raindancers-cloudfront 0.0.5 → 0.0.6

package/lib/cloudfront/cloudfront-functions/auth-check.js

@@ -90,11 +90,12 @@ function generateCodeChallenge(verifier) {
     return hash.digest('base64url');
 }
 
-function generateState(originalPath) {
+function generateState(originalPath, host) {
     var randomPart = Math.random().toString(36).substring(2) + Date.now().toString(36);
     var stateObj = {
         r: randomPart,
-        p: originalPath
+        p: originalPath,
+        h: host
     };
     return btoa(JSON.stringify(stateObj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
 }
@@ -136,8 +137,8 @@ function getOriginalPath(request) {
     return request.uri + '?' + qs;
 }
 
-function redirectToAuth(originalPath) {
-    var state = generateState(originalPath);
+function redirectToAuth(originalPath, host) {
+    var state = generateState(originalPath, host);
     var codeVerifier = generateCodeVerifier();
     var codeChallenge = generateCodeChallenge(codeVerifier);
     var domainAttr = COOKIE_DOMAIN ? '; Domain=' + COOKIE_DOMAIN : '';
@@ -169,17 +170,18 @@ async function handler(event) {
     }
     
     var cookies = request.cookies;
+    var host = request.headers.host ? request.headers.host.value : '';
     
     // Check for session cookie (supports both __Secure- with domain and __Host- without)
     var sessionCookie = cookies['__Secure-auth_session'] || cookies['__Host-auth_session'];
     if (!sessionCookie) {
-        return redirectToAuth(getOriginalPath(request));
+        return redirectToAuth(getOriginalPath(request), host);
     }
     
     var token = sessionCookie.value;
     
     if (!token || token.length === 0) {
-        return redirectToAuth(getOriginalPath(request));
+        return redirectToAuth(getOriginalPath(request), host);
     }
     
     try {
@@ -187,19 +189,19 @@ async function handler(event) {
         var parts = token.split('.');
         
         if (parts.length !== 3) {
-            return redirectToAuth(originalPath);
+            return redirectToAuth(originalPath, host);
         }
         
         var isValid = await validateHmacSignature(token);
         if (!isValid) {
-            return redirectToAuth(originalPath);
+            return redirectToAuth(originalPath, host);
         }
         
         var payload = JSON.parse(base64urlDecode(parts[1]));
         var now = Math.floor(Date.now() / 1000);
         
         if (payload.exp && payload.exp < now) {
-            return redirectToAuth(originalPath);
+            return redirectToAuth(originalPath, host);
         }
         
         // Check if session is revoked (denylist approach)
@@ -209,7 +211,7 @@ async function handler(event) {
                 var isRevoked = await kvsHandle.get('revoked:' + jti);
                 if (isRevoked) {
                     console.log('Session revoked: ' + jti);
-                    return redirectToAuth(originalPath);
+                    return redirectToAuth(originalPath, host);
                 }
             } catch (e) {
                 console.log('KVS error checking revocation: ' + e);
@@ -218,6 +220,6 @@ async function handler(event) {
         
         return request;
     } catch (e) {
-        return redirectToAuth(getOriginalPath(request));
+        return redirectToAuth(getOriginalPath(request), host);
     }
 }

package/lib/cloudfront/cloudfront-functions/modules/auth-check.js

@@ -82,11 +82,12 @@ function generateCodeChallenge(verifier) {
   return hash.digest('base64url');
 }
 
-function generateState(originalPath) {
+function generateState(originalPath, host) {
   var randomPart = Math.random().toString(36).substring(2) + Date.now().toString(36);
   var stateObj = {
     r: randomPart,
-    p: originalPath
+    p: originalPath,
+    h: host
   };
   return btoa(JSON.stringify(stateObj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
 }
@@ -128,8 +129,8 @@ function getOriginalPath(request) {
   return request.uri + '?' + qs;
 }
 
-function redirectToAuth(originalPath) {
-  var state = generateState(originalPath);
+function redirectToAuth(originalPath, host) {
+  var state = generateState(originalPath, host);
   var codeVerifier = generateCodeVerifier();
   var codeChallenge = generateCodeChallenge(codeVerifier);
   var domainAttr = COOKIE_DOMAIN ? '; Domain=' + COOKIE_DOMAIN : '';
@@ -162,18 +163,19 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
   }
   var cookies = request.cookies;
   var originalPath = getOriginalPath(request);
+  var host = request.headers.host ? request.headers.host.value : '';
   var sessionCookie = cookies['__Secure-auth_session'] || cookies['__Host-auth_session'];
   if (!sessionCookie) {
     return {
       pass: false,
-      response: redirectToAuth(originalPath)
+      response: redirectToAuth(originalPath, host)
     };
   }
   var token = sessionCookie.value;
   if (!token || token.length === 0) {
     return {
       pass: false,
-      response: redirectToAuth(originalPath)
+      response: redirectToAuth(originalPath, host)
     };
   }
   try {
@@ -181,14 +183,14 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
     if (parts.length !== 3) {
       return {
         pass: false,
-        response: redirectToAuth(originalPath)
+        response: redirectToAuth(originalPath, host)
       };
     }
     var isValid = await validateHmacSignature(token);
     if (!isValid) {
       return {
         pass: false,
-        response: redirectToAuth(originalPath)
+        response: redirectToAuth(originalPath, host)
       };
     }
     var payload = JSON.parse(base64urlDecode(parts[1]));
@@ -196,7 +198,7 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
     if (payload.exp && payload.exp < now) {
       return {
         pass: false,
-        response: redirectToAuth(originalPath)
+        response: redirectToAuth(originalPath, host)
       };
     }
     var jti = payload.jti;
@@ -206,7 +208,7 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
         if (isRevoked) {
           return {
             pass: false,
-            response: redirectToAuth(originalPath)
+            response: redirectToAuth(originalPath, host)
           };
         }
       } catch (e) {}
@@ -250,7 +252,7 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
   } catch (e) {
     return {
       pass: false,
-      response: redirectToAuth(originalPath)
+      response: redirectToAuth(originalPath, host)
     };
   }
 }

package/lib/cloudfront/lambda/edge-auth/oauth-callback.py

@@ -328,15 +328,20 @@ def lambda_handler(event, context):
     
     logger.info(f'CSRF validation passed, proceeding with token exchange')
     
-    # Decode state to get original path
+    # Decode state to get original path and host
     redirect_path = '/'
     try:
         # Decode base64url state
         state_padded = state + '=' * (4 - len(state) % 4)
         state_decoded = base64.urlsafe_b64decode(state_padded.replace('-', '+').replace('_', '/')).decode('utf-8')
         state_obj = json.loads(state_decoded)
-        redirect_path = state_obj.get('p', '/')
-        logger.info(f'Decoded original path from state: {redirect_path}')
+        original_path = state_obj.get('p', '/')
+        original_host = state_obj.get('h', '')
+        if original_host:
+            redirect_path = f'https://{original_host}{original_path}'
+        else:
+            redirect_path = original_path
+        logger.info(f'Decoded redirect target from state: {redirect_path}')
     except Exception as e:
         logger.warning(f'Could not decode state, using default redirect: {str(e)}')
         redirect_path = '/'

package/package.json

@@ -54,7 +54,7 @@
   },
   "main": "lib/index.js",
   "license": "Apache-2.0",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [