Commit c0d7015
authored
Normalize iss/issuer comparisons consistently across all three sites (#8)
Closes #7.
`solid-oidc.js` had three sites comparing `iss` / `issuer` URLs but only
one of them (the discovery-time check) normalized trailing slashes. The
redirect-callback check and the token-validation check used strict `!==`
with no normalization, so legitimate logins failed with misleading
"Issuer mismatch" errors any time the IdP served slightly different URL
forms between the discovery doc and the redirect / token claim.
Lift `trimSlash` to module scope and apply it consistently at all three
comparison sites. RFC 9207 §2.3 requires comparison after normalization.1 parent 26acec0 commit c0d7015
1 file changed
Lines changed: 12 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -37,6 +37,16 @@ function base64urlDecode(str) { | |||
| 37 | 37 | return Uint8Array.from(atob(str), c => c.charCodeAt(0)) | |
| 38 | 38 | } | |
| 39 | 39 | ||
| 40 | + // ============================================================================ | ||
| 41 | + // URL Helpers | ||
| 42 | + // ============================================================================ | ||
| 43 | + | ||
| 44 | + // Normalize URLs by trimming a single trailing slash, so iss/issuer | ||
| 45 | + // comparisons survive trailing-slash variance between OIDC discovery doc, | ||
| 46 | + // redirect `iss` parameter, and token `iss` claim. RFC 9207 §2.3 requires | ||
| 47 | + // comparison after normalization. | ||
| 48 | + const trimSlash = (s) => (typeof s === 'string' && s.endsWith('/')) ? s.slice(0, -1) : s | ||
| 49 | + | ||
| 40 | 50 | // ============================================================================ | |
| 41 | 51 | // Web Crypto JWT Helpers (replaces jose dependency) | |
| 42 | 52 | // ============================================================================ | |
@@ -90,7 +100,7 @@ async function verifyJWT(token, jwksUri, options = {}) { | |||
| 90 | 100 | const header = JSON.parse(new TextDecoder().decode(base64urlDecode(parts[0]))) | |
| 91 | 101 | const payload = JSON.parse(new TextDecoder().decode(base64urlDecode(parts[1]))) | |
| 92 | 102 | ||
| 93 | - if (options.issuer && payload.iss !== options.issuer) { | ||
| 103 | + if (options.issuer && trimSlash(payload.iss) !== trimSlash(options.issuer)) { | ||
| 94 | 104 | throw new Error(`Issuer mismatch: ${payload.iss} !== ${options.issuer}`) | |
| 95 | 105 | } | |
| 96 | 106 | if (options.audience) { | |
@@ -453,7 +463,6 @@ export class Session extends EventTarget { | |||
| 453 | 463 | ||
| 454 | 464 | // RFC 9207: Verify issuer | |
| 455 | 465 | const issuer = config.issuer | |
| 456 | - const trimSlash = (s) => s.endsWith('/') ? s.slice(0, -1) : s | ||
| 457 | 466 | if (trimSlash(idp) !== trimSlash(issuer)) { | |
| 458 | 467 | throw new Error(`Issuer mismatch: ${issuer} !== ${idp}`) | |
| 459 | 468 | } | |
@@ -507,7 +516,7 @@ export class Session extends EventTarget { | |||
| 507 | 516 | // RFC 9207: Verify issuer | |
| 508 | 517 | const idp = sessionStorage.getItem('solid_oidc_idp') | |
| 509 | 518 | const iss = url.searchParams.get('iss') | |
| 510 | - if (!idp || iss !== idp) { | ||
| 519 | + if (!idp || trimSlash(iss) !== trimSlash(idp)) { | ||
| 511 | 520 | throw new Error(`Issuer mismatch: ${iss} !== ${idp}`) | |
| 512 | 521 | } | |
| 513 | 522 | ||
0 commit comments