fix: bump authkit-js to ^0.20.1 and harden returnTo redirects

README.md

@@ -229,13 +229,29 @@ Use `state` to preserve data across the authentication redirect:
 </button>
 ```
 
+> **Security:** `state` round-trips through the OAuth redirect as plaintext in
+> the URL and is **not** integrity protected — treat anything read from it as
+> untrusted input. Before navigating to a `returnTo`-style value, validate it
+> against your own origin so an attacker cannot smuggle a `javascript:` URI or
+> an off-site open-redirect target.
+
 ```jsx
 // Retrieve it in onRedirectCallback
 <AuthKitProvider
   clientId="client_01ABC123DEF456"
   onRedirectCallback={({ state }) => {
-    if (state?.returnTo) {
-      window.location.href = state.returnTo;
+    if (typeof state?.returnTo !== "string") return;
+    let url;
+    try {
+      url = new URL(state.returnTo, window.location.origin);
+    } catch {
+      return; // malformed URL — ignore
+    }
+    // Only navigate to a same-origin destination. Use the parsed absolute
+    // URL, not a value rebuilt from url.pathname (a "//evil.com" pathname
+    // would redirect off-site).
+    if (url.origin === window.location.origin) {
+      window.location.href = url.href;
     }
   }}
 >

package.json

@@ -37,6 +37,6 @@
     "react": ">=17"
   },
   "dependencies": {
-    "@workos-inc/authkit-js": "0.20.0"
+    "@workos-inc/authkit-js": "^0.20.1"
   }
 }

src/provider.tsx

@@ -69,6 +69,11 @@ export function AuthKitProvider(props: AuthKitProviderProps) {
 
   React.useEffect(() => {
     function initialize() {
+      // createClient() cannot be cancelled once started, so a superseded
+      // initialization (props changed mid-flight) may settle after this effect
+      // has been cleaned up. Ignore those stale results so they cannot clobber
+      // the current initialization's state.
+      let cancelled = false;
       const timeoutId = setTimeout(() => {
         createClient(clientId, {
           apiHostname,
@@ -80,23 +85,34 @@ export function AuthKitProvider(props: AuthKitProviderProps) {
           onRefresh: handleRefresh,
           onRefreshFailure,
           refreshBufferInterval,
-        }).then(async (client) => {
-          const user = client.getUser();
-          setClient({
-            getAccessToken: client.getAccessToken.bind(client),
-            getUser: client.getUser.bind(client),
-            signIn: client.signIn.bind(client),
-            signUp: client.signUp.bind(client),
-            signOut: client.signOut.bind(client),
-            switchToOrganization: client.switchToOrganization.bind(client),
-            getSignInUrl: client.getSignInUrl.bind(client),
-            getSignUpUrl: client.getSignUpUrl.bind(client),
+        })
+          .then(async (client) => {
+            if (cancelled) return;
+            const user = client.getUser();
+            setClient({
+              getAccessToken: client.getAccessToken.bind(client),
+              getUser: client.getUser.bind(client),
+              signIn: client.signIn.bind(client),
+              signUp: client.signUp.bind(client),
+              signOut: client.signOut.bind(client),
+              switchToOrganization: client.switchToOrganization.bind(client),
+              getSignInUrl: client.getSignInUrl.bind(client),
+              getSignUpUrl: client.getSignUpUrl.bind(client),
+            });
+            setState((prev) => ({ ...prev, isLoading: false, user }));
+          })
+          .catch((error) => {
+            if (cancelled) return;
+            // Never leave the app wedged on `isLoading: true` if client
+            // initialization rejects (e.g. a crafted callback URL). Surface the
+            // error and settle into an unauthenticated state.
+            console.error(error);
+            setState((prev) => ({ ...prev, isLoading: false, user: null }));
           });
-          setState((prev) => ({ ...prev, isLoading: false, user }));
-        });
       });
 
       return () => {
+        cancelled = true;
         clearTimeout(timeoutId);
       };
     }