IcyNetwork/sso-core
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Tweak openid configuration

Browse Source
This commit is contained in:
Evert Prants 2025-02-22 09:46:47 +02:00
parent 3e6a335ab3
commit ccfcdc75f4
Signed by: evert
GPG Key ID: 0960A17F9F40237D
4 changed files with 531 additions and 512 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

980
package-lock.json generated
View File

File diff suppressed because it is too large Load Diff

48
package.json
View File

@ -12,48 +12,48 @@
"format": "prettier --write ." "format": "prettier --write ."
}, },
"devDependencies": { "devDependencies": {
"@sveltejs/kit": "^2.9.0", "@sveltejs/kit": "^2.17.2",
"@sveltejs/vite-plugin-svelte": "^5.0.1", "@sveltejs/vite-plugin-svelte": "^5.0.3",
"@types/bcryptjs": "^2.4.6", "@types/bcryptjs": "^2.4.6",
"@types/eslint": "^9.6.1", "@types/eslint": "^9.6.1",
"@types/mime-types": "^2.1.4", "@types/mime-types": "^2.1.4",
"@types/node": "^22.10.1", "@types/node": "^22.13.5",
"@types/nodemailer": "^6.4.17", "@types/nodemailer": "^6.4.17",
"@types/qrcode": "^1.5.5", "@types/qrcode": "^1.5.5",
"@types/uuid": "^10.0.0", "@types/uuid": "^10.0.0",
"@typescript-eslint/eslint-plugin": "^8.17.0", "@typescript-eslint/eslint-plugin": "^8.24.1",
"@typescript-eslint/parser": "^8.17.0", "@typescript-eslint/parser": "^8.24.1",
"drizzle-kit": "^0.30.0", "drizzle-kit": "^0.30.4",
"eslint": "^9.16.0", "eslint": "^9.21.0",
"eslint-config-prettier": "^9.1.0", "eslint-config-prettier": "^10.0.1",
"eslint-plugin-svelte": "^2.46.1", "eslint-plugin-svelte": "^2.46.1",
"prettier": "^3.4.2", "prettier": "^3.5.2",
"prettier-plugin-svelte": "^3.3.2", "prettier-plugin-svelte": "^3.3.3",
"svelte": "^5.9.1", "svelte": "^5.20.2",
"svelte-check": "^4.1.1", "svelte-check": "^4.1.4",
"tslib": "^2.8.1", "tslib": "^2.8.1",
"typescript": "^5.7.2", "typescript": "^5.7.3",
"vite": "^6.0.3" "vite": "^6.1.1"
}, },
"type": "module", "type": "module",
"dependencies": { "dependencies": {
"@sveltejs/adapter-node": "^5.2.9", "@sveltejs/adapter-node": "^5.2.12",
"bcryptjs": "^2.4.3", "bcryptjs": "^3.0.2",
"chalk": "^5.4.0", "chalk": "^5.4.1",
"cropperjs": "^1.6.2", "cropperjs": "^1.6.2",
"dotenv": "^16.4.7", "dotenv": "^16.4.7",
"drizzle-orm": "^0.38.0", "drizzle-orm": "^0.39.3",
"image-size": "^1.1.1", "image-size": "^1.2.0",
"jose": "^5.9.6", "jose": "^5.10.0",
"mime-types": "^2.1.35", "mime-types": "^2.1.35",
"mysql2": "^3.11.5", "mysql2": "^3.12.0",
"nodemailer": "^6.9.16", "nodemailer": "^6.10.0",
"otplib": "^12.0.1", "otplib": "^12.0.1",
"qrcode": "^1.5.4", "qrcode": "^1.5.4",
"svelte-kit-cookie-session": "^4.0.0", "svelte-kit-cookie-session": "^4.1.1",
"sveltekit-i18n": "^2.4.2", "sveltekit-i18n": "^2.4.2",
"sveltekit-rate-limiter": "^0.6.1", "sveltekit-rate-limiter": "^0.6.1",
"uuid": "^11.0.3", "uuid": "^11.1.0",
"vite-plugin-mkcert": "^1.17.6" "vite-plugin-mkcert": "^1.17.6"
} }
} }

10
src/lib/server/oauth2/model/client.ts
View File

@ -1,4 +1,5 @@
import { env } from '$env/dynamic/public'; import { env } from '$env/dynamic/public';
import { env as privateEnv } from '$env/dynamic/private';
import { CryptoUtils } from '$lib/server/crypto-utils'; import { CryptoUtils } from '$lib/server/crypto-utils';
import { import {
DB, DB,
@ -540,12 +541,17 @@ export class OAuth2Clients {
const set = createLocalJWKSet({ keys: parsedSet as JWK[] }); const set = createLocalJWKSet({ keys: parsedSet as JWK[] });
try { try {
const { payload } = await jwtVerify(assertionToken, set, { const { payload } = await jwtVerify(assertionToken, set, {
subject: client.client_id subject: client.client_id,
issuer: client.client_id
}); });
// Check audience, token must be intended for our service // Check audience, token must be intended for our service
const checkAudience = Array.isArray(payload.aud) ? payload.aud : [payload.aud]; const checkAudience = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
if (!checkAudience.some((entry) => entry?.startsWith(env.PUBLIC_URL))) { if (
!checkAudience.some(
(entry) => entry?.startsWith(env.PUBLIC_URL) || entry?.startsWith(privateEnv.JWT_ISSUER)
)
) {
return false; return false;
} }

5
src/routes/[...wellKnown=wellKnown]/openid-configuration/+server.ts
View File

@ -17,6 +17,11 @@ export const GET = async () =>
id_token_signing_alg_values_supported: [privateEnv.JWT_ALGORITHM], id_token_signing_alg_values_supported: [privateEnv.JWT_ALGORITHM],
subject_types_supported: ['public'], subject_types_supported: ['public'],
scopes_supported: ['openid', 'profile', 'picture', 'email'], scopes_supported: ['openid', 'profile', 'picture', 'email'],
token_endpoint_auth_methods_supported: [
'client_secret_post',
'client_secret_basic',
'private_key_jwt'
],
claims_supported: [ claims_supported: [
'aud', 'aud',
'exp', 'exp',