unjwt 0.5.24 → 0.5.26

package/README.md

@@ -15,7 +15,8 @@ A collection of low-level JWT ([RFC 7519](https://datatracker.ietf.org/doc/html/
 - **JWK (JSON Web Key, [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517))**: generate, import, export, wrap, and unwrap keys in JWK format or as `CryptoKey` objects.
 
 - **Adapters** for popular frameworks (PRs welcome for more!):
-  - [H3 (Nuxt, Nitro)](./src/adapters/h3.ts): `useJWSSession()`, `useJWESession()`
+  - [H3 v1 (Nuxt v4, Nitro v2)](./src/adapters/h3v1/): `useJWSSession()`, `useJWESession()`
+  - [H3 v2 (Nuxt v5, Nitro v3)](./src/adapters/h3v2/): `useJWSSession()`, `useJWESession()`
 
 ## Table of Contents
 
@@ -25,7 +26,8 @@ A collection of low-level JWT ([RFC 7519](https://datatracker.ietf.org/doc/html/
   - [JWK](#jwk-json-web-key-rfc-7517)
   - [Utility Functions](#utility-functions)
   - [Adapters](#adapters)
-    - [H3 (Nuxt, Nitro)](#h3-nuxt-nitro)
+    - [H3 v1 (Nuxt up to v4, Nitro up to v2)](#h3-v1-nuxt-v4-nitro-v2)
+    - [H3 v2 (Nuxt v5, Nitro v3)](#h3-v2-nuxt-v5-nitro-v3)
 - [Development](#development)
 - [Credits](#credits)
 - [License](#license)
@@ -616,7 +618,7 @@ Both helpers expose the same API: read `session.id` / `session.data`, call `sess
 import { defineEventHandler } from "h3";
 import { useJWESession, useJWSSession, generateJWK } from "unjwt/adapters/h3v1";
 
-const keys = await generateJWK("RS256");
+const keys = await generateJWK("RS256"); // Make sure to persist these keys somewhere!
 
 export default defineEventHandler(async (event) => {
   const privateSession = await useJWESession(event, {
@@ -663,7 +665,7 @@ import {
   generateJWK,
 } from "unjwt/adapters/h3v2";
 
-const atJwk = await generateJWK("RS256");
+const atJwk = await generateJWK("RS256"); // Make sure to persist these keys somewhere!
 
 const jweOptions = {
   key: "refresh_token_secret",
@@ -675,7 +677,7 @@ const jwsOptions = {
   name: "access_token",
   maxAge: 15 * 60, // 15 minutes
   hooks: {
-    async onExpire(event, _error, config) {
+    async onExpire({ event, config }) {
       const refreshSession = await getJWESession(event, jweOptions);
       if (!refreshSession.data.sub) {
         // no valid refresh session, nothing to do

package/dist/adapters/h3.d.mts

@@ -24,11 +24,30 @@ interface SessionJWE<T extends SessionDataT$1 = SessionDataT$1> {
     [kGetSessionPromise$1]?: Promise<SessionJWE<T>>;
 }
 interface SessionHooksJWE {
-    onRead?: (session: SessionJWE, event: H3Event, config: SessionConfigJWE) => void | Promise<void>;
-    onUpdate?: (session: SessionJWE, event: H3Event, config: SessionConfigJWE) => void | Promise<void>;
-    onClear?: (event: H3Event, config: Partial<SessionConfigJWE>) => void | Promise<void>;
-    onExpire?: (event: H3Event, error: any | undefined, config: SessionConfigJWE) => void | Promise<void>;
-    onError?: (event: H3Event, error: any, config: SessionConfigJWE) => void | Promise<void>;
+    onRead?: (args: {
+        session: SessionJWE;
+        event: H3Event;
+        config: SessionConfigJWE;
+    }) => void | Promise<void>;
+    onUpdate?: (args: {
+        session: SessionJWE;
+        event: H3Event;
+        config: SessionConfigJWE;
+    }) => void | Promise<void>;
+    onClear?: (args: {
+        event: H3Event;
+        config: Partial<SessionConfigJWE>;
+    }) => void | Promise<void>;
+    onExpire?: (args: {
+        event: H3Event;
+        error: Error;
+        config: SessionConfigJWE;
+    }) => void | Promise<void>;
+    onError?: (args: {
+        event: H3Event;
+        error: any;
+        config: SessionConfigJWE;
+    }) => void | Promise<void>;
 }
 interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
     readonly id: string | undefined;
@@ -128,11 +147,30 @@ interface SessionJWS<T extends SessionDataT = SessionDataT> {
     [kGetSessionPromise]?: Promise<SessionJWS<T>>;
 }
 interface SessionHooksJWS {
-    onRead?: (session: SessionJWS, event: H3Event, config: SessionConfigJWS) => void | Promise<void>;
-    onUpdate?: (session: SessionJWS, event: H3Event, config: SessionConfigJWS) => void | Promise<void>;
-    onClear?: (event: H3Event, config: Partial<SessionConfigJWS>) => void | Promise<void>;
-    onExpire?: (event: H3Event, error: any | undefined, config: SessionConfigJWS) => void | Promise<void>;
-    onError?: (event: H3Event, error: any, config: SessionConfigJWS) => void | Promise<void>;
+    onRead?: (args: {
+        session: SessionJWS;
+        event: H3Event;
+        config: SessionConfigJWS;
+    }) => void | Promise<void>;
+    onUpdate?: (args: {
+        session: SessionJWS;
+        event: H3Event;
+        config: SessionConfigJWS;
+    }) => void | Promise<void>;
+    onClear?: (args: {
+        event: H3Event;
+        config: Partial<SessionConfigJWS>;
+    }) => void | Promise<void>;
+    onExpire?: (args: {
+        event: H3Event;
+        error: Error;
+        config: SessionConfigJWS;
+    }) => void | Promise<void>;
+    onError?: (args: {
+        event: H3Event;
+        error: any;
+        config: SessionConfigJWS;
+    }) => void | Promise<void>;
 }
 interface SessionConfigJWS {
     /**

package/dist/adapters/h3.mjs

@@ -59,12 +59,22 @@ async function getJWESession(event, config) {
   if (existingSession) {
     const session2 = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
     if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && isEvent(event)) {
-      await config.hooks?.onExpire?.(event, void 0, config);
+      await config.hooks?.onExpire?.({
+        event,
+        error: new Error(
+          `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(session2.expiresAt * 1e3).toISOString()})`
+        ),
+        config
+      });
       return clearJWESession(event, config).then(
         () => getJWESession(event, config)
       );
     }
-    await config.hooks?.onRead?.(session2, event, config);
+    await config.hooks?.onRead?.({
+      event,
+      session: session2,
+      config
+    });
     return session2;
   }
   const session = {
@@ -74,27 +84,35 @@ async function getJWESession(event, config) {
     data: /* @__PURE__ */ Object.create(null)
   };
   event.context.sessions[sessionName] = session;
-  let jweToken;
+  let token;
   if (config.sessionHeader !== false) {
     const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
     const headerValue = _getReqHeader$1(event, headerName);
     if (typeof headerValue === "string") {
-      jweToken = headerValue;
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
     }
   }
-  if (!jweToken) {
+  if (!token) {
     const cookieHeader = _getReqHeader$1(event, "cookie");
     if (cookieHeader) {
-      jweToken = parse(String(cookieHeader))[sessionName];
+      token = parse(String(cookieHeader))[sessionName];
     }
   }
-  if (jweToken) {
-    const promise = unsealJWESession(event, config, jweToken).catch(async (error_) => {
+  if (token) {
+    const promise = unsealJWESession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
-        await config.hooks?.onExpire?.(event, error_, config);
+        await config.hooks?.onExpire?.({
+          event,
+          error: error_,
+          config
+        });
         return void 0;
       }
-      await config.hooks?.onError?.(event, error_, config);
+      await config.hooks?.onError?.({
+        event,
+        error: error_,
+        config
+      });
       return void 0;
     }).then((unsealed) => {
       if (unsealed) {
@@ -117,7 +135,11 @@ async function getJWESession(event, config) {
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
     await updateJWESession(event, config);
   }
-  await config.hooks?.onRead?.(session, event, config);
+  await config.hooks?.onRead?.({
+    event,
+    session,
+    config
+  });
   return session;
 }
 function _getReqHeader$1(event, name) {
@@ -139,7 +161,11 @@ async function updateJWESession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.(session, event, config);
+    await config.hooks?.onUpdate?.({
+      event,
+      session,
+      config
+    });
   }
   if (config.cookie !== false) {
     const sealed = await sealJWESession(event, config);
@@ -195,11 +221,11 @@ async function unsealJWESession(_event, config, sealed) {
   const { payload } = await decrypt(sealed, key, {
     ...config.jwe?.decryptOptions,
     requiredClaims: [
-      ...config.jwe?.decryptOptions?.requiredClaims?.filter(
-        (claim) => claim !== "jti" && claim !== "iat"
-      ) || [],
-      "jti",
-      "iat"
+      .../* @__PURE__ */ new Set([
+        ...config.jwe?.decryptOptions?.requiredClaims || [],
+        "jti",
+        "iat"
+      ])
     ],
     maxTokenAge: config.maxAge,
     algorithms: alg ? [alg] : void 0,
@@ -235,7 +261,10 @@ async function clearJWESession(event, config) {
     expires: /* @__PURE__ */ new Date(0),
     maxAge: void 0
   });
-  await config.hooks?.onClear?.(event, config);
+  await config.hooks?.onClear?.({
+    event,
+    config
+  });
 }
 function getEncryptKey(key) {
   if (!key) {
@@ -334,12 +363,22 @@ async function getJWSSession(event, config) {
   if (existingSession) {
     const session2 = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
     if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && isEvent(event)) {
-      await config.hooks?.onExpire?.(event, void 0, config);
+      await config.hooks?.onExpire?.({
+        event,
+        error: new Error(
+          `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(session2.expiresAt * 1e3).toISOString()})`
+        ),
+        config
+      });
       return clearJWSSession(event, config).then(
         () => getJWSSession(event, config)
       );
     }
-    await config.hooks?.onRead?.(session2, event, config);
+    await config.hooks?.onRead?.({
+      event,
+      session: session2,
+      config
+    });
     return session2;
   }
   const session = {
@@ -354,7 +393,7 @@ async function getJWSSession(event, config) {
     const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
     const headerValue = _getReqHeader(event, headerName);
     if (typeof headerValue === "string") {
-      token = headerValue;
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
     }
   }
   if (!token) {
@@ -366,10 +405,18 @@ async function getJWSSession(event, config) {
   if (token) {
     const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
-        await config.hooks?.onExpire?.(event, error_, config);
+        await config.hooks?.onExpire?.({
+          event,
+          error: error_,
+          config
+        });
         return void 0;
       }
-      await config.hooks?.onError?.(event, error_, config);
+      await config.hooks?.onError?.({
+        event,
+        error: error_,
+        config
+      });
       return void 0;
     }).then((unsealed) => {
       if (unsealed) {
@@ -392,7 +439,11 @@ async function getJWSSession(event, config) {
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
     await updateJWSSession(event, config);
   }
-  await config.hooks?.onRead?.(session, event, config);
+  await config.hooks?.onRead?.({
+    event,
+    session,
+    config
+  });
   return session;
 }
 function _getReqHeader(event, name) {
@@ -414,7 +465,11 @@ async function updateJWSSession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.(session, event, config);
+    await config.hooks?.onUpdate?.({
+      event,
+      session,
+      config
+    });
   }
   if (config.cookie !== false) {
     const token = await signJWSSession(event, config);
@@ -467,11 +522,11 @@ async function verifyJWSSession(_event, config, token) {
   const { payload } = await verify(token, jwk, {
     ...config.jws?.verifyOptions,
     requiredClaims: [
-      ...config.jws?.verifyOptions?.requiredClaims?.filter(
-        (claim) => claim !== "jti" && claim !== "iat"
-      ) || [],
-      "jti",
-      "iat"
+      .../* @__PURE__ */ new Set([
+        ...config.jws?.verifyOptions?.requiredClaims || [],
+        "jti",
+        "iat"
+      ])
     ],
     typ: typ || "JWT",
     algorithms: alg ? [alg] : void 0,
@@ -501,7 +556,10 @@ async function clearJWSSession(event, config) {
     expires: /* @__PURE__ */ new Date(0),
     maxAge: void 0
   });
-  await config.hooks?.onClear?.(event, config);
+  await config.hooks?.onClear?.({
+    event,
+    config
+  });
 }
 function getSignKey(key) {
   if (!key) {

package/dist/adapters/h3v2.d.mts

@@ -18,11 +18,30 @@ interface SessionJWE<T extends SessionDataT$1 = SessionDataT$1> {
     [kGetSessionPromise$1]?: Promise<SessionJWE<T>>;
 }
 interface SessionHooksJWE {
-    onRead?: (session: SessionJWE, event: HTTPEvent, config: SessionConfigJWE) => void | Promise<void>;
-    onUpdate?: (session: SessionJWE, event: HTTPEvent, config: SessionConfigJWE) => void | Promise<void>;
-    onClear?: (event: HTTPEvent, config: Partial<SessionConfigJWE>) => void | Promise<void>;
-    onExpire?: (event: HTTPEvent, error: any | undefined, config: SessionConfigJWE) => void | Promise<void>;
-    onError?: (event: HTTPEvent, error: any, config: SessionConfigJWE) => void | Promise<void>;
+    onRead?: (args: {
+        session: SessionJWE;
+        event: HTTPEvent;
+        config: SessionConfigJWE;
+    }) => void | Promise<void>;
+    onUpdate?: (args: {
+        session: SessionJWE;
+        event: HTTPEvent;
+        config: SessionConfigJWE;
+    }) => void | Promise<void>;
+    onClear?: (args: {
+        event: HTTPEvent;
+        config: Partial<SessionConfigJWE>;
+    }) => void | Promise<void>;
+    onExpire?: (args: {
+        event: HTTPEvent;
+        error: Error;
+        config: SessionConfigJWE;
+    }) => void | Promise<void>;
+    onError?: (args: {
+        event: HTTPEvent;
+        error: any;
+        config: SessionConfigJWE;
+    }) => void | Promise<void>;
 }
 interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
     readonly id: string | undefined;
@@ -93,11 +112,30 @@ interface SessionJWS<T extends SessionDataT = SessionDataT> {
     [kGetSessionPromise]?: Promise<SessionJWS<T>>;
 }
 interface SessionHooksJWS {
-    onRead?: (session: SessionJWS, event: HTTPEvent, config: SessionConfigJWS) => void | Promise<void>;
-    onUpdate?: (session: SessionJWS, event: HTTPEvent, config: SessionConfigJWS) => void | Promise<void>;
-    onClear?: (event: HTTPEvent, config: Partial<SessionConfigJWS>) => void | Promise<void>;
-    onExpire?: (event: HTTPEvent, error: any | undefined, config: SessionConfigJWS) => void | Promise<void>;
-    onError?: (event: HTTPEvent, error: any, config: SessionConfigJWS) => void | Promise<void>;
+    onRead?: (args: {
+        session: SessionJWS;
+        event: HTTPEvent;
+        config: SessionConfigJWS;
+    }) => void | Promise<void>;
+    onUpdate?: (args: {
+        session: SessionJWS;
+        event: HTTPEvent;
+        config: SessionConfigJWS;
+    }) => void | Promise<void>;
+    onClear?: (args: {
+        event: HTTPEvent;
+        config: Partial<SessionConfigJWS>;
+    }) => void | Promise<void>;
+    onExpire?: (args: {
+        event: HTTPEvent;
+        error: Error;
+        config: SessionConfigJWS;
+    }) => void | Promise<void>;
+    onError?: (args: {
+        event: HTTPEvent;
+        error: any;
+        config: SessionConfigJWS;
+    }) => void | Promise<void>;
 }
 interface SessionConfigJWS {
     key: JWK_Symmetric | {

package/dist/adapters/h3v2.mjs

@@ -1,106 +1,10 @@
 export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.epPK1KFr.mjs';
-import { getEventContext } from 'h3';
-import { serialize, parseSetCookie, parse } from 'cookie-es';
+import { getEventContext, getChunkedCookie, setChunkedCookie } from 'h3';
 import { NullProtoObj } from 'rou3';
 import { e as encrypt, d as decrypt } from '../shared/unjwt.CiBEuvtQ.mjs';
 import { p as isSymmetricJWK, q as isPrivateJWK, u as isPublicJWK } from '../shared/unjwt.C86hA0o-.mjs';
 import { s as sign, v as verify } from '../shared/unjwt.D-FATaw1.mjs';
 
-const CHUNKED_COOKIE = "__chunked__";
-const CHUNKS_MAX_LENGTH = 4e3;
-function parseCookies(event) {
-  return parse(event.req.headers.get("cookie") || "");
-}
-function getCookie(event, name) {
-  return parseCookies(event)[name];
-}
-function setCookie(event, name, value, options) {
-  const newCookie = serialize(name, value, { path: "/", ...options });
-  const currentCookies = event.res.headers.getSetCookie();
-  if (currentCookies.length === 0) {
-    event.res.headers.set("set-cookie", newCookie);
-    return;
-  }
-  const newCookieKey = _getDistinctCookieKey(
-    name,
-    options || {}
-  );
-  event.res.headers.delete("set-cookie");
-  for (const cookie of currentCookies) {
-    const _key = _getDistinctCookieKey(
-      cookie.split("=")[0],
-      parseSetCookie(cookie)
-    );
-    if (_key === newCookieKey) {
-      continue;
-    }
-    event.res.headers.append("set-cookie", cookie);
-  }
-  event.res.headers.append("set-cookie", newCookie);
-}
-function deleteCookie(event, name, serializeOptions) {
-  setCookie(event, name, "", {
-    ...serializeOptions,
-    maxAge: 0
-  });
-}
-function getChunkedCookie(event, name) {
-  const mainCookie = getCookie(event, name);
-  if (!mainCookie || !mainCookie.startsWith(CHUNKED_COOKIE)) {
-    return mainCookie;
-  }
-  const chunksCount = getChunkedCookieCount(mainCookie);
-  if (chunksCount === 0) {
-    return void 0;
-  }
-  const chunks = [];
-  for (let i = 1; i <= chunksCount; i++) {
-    const chunk = getCookie(event, chunkCookieName(name, i));
-    if (!chunk) {
-      return void 0;
-    }
-    chunks.push(chunk);
-  }
-  return chunks.join("");
-}
-function setChunkedCookie(event, name, value, options) {
-  const chunkMaxLength = options?.chunkMaxLength || CHUNKS_MAX_LENGTH;
-  const chunkCount = Math.ceil(value.length / chunkMaxLength);
-  const previousCookie = getCookie(event, name);
-  if (previousCookie?.startsWith(CHUNKED_COOKIE)) {
-    const previousChunkCount = getChunkedCookieCount(previousCookie);
-    if (previousChunkCount > chunkCount) {
-      for (let i = chunkCount; i <= previousChunkCount; i++) {
-        deleteCookie(event, chunkCookieName(name, i), options);
-      }
-    }
-  }
-  if (chunkCount <= 1) {
-    setCookie(event, name, value, options);
-    return;
-  }
-  const mainCookieValue = `${CHUNKED_COOKIE}${chunkCount}`;
-  setCookie(event, name, mainCookieValue, options);
-  for (let i = 1; i <= chunkCount; i++) {
-    const start = (i - 1) * chunkMaxLength;
-    const end = start + chunkMaxLength;
-    const chunkValue = value.slice(start, end);
-    setCookie(event, chunkCookieName(name, i), chunkValue, options);
-  }
-}
-function _getDistinctCookieKey(name, options) {
-  return [name, options.domain || "", options.path || "/"].join(";");
-}
-function getChunkedCookieCount(cookie) {
-  if (!cookie?.startsWith(CHUNKED_COOKIE)) {
-    return Number.NaN;
-  }
-  return Number.parseInt(cookie.slice(CHUNKED_COOKIE.length));
-}
-function chunkCookieName(name, chunkNumber) {
-  return `${name}.${chunkNumber}`;
-}
-
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
 const DEFAULT_NAME$1 = "h3-jwe";
 const DEFAULT_COOKIE$1 = {
@@ -145,12 +49,22 @@ async function getJWESession(event, config) {
   if (existingSession) {
     const session2 = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
     if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && hasWritableResponse$1(event)) {
-      await config.hooks?.onExpire?.(event, void 0, config);
+      await config.hooks?.onExpire?.({
+        event,
+        error: new Error(
+          `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(session2.expiresAt * 1e3).toISOString()})`
+        ),
+        config
+      });
       return clearJWESession(event, config).then(
         () => getJWESession(event, config)
       );
     }
-    await config.hooks?.onRead?.(session2, event, config);
+    await config.hooks?.onRead?.({
+      event,
+      session: session2,
+      config
+    });
     return session2;
   }
   const session = {
@@ -160,27 +74,35 @@ async function getJWESession(event, config) {
     data: new NullProtoObj()
   };
   context.sessions[sessionName] = session;
-  let jweToken;
+  let token;
   if (config.sessionHeader !== false) {
     const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
     const headerValue = event.req.headers.get(headerName);
     if (typeof headerValue === "string") {
-      jweToken = headerValue;
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
     }
   }
-  if (!jweToken) {
-    jweToken = getChunkedCookie(event, sessionName);
+  if (!token) {
+    token = getChunkedCookie(event, sessionName);
   }
-  if (jweToken) {
-    const promise = unsealJWESession(event, config, jweToken).catch(async (error_) => {
+  if (token) {
+    const promise = unsealJWESession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error) {
         const message = error_.message;
         if (message.includes("Token has expired") || message.includes("Token is too old")) {
-          await config.hooks?.onExpire?.(event, error_, config);
+          await config.hooks?.onExpire?.({
+            event,
+            error: error_,
+            config
+          });
           return void 0;
         }
       }
-      await config.hooks?.onError?.(event, error_, config);
+      await config.hooks?.onError?.({
+        event,
+        error: error_,
+        config
+      });
       return void 0;
     }).then((unsealed) => {
       if (unsealed) {
@@ -198,7 +120,11 @@ async function getJWESession(event, config) {
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
     await updateJWESession(event, config);
   }
-  await config.hooks?.onRead?.(session, event, config);
+  await config.hooks?.onRead?.({
+    event,
+    session,
+    config
+  });
   return session;
 }
 async function updateJWESession(event, config, update) {
@@ -210,7 +136,11 @@ async function updateJWESession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.(session, event, config);
+    await config.hooks?.onUpdate?.({
+      event,
+      session,
+      config
+    });
   }
   if (config.cookie !== false && hasWritableResponse$1(event)) {
     const sealed = await sealJWESession(event, config);
@@ -263,11 +193,11 @@ async function unsealJWESession(_event, config, sealed) {
   const { payload } = await decrypt(sealed, key, {
     ...config.jwe?.decryptOptions,
     requiredClaims: [
-      ...config.jwe?.decryptOptions?.requiredClaims?.filter(
-        (claim) => claim !== "jti" && claim !== "iat"
-      ) || [],
-      "jti",
-      "iat"
+      .../* @__PURE__ */ new Set([
+        ...config.jwe?.decryptOptions?.requiredClaims || [],
+        "jti",
+        "iat"
+      ])
     ],
     maxTokenAge: config.maxAge,
     algorithms: alg ? [alg] : void 0,
@@ -303,7 +233,10 @@ async function clearJWESession(event, config) {
       expires: /* @__PURE__ */ new Date(0),
       maxAge: void 0
     });
-    await config.hooks?.onClear?.(event, config);
+    await config.hooks?.onClear?.({
+      event,
+      config
+    });
   }
 }
 function getSessionFromContext$1(event, sessionName) {
@@ -400,12 +333,22 @@ async function getJWSSession(event, config) {
   if (existingSession) {
     const session2 = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
     if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && hasWritableResponse(event)) {
-      await config.hooks?.onExpire?.(event, void 0, config);
+      await config.hooks?.onExpire?.({
+        event,
+        error: new Error(
+          `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(session2.expiresAt * 1e3).toISOString()})`
+        ),
+        config
+      });
       return clearJWSSession(event, config).then(
         () => getJWSSession(event, config)
       );
     }
-    await config.hooks?.onRead?.(session2, event, config);
+    await config.hooks?.onRead?.({
+      event,
+      session: session2,
+      config
+    });
     return session2;
   }
   const session = {
@@ -420,7 +363,7 @@ async function getJWSSession(event, config) {
     const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
     const headerValue = event.req.headers.get(headerName);
     if (typeof headerValue === "string") {
-      token = headerValue;
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
     }
   }
   if (!token) {
@@ -429,10 +372,18 @@ async function getJWSSession(event, config) {
   if (token) {
     const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
-        await config.hooks?.onExpire?.(event, error_, config);
+        await config.hooks?.onExpire?.({
+          event,
+          error: error_,
+          config
+        });
         return void 0;
       }
-      await config.hooks?.onError?.(event, error_, config);
+      await config.hooks?.onError?.({
+        event,
+        error: error_,
+        config
+      });
       return void 0;
     }).then((unsealed) => {
       if (unsealed) {
@@ -450,7 +401,11 @@ async function getJWSSession(event, config) {
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
     await updateJWSSession(event, config);
   }
-  await config.hooks?.onRead?.(session, event, config);
+  await config.hooks?.onRead?.({
+    event,
+    session,
+    config
+  });
   return session;
 }
 async function updateJWSSession(event, config, update) {
@@ -462,7 +417,11 @@ async function updateJWSSession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.(session, event, config);
+    await config.hooks?.onUpdate?.({
+      event,
+      session,
+      config
+    });
   }
   if (config.cookie !== false && hasWritableResponse(event)) {
     const token = await signJWSSession(event, config);
@@ -516,11 +475,11 @@ async function verifyJWSSession(_event, config, token) {
   const { payload } = await verify(token, jwk, {
     ...config.jws?.verifyOptions,
     requiredClaims: [
-      ...config.jws?.verifyOptions?.requiredClaims?.filter(
-        (claim) => claim !== "jti" && claim !== "iat"
-      ) || [],
-      "jti",
-      "iat"
+      .../* @__PURE__ */ new Set([
+        ...config.jws?.verifyOptions?.requiredClaims || [],
+        "jti",
+        "iat"
+      ])
     ],
     typ: typ || "JWT",
     algorithms: alg ? [alg] : void 0,
@@ -551,7 +510,10 @@ async function clearJWSSession(event, config) {
       expires: /* @__PURE__ */ new Date(0),
       maxAge: void 0
     });
-    await config.hooks?.onClear?.(event, config);
+    await config.hooks?.onClear?.({
+      event,
+      config
+    });
   }
 }
 function getSessionFromContext(event, sessionName) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.24",
+  "version": "0.5.26",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -73,7 +73,7 @@
     "eslint": "^9.36.0",
     "eslint-config-unjs": "^0.5.0",
     "h3v1": "npm:h3@^1.15.4",
-    "h3v2": "npm:h3@^2.0.0-beta.5",
+    "h3v2": "npm:h3@^2.0.1-rc.5",
     "jose": "^6.1.0",
     "prettier": "^3.6.2",
     "supertest": "^7.1.4",
@@ -83,8 +83,8 @@
   },
   "peerDependencies": {
     "cookie-es": "^1.2.2 || ^2.0.0",
-    "h3": "^1.15.4 || >=2.0.0-beta.5 <2.0.0 || ^2.0.1",
-    "rou3": "^0.7.7"
+    "h3": "^1.15.4 || >=2.0.1-rc.5 || ^2.0.1",
+    "rou3": "^0.7.10"
   },
   "peerDependenciesMeta": {
     "cookie-es": {
@@ -92,7 +92,13 @@
     },
     "h3": {
       "optional": true
+    },
+    "rou3": {
+      "optional": true
     }
   },
-  "packageManager": "pnpm@10.17.1"
+  "resolutions": {
+    "@eslint/plugin-kit": "^0.3.4"
+  },
+  "packageManager": "pnpm@10.19.0"
 }