,
+                `To authorize this request add "${hostname}" to`,
+                "`resourceServersAllowedHostnames`."
+            ].join(" "));
+        }
+        return sendBeacon_actual(nextUrl, nextData);
+    };
+}
+function runMonkeyPatchingPrevention() {
+    const createWriteError = (target) => new Error([
+        `oidc-spa: Monkey patching of ${target} has been blocked.`,
+        `Read: https://docs.oidc-spa.dev/v/v8/resources/blocked-monkey-patching`
+    ].join(" "));
+    for (const name of [
+        "fetch",
+        "XMLHttpRequest",
+        "WebSocket",
+        "Headers",
+        "URLSearchParams",
+        "EventSource",
+        "ServiceWorkerContainer",
+        "ServiceWorkerRegistration",
+        "ServiceWorker",
+        "FormData",
+        "Blob",
+        "String",
+        "Object",
+        "Promise",
+        "Array",
+        "RegExp",
+        "TextEncoder",
+        "Uint8Array",
+        "Uint32Array",
+        "Response",
+        "Reflect",
+        "JSON",
+        "encodeURIComponent",
+        "decodeURIComponent",
+        "atob",
+        "btoa"
+    ]) {
+        const original = window[name];
+        if (!original) {
+            continue;
+        }
+        if ("prototype" in original) {
+            for (const propertyName of Object.getOwnPropertyNames(original.prototype)) {
+                if (name === "Object") {
+                    if (propertyName === "toString" ||
+                        propertyName === "constructor" ||
+                        propertyName === "valueOf") {
+                        continue;
+                    }
+                }
+                if (name === "Array") {
+                    if (propertyName === "constructor" || propertyName === "concat") {
+                        continue;
+                    }
+                }
+                const pd = Object.getOwnPropertyDescriptor(original.prototype, propertyName);
+                (0, assert_1.assert)(pd !== undefined);
+                if (!pd.configurable) {
+                    continue;
+                }
+                Object.defineProperty(original.prototype, propertyName, {
+                    enumerable: pd.enumerable,
+                    configurable: false,
+                    ...("value" in pd
+                        ? {
+                            get: () => pd.value,
+                            set: () => {
+                                throw createWriteError(`window.${name}.prototype.${propertyName}`);
+                            }
+                        }
+                        : {
+                            get: pd.get,
+                            set: pd.set ??
+                                (() => {
+                                    throw createWriteError(`window.${name}.prototype.${propertyName}`);
+                                })
+                        })
+                });
+            }
+        }
+        Object.defineProperty(window, name, {
+            configurable: false,
+            enumerable: true,
+            get: () => original,
+            set: () => {
+                throw createWriteError(`window.${name}`);
+            }
+        });
+    }
+    {
+        const name = "serviceWorker";
+        const original = navigator[name];
+        Object.defineProperty(navigator, name, {
+            configurable: false,
+            enumerable: true,
+            get: () => original,
+            set: () => {
+                throw createWriteError(`window.navigator.${name}`);
+            }
+        });
+    }
+    for (const name of ["call", "apply", "bind"]) {
+        const original = Function.prototype[name];
+        Object.defineProperty(Function.prototype, name, {
+            configurable: false,
+            enumerable: true,
+            get: () => original,
+            set: () => {
+                throw createWriteError(`window.Function.prototype.${name})`);
+            }
+        });
+    }
+}
+function restrictServiceWorkerRegistration(params) {
+    const { serviceWorkersAllowedHostnames } = params;
+    const { serviceWorker } = navigator;
+    const register_actual = serviceWorker.register.bind(serviceWorker);
+    serviceWorker.register = function register(scriptURL, options) {
+        const { hostname, protocol } = new URL(typeof scriptURL === "string" ? scriptURL : scriptURL.href, window.location.href);
+        if (protocol === "blob:") {
+            throw new Error([
+                "oidc-spa: Blocked service worker registration from blob.",
+                "Only solution: Set enableTokenExfiltrationDefense to false",
+                "or load the worker script from a remote url."
+            ].join(" "));
+        }
+        if (!(0, isHostnameAuthorized_1.getIsHostnameAuthorized)({
+            allowedHostnames: serviceWorkersAllowedHostnames,
+            extendAuthorizationToParentDomain: false,
+            hostname
+        })) {
+            throw new Error([
+                `oidc-spa: Blocked service worker registration to ${hostname}.`,
+                `To authorize this registration add "${hostname}" to`,
+                "`serviceWorkersAllowedHostnames`."
+            ].join(" "));
+        }
+        return register_actual(scriptURL, options);
+    };
+}
+//# sourceMappingURL=tokenExfiltrationDefense.js.map