oidc-spa 8.6.19 → 8.7.0

package/src/core/oidcClientTsUserToTokens.ts

@@ -6,6 +6,8 @@ import { decodeJwt } from "../tools/decodeJwt";
 import type { Oidc } from "./Oidc";
 import { INFINITY_TIME } from "../tools/INFINITY_TIME";
 import { getIsTokenSubstitutionEnabled, getTokensPlaceholders } from "./tokenPlaceholderSubstitution";
+import { registerAccessTokenForDPoP } from "./dpop";
+import { createGetServerDateNow, type ParamsOfCreateGetServerDateNow } from "../tools/getServerDateNow";
 
 export function oidcClientTsUserToTokens<DecodedIdToken extends Record<string, unknown>>(params: {
     configId: string;
@@ -15,6 +17,7 @@ export function oidcClientTsUserToTokens<DecodedIdToken extends Record<string, u
     };
     __unsafe_useIdTokenAsAccessToken: boolean;
     decodedIdToken_previous: DecodedIdToken | undefined;
+    isDPoPEnabled: boolean;
     log: typeof console.log | undefined;
 }): Oidc.Tokens<DecodedIdToken> {
     const {
@@ -23,6 +26,7 @@ export function oidcClientTsUserToTokens<DecodedIdToken extends Record<string, u
         decodedIdTokenSchema,
         __unsafe_useIdTokenAsAccessToken,
         decodedIdToken_previous,
+        isDPoPEnabled,
         log
     } = params;
 
@@ -107,6 +111,11 @@ export function oidcClientTsUserToTokens<DecodedIdToken extends Record<string, u
         return id_token_iat * 1000;
     })();
 
+    const paramsOfCreateGetServerDateNow: ParamsOfCreateGetServerDateNow = {
+        issuedAtTime_local: oidcClientTsUser.__oidc_spa_localTimeWhenTokenIssued,
+        issuedAtTime
+    };
+
     const tokens_common: Oidc.Tokens.Common<DecodedIdToken> = {
         ...(__unsafe_useIdTokenAsAccessToken
             ? {
@@ -166,10 +175,7 @@ export function oidcClientTsUserToTokens<DecodedIdToken extends Record<string, u
         decodedIdToken,
         decodedIdToken_original,
         issuedAtTime,
-        getServerDateNow: (() => {
-            const issuedAtTime_local = oidcClientTsUser.__oidc_spa_localTimeWhenTokenIssued;
-            return () => Date.now() + (issuedAtTime - issuedAtTime_local);
-        })()
+        getServerDateNow: createGetServerDateNow(paramsOfCreateGetServerDateNow)
     };
 
     const tokens: Oidc.Tokens<DecodedIdToken> =
@@ -229,6 +235,14 @@ export function oidcClientTsUserToTokens<DecodedIdToken extends Record<string, u
                   })()
               });
 
+    if (isDPoPEnabled) {
+        registerAccessTokenForDPoP({
+            configId,
+            accessToken: tokens.accessToken,
+            paramsOfCreateGetServerDateNow
+        });
+    }
+
     if (getIsTokenSubstitutionEnabled()) {
         const placeholders = getTokensPlaceholders({
             configId,

package/src/core/tokenExfiltrationDefense.ts

@@ -341,11 +341,7 @@ function patchXMLHttpRequestApiToSubstituteTokenPlaceholder(params: {
             throw new Error("oidc-spa: Blocked request to hashed static asset.");
         }
 
-        if (async === undefined) {
-            return open_actual.bind(this)(method, state.url);
-        } else {
-            return open_actual.call(this, method, state.url, async, username, password);
-        }
+        return open_actual.call(this, method, state.url, async as true, username, password);
     };
 
     XMLHttpRequest.prototype.setRequestHeader = function setRequestHeader(name, value) {
@@ -911,6 +907,65 @@ function runMonkeyPatchingPrevention() {
         });
     }
 
+    crypto_subtle: {
+        const { crypto } = window;
+
+        if (!crypto?.subtle) {
+            break crypto_subtle;
+        }
+
+        const subtle = crypto.subtle;
+        const prototype = Object.getPrototypeOf(subtle);
+
+        for (const propertyName of Object.getOwnPropertyNames(prototype)) {
+            const pd = Object.getOwnPropertyDescriptor(prototype, propertyName);
+
+            assert(pd !== undefined);
+
+            if (!pd.configurable) {
+                continue;
+            }
+
+            const target = `window.crypto.subtle.${propertyName}`;
+
+            Object.defineProperty(prototype, propertyName, {
+                enumerable: pd.enumerable,
+                configurable: false,
+                ...("value" in pd
+                    ? {
+                          get: () => pd.value,
+                          set: () => {
+                              throw createWriteError(target);
+                          }
+                      }
+                    : {
+                          get: pd.get,
+                          set:
+                              pd.set ??
+                              (() => {
+                                  throw createWriteError(target);
+                              })
+                      })
+            });
+        }
+
+        {
+            const subtlePd = Object.getOwnPropertyDescriptor(crypto, "subtle");
+            if (subtlePd !== undefined && !subtlePd.configurable) {
+                break crypto_subtle;
+            }
+        }
+
+        Object.defineProperty(crypto, "subtle", {
+            configurable: false,
+            enumerable: true,
+            get: () => subtle,
+            set: () => {
+                throw createWriteError("window.crypto.subtle");
+            }
+        });
+    }
+
     {
         const name = "serviceWorker";
 

package/src/react-spa/createOidcSpaApi.ts

@@ -414,7 +414,8 @@ export function createOidcSpaApi<
                                 __metadata: paramsOfBootstrap.__metadata,
                                 __unsafe_useIdTokenAsAccessToken:
                                     paramsOfBootstrap.__unsafe_useIdTokenAsAccessToken,
-                                autoLogoutParams: paramsOfBootstrap.autoLogoutParams
+                                autoLogoutParams: paramsOfBootstrap.autoLogoutParams,
+                                dpop: paramsOfBootstrap.dpop
                             });
                         } catch (error) {
                             if (!(error instanceof OidcInitializationError)) {

package/src/react-spa/types.tsx

@@ -289,6 +289,9 @@ export namespace ParamsOfBootstrap {
          * (if you weren't able to provide it)
          */
         BASE_URL?: string;
+
+        /** Default: false */
+        dpop?: boolean;
     } & (AutoLogin extends true ? {} : {});
 
     export type Mock<AutoLogin, DecodedIdToken> = {