refactor(adapter-nextjs): use maxAge attribute to set cookie from ser…

…ver to avoid clock drift
aws-amplify · Dec 30, 2024 · c850f31 · c850f31
1 parent 43e6b22
commit c850f31
Show file tree

Hide file tree

Showing 20 changed files with 103 additions and 64 deletions.
diff --git a/packages/adapter-nextjs/__tests__/auth/handlers/handleSignInCallbackRequest.test.ts b/packages/adapter-nextjs/__tests__/auth/handlers/handleSignInCallbackRequest.test.ts
@@ -218,6 +218,7 @@ describe('handleSignInCallbackRequest', () => {
 				httpOnly: true,
 				sameSite: 'strict' as const,
 				expires: new Date('2024-9-17'),
+				maxAge: 3600,
 			};
 			mockCreateTokenCookiesSetOptions.mockReturnValueOnce(
 				mockCreateTokenCookiesSetOptionsResult,
@@ -231,7 +232,7 @@ describe('handleSignInCallbackRequest', () => {
 			const mockCreateAuthFlowProofCookiesRemoveOptionsResult = {
 				domain: 'example.com',
 				path: '/',
-				expires: new Date('1970-1-1'),
+				maxAge: -1,
 			};
 			mockCreateAuthFlowProofCookiesRemoveOptions.mockReturnValueOnce(
 				mockCreateAuthFlowProofCookiesRemoveOptionsResult,

diff --git a/.../adapter-nextjs/__tests__/auth/handlers/handleSignInCallbackRequestForPagesRouter.test.ts b/.../adapter-nextjs/__tests__/auth/handlers/handleSignInCallbackRequestForPagesRouter.test.ts
@@ -249,6 +249,7 @@ describe('handleSignInCallbackRequest', () => {
 				httpOnly: true,
 				sameSite: 'strict' as const,
 				expires: new Date('2024-9-17'),
+				maxAge: 3600,
 			};
 			mockCreateTokenCookiesSetOptions.mockReturnValueOnce(
 				mockCreateTokenCookiesSetOptionsResult,
@@ -262,7 +263,7 @@ describe('handleSignInCallbackRequest', () => {
 			const mockCreateAuthFlowProofCookiesRemoveOptionsResult = {
 				domain: 'example.com',
 				path: '/',
-				expires: new Date('1970-1-1'),
+				maxAge: -1,
 			};
 			mockCreateAuthFlowProofCookiesRemoveOptions.mockReturnValueOnce(
 				mockCreateAuthFlowProofCookiesRemoveOptionsResult,

diff --git a/packages/adapter-nextjs/__tests__/auth/handlers/handleSignInSignUpRequest.test.ts b/packages/adapter-nextjs/__tests__/auth/handlers/handleSignInSignUpRequest.test.ts
@@ -97,6 +97,7 @@ describe('handleSignInSignUpRequest', () => {
 				secure: true,
 				sameSite: 'lax' as const,
 				expires: new Date(),
+				maxAge: 3600,
 			};
 			mockCreateAuthFlowProofCookiesSetOptions.mockReturnValueOnce(
 				mockCreateAuthFlowProofCookiesSetOptionsResult,

diff --git a/...es/adapter-nextjs/__tests__/auth/handlers/handleSignInSignUpRequestForPagesRouter.test.ts b/...es/adapter-nextjs/__tests__/auth/handlers/handleSignInSignUpRequestForPagesRouter.test.ts
@@ -116,6 +116,7 @@ describe('handleSignInSignUpRequest', () => {
 				secure: true,
 				sameSite: 'lax' as const,
 				expires: new Date(),
+				maxAge: 3600,
 			};
 			mockCreateAuthFlowProofCookiesSetOptions.mockReturnValueOnce(
 				mockCreateAuthFlowProofCookiesSetOptionsResult,

diff --git a/packages/adapter-nextjs/__tests__/auth/handlers/handleSignOutCallbackRequest.test.ts b/packages/adapter-nextjs/__tests__/auth/handlers/handleSignOutCallbackRequest.test.ts
@@ -225,7 +225,7 @@ describe('handleSignOutCallbackRequest', () => {
 			const mockCreateTokenCookiesRemoveOptionsResult = {
 				domain: mockSetCookieOptions.domain,
 				path: '/',
-				expires: new Date('1970-01-01'),
+				maxAge: -1,
 			};
 			mockCreateTokenCookiesRemoveOptions.mockReturnValueOnce(
 				mockCreateTokenCookiesRemoveOptionsResult,

diff --git a/...adapter-nextjs/__tests__/auth/handlers/handleSignOutCallbackRequestForPagesRouter.test.ts b/...adapter-nextjs/__tests__/auth/handlers/handleSignOutCallbackRequestForPagesRouter.test.ts
@@ -257,7 +257,7 @@ describe('handleSignOutCallbackRequest', () => {
 			const mockCreateTokenCookiesRemoveOptionsResult = {
 				domain: mockSetCookieOptions.domain,
 				path: '/',
-				expires: new Date('1970-01-01'),
+				maxAge: -1,
 			};
 			mockCreateTokenCookiesRemoveOptions.mockReturnValueOnce(
 				mockCreateTokenCookiesRemoveOptionsResult,

diff --git a/packages/adapter-nextjs/__tests__/auth/handlers/handleSignOutRequest.test.ts b/packages/adapter-nextjs/__tests__/auth/handlers/handleSignOutRequest.test.ts
@@ -68,6 +68,7 @@ describe('handleSignOutRequest', () => {
 			secure: true,
 			sameSite: 'lax' as const,
 			expires: new Date('2024-09-18'),
+			maxAge: 3600,
 		};
 		mockCreateAuthFlowProofCookiesSetOptions.mockReturnValueOnce(
 			mockCreateAuthFlowProofCookiesSetOptionsResult,

diff --git a/packages/adapter-nextjs/__tests__/auth/handlers/handleSignOutRequestForPagesRouter.test.ts b/packages/adapter-nextjs/__tests__/auth/handlers/handleSignOutRequestForPagesRouter.test.ts
@@ -85,6 +85,7 @@ describe('handleSignOutRequest', () => {
 			secure: true,
 			sameSite: 'lax' as const,
 			expires: new Date('2024-09-18'),
+			maxAge: 3600,
 		};
 		mockCreateAuthFlowProofCookiesSetOptions.mockReturnValueOnce(
 			mockCreateAuthFlowProofCookiesSetOptionsResult,

diff --git a/packages/adapter-nextjs/__tests__/auth/utils/authFlowProofCookies.test.ts b/packages/adapter-nextjs/__tests__/auth/utils/authFlowProofCookies.test.ts
@@ -1,7 +1,7 @@
 import { CookieStorage } from 'aws-amplify/adapter-core';
 
 import {
-	AUTH_FLOW_PROOF_COOKIE_EXPIRY,
+	AUTH_FLOW_PROOF_MAX_AGE,
 	IS_SIGNING_OUT_COOKIE_NAME,
 	PKCE_COOKIE_NAME,
 	STATE_COOKIE_NAME,
@@ -37,16 +37,6 @@ describe('createSignOutFlowProofCookies', () => {
 });
 
 describe('createAuthFlowProofCookiesSetOptions', () => {
-	let nowSpy: jest.SpyInstance;
-
-	beforeAll(() => {
-		nowSpy = jest.spyOn(Date, 'now').mockReturnValue(0);
-	});
-
-	afterAll(() => {
-		jest.restoreAllMocks();
-	});
-
 	it('returns expected cookie serialization options with specified parameters', () => {
 		const setCookieOptions: CookieStorage.SetCookieOptions = {
 			domain: '.example.com',
@@ -55,14 +45,13 @@ describe('createAuthFlowProofCookiesSetOptions', () => {
 
 		const options = createAuthFlowProofCookiesSetOptions(setCookieOptions);
 
-		expect(nowSpy).toHaveBeenCalled();
 		expect(options).toEqual({
 			domain: setCookieOptions?.domain,
 			path: '/',
 			httpOnly: true,
 			secure: true,
 			sameSite: 'lax' as const,
-			expires: new Date(0 + AUTH_FLOW_PROOF_COOKIE_EXPIRY),
+			maxAge: AUTH_FLOW_PROOF_MAX_AGE,
 		});
 	});
 
@@ -76,14 +65,13 @@ describe('createAuthFlowProofCookiesSetOptions', () => {
 			secure: false,
 		});
 
-		expect(nowSpy).toHaveBeenCalled();
 		expect(options).toEqual({
 			domain: setCookieOptions?.domain,
 			path: '/',
 			httpOnly: true,
 			secure: false,
 			sameSite: 'lax' as const,
-			expires: new Date(0 + AUTH_FLOW_PROOF_COOKIE_EXPIRY),
+			maxAge: AUTH_FLOW_PROOF_MAX_AGE,
 		});
 	});
 });
@@ -99,7 +87,7 @@ describe('createAuthFlowProofCookiesRemoveOptions', () => {
 		expect(options).toEqual({
 			domain: setCookieOptions?.domain,
 			path: '/',
-			expires: new Date('1970-01-01'),
+			maxAge: -1,
 		});
 	});
 });
diff --git a/packages/adapter-nextjs/__tests__/auth/utils/tokenCookies.test.ts b/packages/adapter-nextjs/__tests__/auth/utils/tokenCookies.test.ts
@@ -1,7 +1,7 @@
 import {
 	AUTH_KEY_PREFIX,
 	CookieStorage,
-	DEFAULT_COOKIE_EXPIRY,
+	DEFAULT_AUTH_TOKEN_COOKIES_MAX_AGE,
 } from 'aws-amplify/adapter-core';
 
 import { OAuthTokenResponsePayload } from '../../../src/auth/types';
@@ -113,7 +113,7 @@ describe('createTokenCookiesSetOptions', () => {
 			httpOnly: true,
 			secure: true,
 			sameSite: 'strict',
-			expires: new Date(0 + DEFAULT_COOKIE_EXPIRY),
+			maxAge: DEFAULT_AUTH_TOKEN_COOKIES_MAX_AGE,
 		});
 
 		dateNowSpy.mockRestore();
@@ -154,7 +154,7 @@ describe('createTokenCookiesRemoveOptions', () => {
 		expect(result).toEqual({
 			domain: mockSetCookieOptions?.domain,
 			path: '/',
-			expires: new Date('1970-01-01'),
+			maxAge: -1,
 		});
 	});
 });
diff --git a/...es/adapter-nextjs/__tests__/utils/createCookieStorageAdapterFromNextServerContext.test.ts b/...es/adapter-nextjs/__tests__/utils/createCookieStorageAdapterFromNextServerContext.test.ts
@@ -158,6 +158,7 @@ describe('createCookieStorageAdapterFromNextServerContext', () => {
 			httpOnly: true,
 			secure: true,
 			path: '/a-path',
+			maxAge: 3600,
 		};
 
 		it('gets cookie by calling `get` method of the underlying cookie store', () => {
@@ -185,7 +186,7 @@ describe('createCookieStorageAdapterFromNextServerContext', () => {
 					mockSerializeOptions.domain
 				};Expires=${mockSerializeOptions.expires.toUTCString()};HttpOnly;SameSite=${
 					mockSerializeOptions.sameSite
-				};Secure;Path=${mockSerializeOptions.path}`,
+				};Secure;Path=${mockSerializeOptions.path};Max-Age=${mockSerializeOptions.maxAge}`,
 			);
 		});
 
@@ -197,7 +198,7 @@ describe('createCookieStorageAdapterFromNextServerContext', () => {
 					mockSerializeOptions.domain
 				};Expires=${mockSerializeOptions.expires.toUTCString()};HttpOnly;SameSite=${
 					mockSerializeOptions.sameSite
-				};Secure;Path=${mockSerializeOptions.path}`,
+				};Secure;Path=${mockSerializeOptions.path};Max-Age=${mockSerializeOptions.maxAge}`,
 			);
 		});
 

diff --git a/packages/adapter-nextjs/src/auth/constant.ts b/packages/adapter-nextjs/src/auth/constant.ts
@@ -22,5 +22,6 @@ export const PKCE_COOKIE_NAME = 'com.amplify.server_auth.pkce';
 export const STATE_COOKIE_NAME = 'com.amplify.server_auth.state';
 export const IS_SIGNING_OUT_COOKIE_NAME =
 	'com.amplify.server_auth.isSigningOut';
-export const AUTH_FLOW_PROOF_COOKIE_EXPIRY = 10 * 60 * 1000; // 10 mins
+export const AUTH_FLOW_PROOF_MAX_AGE = 10 * 60; // 10 mins in seconds
+export const REMOVE_COOKIE_MAX_AGE = -1; // -1 to remove the cookie immediately (0 ==> session cookie)
 export const OAUTH_GRANT_TYPE = 'authorization_code';
diff --git a/packages/adapter-nextjs/src/auth/utils/authFlowProofCookies.ts b/packages/adapter-nextjs/src/auth/utils/authFlowProofCookies.ts
@@ -4,9 +4,10 @@
 import { CookieStorage } from 'aws-amplify/adapter-core';
 
 import {
-	AUTH_FLOW_PROOF_COOKIE_EXPIRY,
+	AUTH_FLOW_PROOF_MAX_AGE,
 	IS_SIGNING_OUT_COOKIE_NAME,
 	PKCE_COOKIE_NAME,
+	REMOVE_COOKIE_MAX_AGE,
 	STATE_COOKIE_NAME,
 } from '../constant';
 
@@ -43,13 +44,13 @@ export const createAuthFlowProofCookiesSetOptions = (
 	httpOnly: true,
 	secure: overrides?.secure ?? true,
 	sameSite: 'lax' as const,
-	expires: new Date(Date.now() + AUTH_FLOW_PROOF_COOKIE_EXPIRY),
+	maxAge: AUTH_FLOW_PROOF_MAX_AGE,
 });
 
 export const createAuthFlowProofCookiesRemoveOptions = (
 	setCookieOptions: CookieStorage.SetCookieOptions,
 ) => ({
 	domain: setCookieOptions?.domain,
 	path: '/',
-	expires: new Date('1970-01-01'),
+	maxAge: REMOVE_COOKIE_MAX_AGE,
 });
diff --git a/packages/adapter-nextjs/src/auth/utils/tokenCookies.ts b/packages/adapter-nextjs/src/auth/utils/tokenCookies.ts
@@ -4,11 +4,12 @@
 import {
 	AUTH_KEY_PREFIX,
 	CookieStorage,
-	DEFAULT_COOKIE_EXPIRY,
+	DEFAULT_AUTH_TOKEN_COOKIES_MAX_AGE,
 	createKeysForAuthStorage,
 } from 'aws-amplify/adapter-core';
 
 import { OAuthTokenResponsePayload } from '../types';
+import { REMOVE_COOKIE_MAX_AGE } from '../constant';
 
 import { getAccessTokenUsernameAndClockDrift } from './getAccessTokenUsernameAndClockDrift';
 
@@ -55,22 +56,31 @@ export const createTokenRemoveCookies = (keys: string[]) =>
 	keys.map(key => ({ name: key, value: '' }));
 
 export const createTokenCookiesSetOptions = (
-	setCookieOptions: CookieStorage.SetCookieOptions,
+	{ domain, sameSite, expires, maxAge }: CookieStorage.SetCookieOptions,
 	overrides?: Pick<CookieStorage.SetCookieOptions, 'secure'>,
-) => ({
-	domain: setCookieOptions?.domain,
-	path: '/',
-	httpOnly: true,
-	secure: overrides?.secure ?? true,
-	sameSite: setCookieOptions.sameSite ?? 'strict',
-	expires:
-		setCookieOptions?.expires ?? new Date(Date.now() + DEFAULT_COOKIE_EXPIRY),
-});
+) => {
+	const result = {
+		domain,
+		path: '/',
+		httpOnly: true,
+		secure: overrides?.secure ?? true,
+		sameSite: sameSite ?? 'strict',
+		expires,
+		maxAge,
+	};
+
+	// when expires and maxAge both are not specified, we set a default maxAge
+	if (!result.expires && !result.maxAge) {
+		result.maxAge = DEFAULT_AUTH_TOKEN_COOKIES_MAX_AGE;
+	}
+
+	return result;
+};
 
 export const createTokenCookiesRemoveOptions = (
 	setCookieOptions: CookieStorage.SetCookieOptions,
 ) => ({
 	domain: setCookieOptions?.domain,
 	path: '/',
-	expires: new Date('1970-01-01'),
+	maxAge: REMOVE_COOKIE_MAX_AGE, // Expire immediately (remove the cookie)
 });
diff --git a/packages/adapter-nextjs/src/types/NextServer.ts b/packages/adapter-nextjs/src/types/NextServer.ts
@@ -81,7 +81,7 @@ export declare namespace NextServer {
 	export interface CreateServerRunnerRuntimeOptions {
 		cookies?: Pick<
 			CookieStorage.SetCookieOptions,
-			'domain' | 'expires' | 'sameSite'
+			'domain' | 'expires' | 'sameSite' | 'maxAge'
 		>;
 	}
 

diff --git a/packages/adapter-nextjs/src/utils/cookie/serializeCookie.ts b/packages/adapter-nextjs/src/utils/cookie/serializeCookie.ts
@@ -13,7 +13,7 @@ export const serializeCookie = (
 const serializeSetCookieOptions = (
 	options: CookieStorage.SetCookieOptions,
 ): string => {
-	const { expires, domain, httpOnly, sameSite, secure, path } = options;
+	const { expires, domain, httpOnly, sameSite, secure, path, maxAge } = options;
 	const serializedOptions: string[] = [];
 	if (domain) {
 		serializedOptions.push(`Domain=${domain}`);
@@ -33,6 +33,9 @@ const serializeSetCookieOptions = (
 	if (path) {
 		serializedOptions.push(`Path=${path}`);
 	}
+	if (maxAge) {
+		serializedOptions.push(`Max-Age=${maxAge}`);
+	}
 
 	return serializedOptions.join(';');
 };