fix(next-auth): harden getToken parsing and bind OAuth check cookies to provider#13469
Merged
Merged
Conversation
…headers A request carrying a malformed percent-encoded bearer token (for example `Authorization: Bearer %`) made getToken throw an uncaught URIError to the caller instead of failing authentication cleanly. Decoding now treats a malformed encoding as an invalid token and returns null, matching how undecodable tokens are already handled. Fixes GHSA-xmf8-cvqr-rfgj
The state, nonce, and PKCE check cookies used shared, non provider-specific names, so a check cookie minted during a sign-in with one provider could be replayed against a callback for a different provider. The sealed payload now records the id of the provider that created it, and the callback rejects any check cookie whose recorded provider does not match the provider handling the request. Cookies minted before this change carry no provider id and are rejected.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two hardening fixes for the 4.x line, matching behavior already shipped in @auth/core@0.41.3.
getToken()returned an uncaughtURIErrorwhen theAuthorizationheader carried malformed percent-encoding, turning a garbage header into a request crash. It now treats the token as absent and returnsnull.OAuth
state,nonce, and PKCE check cookies were not tied to the provider that created them, so a check minted in one provider's flow could be redeemed in another's callback. The sealed cookie payload now records the issuing provider and the callback rejects any mismatch. Cookies minted before this change carry no provider field and are also rejected; users mid-sign-in during an upgrade see one failed callback and succeed on retry.