strapi-plugin-oidc 1.0.9 → 1.0.12

package/dist/server/index.js

@@ -168,11 +168,22 @@ async function oidcSignIn(ctx) {
   let { state } = ctx.query;
   const { OIDC_CLIENT_ID, OIDC_REDIRECT_URI, OIDC_SCOPES, OIDC_AUTHORIZATION_ENDPOINT } = configValidation();
   const { code_verifier: codeVerifier, code_challenge: codeChallenge } = await pkceChallenge__default.default();
-  ctx.session.codeVerifier = codeVerifier;
   if (!state) {
     state = node_crypto.randomBytes(32).toString("base64url");
   }
-  ctx.session.oidcState = state;
+  const isProduction = process.env.NODE_ENV === "production";
+  ctx.cookies.set("oidc_code_verifier", codeVerifier, {
+    httpOnly: true,
+    maxAge: 6e5,
+    secure: isProduction && ctx.request.secure,
+    sameSite: "lax"
+  });
+  ctx.cookies.set("oidc_state", state, {
+    httpOnly: true,
+    maxAge: 6e5,
+    secure: isProduction && ctx.request.secure,
+    sameSite: "lax"
+  });
   const params = new URLSearchParams();
   params.append("response_type", "code");
   params.append("client_id", OIDC_CLIENT_ID);
@@ -271,7 +282,9 @@ async function oidcSignInCallback(ctx) {
   if (!ctx.query.code) {
     return ctx.send(oauthService2.renderSignUpError("code Not Found"));
   }
-  if (!ctx.query.state || ctx.query.state !== ctx.session.oidcState) {
+  const oidcState = ctx.cookies.get("oidc_state");
+  const codeVerifier = ctx.cookies.get("oidc_code_verifier");
+  if (!ctx.query.state || ctx.query.state !== oidcState) {
     return ctx.send(oauthService2.renderSignUpError("Invalid state"));
   }
   const params = new URLSearchParams();
@@ -280,7 +293,7 @@ async function oidcSignInCallback(ctx) {
   params.append("client_secret", config2.OIDC_CLIENT_SECRET);
   params.append("redirect_uri", config2.OIDC_REDIRECT_URI);
   params.append("grant_type", config2.OIDC_GRANT_TYPE);
-  params.append("code_verifier", ctx.session.codeVerifier);
+  params.append("code_verifier", codeVerifier);
   try {
     const userResponseData = await exchangeTokenAndFetchUserInfo(config2, params);
     const { activateUser, jwtToken } = await handleUserAuthentication(
@@ -505,7 +518,7 @@ const routes = [
     handler: "oidc.oidcSignIn",
     config: {
       auth: false,
-      middlewares: [rateLimitMiddleware]
+      middlewares: [rateLimitMiddleware, "strapi::session"]
     }
   },
   {
@@ -514,7 +527,7 @@ const routes = [
     handler: "oidc.oidcSignInCallback",
     config: {
       auth: false,
-      middlewares: [rateLimitMiddleware]
+      middlewares: [rateLimitMiddleware, "strapi::session"]
     }
   },
   {

package/dist/server/index.mjs

@@ -162,11 +162,22 @@ async function oidcSignIn(ctx) {
   let { state } = ctx.query;
   const { OIDC_CLIENT_ID, OIDC_REDIRECT_URI, OIDC_SCOPES, OIDC_AUTHORIZATION_ENDPOINT } = configValidation();
   const { code_verifier: codeVerifier, code_challenge: codeChallenge } = await pkceChallenge();
-  ctx.session.codeVerifier = codeVerifier;
   if (!state) {
     state = randomBytes(32).toString("base64url");
   }
-  ctx.session.oidcState = state;
+  const isProduction = process.env.NODE_ENV === "production";
+  ctx.cookies.set("oidc_code_verifier", codeVerifier, {
+    httpOnly: true,
+    maxAge: 6e5,
+    secure: isProduction && ctx.request.secure,
+    sameSite: "lax"
+  });
+  ctx.cookies.set("oidc_state", state, {
+    httpOnly: true,
+    maxAge: 6e5,
+    secure: isProduction && ctx.request.secure,
+    sameSite: "lax"
+  });
   const params = new URLSearchParams();
   params.append("response_type", "code");
   params.append("client_id", OIDC_CLIENT_ID);
@@ -265,7 +276,9 @@ async function oidcSignInCallback(ctx) {
   if (!ctx.query.code) {
     return ctx.send(oauthService2.renderSignUpError("code Not Found"));
   }
-  if (!ctx.query.state || ctx.query.state !== ctx.session.oidcState) {
+  const oidcState = ctx.cookies.get("oidc_state");
+  const codeVerifier = ctx.cookies.get("oidc_code_verifier");
+  if (!ctx.query.state || ctx.query.state !== oidcState) {
     return ctx.send(oauthService2.renderSignUpError("Invalid state"));
   }
   const params = new URLSearchParams();
@@ -274,7 +287,7 @@ async function oidcSignInCallback(ctx) {
   params.append("client_secret", config2.OIDC_CLIENT_SECRET);
   params.append("redirect_uri", config2.OIDC_REDIRECT_URI);
   params.append("grant_type", config2.OIDC_GRANT_TYPE);
-  params.append("code_verifier", ctx.session.codeVerifier);
+  params.append("code_verifier", codeVerifier);
   try {
     const userResponseData = await exchangeTokenAndFetchUserInfo(config2, params);
     const { activateUser, jwtToken } = await handleUserAuthentication(
@@ -499,7 +512,7 @@ const routes = [
     handler: "oidc.oidcSignIn",
     config: {
       auth: false,
-      middlewares: [rateLimitMiddleware]
+      middlewares: [rateLimitMiddleware, "strapi::session"]
     }
   },
   {
@@ -508,7 +521,7 @@ const routes = [
     handler: "oidc.oidcSignInCallback",
     config: {
       auth: false,
-      middlewares: [rateLimitMiddleware]
+      middlewares: [rateLimitMiddleware, "strapi::session"]
     }
   },
   {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strapi-plugin-oidc",
-  "version": "1.0.9",
+  "version": "1.0.12",
   "description": "A Strapi plugin that provides OpenID Connect (OIDC) authentication functionality for the Strapi Admin Panel.",
   "strapi": {
     "displayName": "OIDC Plugin",
@@ -63,8 +63,8 @@
     }
   ],
   "engines": {
-    "node": ">=20.0.0 <=24.x.x",
-    "npm": ">=6.0.0"
+    "node": ">=22.0.0 <=22.x.x",
+    "npm": "10.x.x"
   },
   "files": [
     "dist"