Exercise browser binding and replay protection for login state

Author: RhysSullivan

apps/cloud/src/auth/handlers.ts

@@ -210,7 +210,7 @@ export const CloudAuthPublicHandlers = HttpApiBuilder.group(
           let sealedSession = result.sealedSession;
 
           // Resume where the SSR gate interrupted them. The state passed the
-          // CSRF check above whenever it's present, but it's still a
+          // CSRF check above, but it's still a
           // round-tripped value, so the returnTo inside it is re-validated like
           // any other untrusted path.
           const returnTo = safeReturnTo(decodeLoginState(query.state)?.returnTo) ?? "/";

apps/cloud/src/auth/workos-callback-state.node.test.ts

@@ -10,7 +10,7 @@
 // HTTP surface (see api.request-scope.node.test.ts).
 // ---------------------------------------------------------------------------
 
-import { describe, expect, it } from "@effect/vitest";
+import { afterAll, describe, expect, it } from "@effect/vitest";
 import { Effect, Layer } from "effect";
 import { HttpRouter, HttpServer } from "effect/unstable/http";
 import { HttpApiBuilder } from "effect/unstable/httpapi";
@@ -91,11 +91,13 @@ const App = HttpApiBuilder.layer(PublicApi).pipe(
   Layer.provide(HttpServer.layerServices),
 );
 
+const app = HttpRouter.toWebHandler(App, { disableLogger: true });
+afterAll(() => app.dispose());
+
 const run = (request: Request) => {
-  const handler = HttpRouter.toWebHandler(App, { disableLogger: true }).handler;
   // beta.59: the handler type expects a context argument; this layer stack
   // needs none at runtime — pass undefined like the api.request-scope tests.
-  return handler(request, undefined as never);
+  return app.handler(request, undefined as never);
 };
 
 const callbackUrl = (state?: string, code = "code_1") =>
@@ -109,9 +111,24 @@ describe("workos callback · CSRF state hardening", () => {
     expect(res.headers.get("set-cookie") ?? "").not.toContain(SESSION_COOKIE);
   });
 
+  it("rejects missing state even when the browser has a login cookie", async () => {
+    const res = await run(
+      new Request(callbackUrl(undefined), {
+        headers: { cookie: `${STATE_COOKIE}=victim-login-state` },
+        redirect: "manual",
+      }),
+    );
+    expect(res.status).toBe(400);
+    expect(await res.text()).toBe("Invalid login state");
+    expect(res.headers.get("set-cookie") ?? "").not.toContain(SESSION_COOKIE);
+  });
+
   it("rejects a state that does not match the login cookie", async () => {
     const res = await run(
-      new Request(callbackUrl("attacker-controlled-state"), { redirect: "manual" }),
+      new Request(callbackUrl("attacker-controlled-state"), {
+        headers: { cookie: `${STATE_COOKIE}=victim-login-state` },
+        redirect: "manual",
+      }),
     );
     expect(res.status).toBe(400);
     expect(await res.text()).toContain("Invalid login state");

e2e/cloud/login-csrf.test.ts

@@ -0,0 +1,67 @@
+import { randomUUID } from "node:crypto";
+
+import { expect } from "@effect/vitest";
+import { Effect } from "effect";
+
+import { scenario } from "../src/scenario";
+import { Browser, Target } from "../src/services";
+
+scenario(
+  "Login CSRF · state is required, bound to the browser, and consumed after login",
+  { timeout: 180_000 },
+  Effect.gen(function* () {
+    const target = yield* Target;
+    const browser = yield* Browser;
+    const email = `csrf-${randomUUID()}@e2e.test`;
+    yield* browser.session({ label: "anonymous" }, async ({ page, step }) => {
+      const interceptCallback = async (): Promise<string> => {
+        let callback: string | undefined;
+        await page.route("**/api/auth/callback?**", async (route) => {
+          callback = route.request().url();
+          await route.abort();
+        });
+        await page.goto(new URL("/api/auth/login", target.baseUrl).toString());
+        await page.getByPlaceholder("new-user@example.com").fill(email);
+        await page.getByRole("button", { name: /Continue/ }).click();
+        await expect.poll(() => callback).toBeDefined();
+        await page.unroute("**/api/auth/callback?**");
+        if (!callback) throw new Error("AuthKit did not return a callback");
+        return callback;
+      };
+      await step("Refuse a valid authorization code with no state", async () => {
+        const callback = new URL(await interceptCallback());
+        callback.searchParams.delete("state");
+        const response = await page.request.get(callback.toString(), { maxRedirects: 0 });
+        expect(response.status()).toBe(400);
+        expect(await response.text()).toBe("Invalid login state");
+        expect(
+          (await page.context().cookies()).some((cookie) => cookie.name === "wos-session"),
+        ).toBe(false);
+      });
+      await step("Refuse a state from another login", async () => {
+        const callback = new URL(await interceptCallback());
+        callback.searchParams.set("state", "another-browser-state");
+        const response = await page.request.get(callback.toString(), { maxRedirects: 0 });
+        expect(response.status()).toBe(400);
+        expect(await response.text()).toBe("Invalid login state");
+        expect(
+          (await page.context().cookies()).some((cookie) => cookie.name === "wos-session"),
+        ).toBe(false);
+      });
+      await step("Complete a fresh login, then reject the same callback again", async () => {
+        const callback = await interceptCallback();
+        await page.goto(callback);
+        await page.waitForURL((url) => url.pathname === "/create-org", { timeout: 30_000 });
+        const cookies = await page.context().cookies();
+        expect(cookies.some((cookie) => cookie.name === "wos-session")).toBe(true);
+        expect(cookies.some((cookie) => cookie.name === "wos-login-state")).toBe(false);
+        const me = await page.request.get(new URL("/api/auth/me", target.baseUrl).toString());
+        expect(me.status()).toBe(200);
+        expect(await me.json()).toMatchObject({ user: { email } });
+        const replay = await page.request.get(callback, { maxRedirects: 0 });
+        expect(replay.status()).toBe(400);
+        expect(await replay.text()).toBe("Invalid login state");
+      });
+    });
+  }),
+);