nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: 8398a7/action-slack
Pull request #178 (2021-11-18 05:51:21)

fix(fields): escape Slack control characters in pullRequest title
Related: #158

![image](https://user-images.githubusercontent.com/6624567/142359594-40c78b7d-0112-4a38-9b67-7f11e4d246b6.png)

Actually I want to extract the escaping part but haven't find the best place to put that.


Patch:
diff --git a/src/fields.ts b/src/fields.ts
index 04cd299..d6bbdc6 100644
--- a/src/fields.ts
+++ b/src/fields.ts
@@ -199,7 +199,12 @@ export class FieldFactory {
   private async pullRequest(): Promise<string> {
     let value;
     if (context.eventName.startsWith('pull_request')) {
-      value = `<${context.payload.pull_request?.html_url}|${context.payload.pull_request?.title} #${context.payload.pull_request?.number}>`;
+      value = `<${
+        context.payload.pull_request?.html_url
+      }|${context.payload.pull_request?.title
+        ?.replace(/&/g, '&amp;')
+        ?.replace(/</g, '&lt;')
+        ?.replace(/>/g, '&gt;')} #${context.payload.pull_request?.number}>`;
     } else {
       value = 'n/a';
     }


Test patch:
diff --git a/__tests__/fixtures/repos.commits.get.json b/__tests__/fixtures/repos.commits.get.json
index 3994f8f..5fc1361 100644
--- a/__tests__/fixtures/repos.commits.get.json
+++ b/__tests__/fixtures/repos.commits.get.json
@@ -92,4 +92,4 @@
       "patch": "@@ -29,7 +29,7 @@\n....."
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/__tests__/helper.ts b/__tests__/helper.ts
index 8a4aada..1d7eaf6 100644
--- a/__tests__/helper.ts
+++ b/__tests__/helper.ts
@@ -181,7 +181,7 @@ export const pullRequest = (): Field => {
   let value;
   if (context.eventName.startsWith('pull_request')) {
     value =
-      '<https://github.com/8398a7/action-slack/pull/123|Add pullRequest field #123>';
+      '<https://github.com/8398a7/action-slack/pull/123|Add pullRequest field &amp; escaping &lt;, &gt; #123>';
   } else {
     value = 'n/a';
   }
diff --git a/__tests__/pull_request.test.ts b/__tests__/pull_request.test.ts
index de6285a..ce535b6 100644
--- a/__tests__/pull_request.test.ts
+++ b/__tests__/pull_request.test.ts
@@ -67,7 +67,7 @@ describe.each`
     github.context.payload = {
       pull_request: {
         html_url: 'https://github.com/8398a7/action-slack/pull/123',
-        title: 'Add pullRequest field',
+        title: 'Add pullRequest field & escaping <, >',
         number: 123,
         head: { sha },
       },
@@ -90,7 +90,7 @@ describe.each`
     payload.attachments[0].color = 'good';
     expect(await client.prepare(msg)).toStrictEqual(payload);
     expect(process.env.AS_PULL_REQUEST).toStrictEqual(
-      '<https://github.com/8398a7/action-slack/pull/123|Add pullRequest field #123>',
+      '<https://github.com/8398a7/action-slack/pull/123|Add pullRequest field &amp; escaping &lt;, &gt; #123>',
     );
   });
 });
Repository: auth0/auth0-spa-js
Pull request #18 (2019-05-07 19:35:02)

Update telemetry name


Patch:
diff --git a/src/Auth0Client.ts b/src/Auth0Client.ts
index ca3524d..fc73ba9 100644
--- a/src/Auth0Client.ts
+++ b/src/Auth0Client.ts
@@ -36,7 +36,7 @@ export default class Auth0Client {
     const telemetry = encodeURIComponent(
       btoa(
         JSON.stringify({
-          name: '@auth0/auth0-spa-js',
+          name: 'auth0-spa-js',
           version: version
         })
       )


Test patch:
diff --git a/__tests__/index.test.ts b/__tests__/index.test.ts
index c137ab3..0e6c8ce 100644
--- a/__tests__/index.test.ts
+++ b/__tests__/index.test.ts
@@ -25,7 +25,7 @@ const TEST_APP_STATE = { bestPet: 'dog' };
 const TEST_TELEMETRY_QUERY_STRING = `&auth0Client=${encodeURIComponent(
   btoa(
     JSON.stringify({
-      name: '@auth0/auth0-spa-js',
+      name: 'auth0-spa-js',
       version: version
     })
   )
Repository: auth0/auth0-spa-js
Pull request #28 (2019-06-18 17:33:35)

Fix encoding issue when decoding tokens
fix https://github.com/auth0/auth0-spa-js/issues/27

### Description

Fixes an encoding issue when decoding JWTs

### References

https://github.com/auth0/auth0-spa-js/issues/27

### Testing

- [x] This change adds test coverage for new/changed/fixed functionality


Patch:
diff --git a/src/utils.ts b/src/utils.ts
index c8dd0af..f64d7a0 100644
--- a/src/utils.ts
+++ b/src/utils.ts
@@ -96,8 +96,19 @@ const urlEncodeB64 = (input: string) => {
   return input.replace(/[\+\/=]/g, (m: string) => b64Chars[m]);
 };
 
+// https://stackoverflow.com/questions/30106476/
+const decodeB64 = input =>
+  decodeURIComponent(
+    atob(input)
+      .split('')
+      .map(c => {
+        return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2);
+      })
+      .join('')
+  );
+
 export const urlDecodeB64 = (input: string) =>
-  atob(input.replace(/_/g, '/').replace(/-/g, '+'));
+  decodeB64(input.replace(/_/g, '/').replace(/-/g, '+'));
 
 export const bufferToBase64UrlEncoded = input =>
   urlEncodeB64(


Test patch:
diff --git a/__tests__/utils.test.ts b/__tests__/utils.test.ts
index 0995fed..409fe51 100644
--- a/__tests__/utils.test.ts
+++ b/__tests__/utils.test.ts
@@ -69,6 +69,25 @@ describe('utils', () => {
       expect(urlDecodeB64('abc@123-_')).toBe('abc@123+/');
       expect(atob).toHaveBeenCalledWith('abc@123+/');
     });
+    it('decodes string with utf-8 chars', () => {
+      // restore atob to the default atob
+      (<any>global).atob = oldATOB;
+
+      // first we use encodeURIComponent to get percent-encoded UTF-8,
+      // then we convert the percent encodings into raw bytes which
+      // can be fed into btoa.
+      // https://stackoverflow.com/questions/30106476/
+      const b64EncodeUnicode = str =>
+        btoa(
+          encodeURIComponent(str).replace(/%([0-9A-F]{2})/g, (_, p1) =>
+            String.fromCharCode(<any>('0x' + p1))
+          )
+        );
+      const input = 'Błżicz@123!!';
+      const encoded = b64EncodeUnicode(input);
+      const output = urlDecodeB64(encoded);
+      expect(output).toBe(input);
+    });
   });
   describe('bufferToBase64UrlEncoded', () => {
     let oldBTOA;
Repository: auth0/auth0-spa-js
Pull request #230 (2019-09-30 19:09:55)

Add missing char for nonce/state generation.
### Description
We're missing a **W** in the nonce/state generator. 
This does not impact security in any significant way; making this change so it has the expected behavior. 


gkwang: oops, let me fix the tests.

Patch:
diff --git a/src/utils.ts b/src/utils.ts
index 6c0d5a4..cc73c84 100644
--- a/src/utils.ts
+++ b/src/utils.ts
@@ -91,7 +91,7 @@ export const runPopup = (
 
 export const createRandomString = () => {
   const charset =
-    '0123456789ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvwxyz-_~.';
+    '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_~.';
   let random = '';
   const randomValues = Array.from(crypto.getRandomValues(new Uint8Array(43)));
   randomValues.forEach(v => (random += charset[v % charset.length]));


Test patch:
diff --git a/__tests__/utils.test.ts b/__tests__/utils.test.ts
index 72bf678..f5acb93 100644
--- a/__tests__/utils.test.ts
+++ b/__tests__/utils.test.ts
@@ -116,7 +116,7 @@ describe('utils', () => {
       (<any>global).crypto = {
         getRandomValues: () => [1, 5, 10, 15, 100]
       };
-      expect(createRandomString()).toBe('15AFa');
+      expect(createRandomString()).toBe('15AFY');
     });
     it('creates random string with a length between 43 and 128', () => {
       (<any>global).crypto = {
Repository: auth0/auth0-spa-js
Pull request #356 (2020-02-14 21:46:34)

center popup over owner window
Center the popup used in `loginWithPopup` over the owning window.  Tested on Chrome, Firefox and Safari on OSX  Also tested on IOS Safari, the popup opened, but the login redirect after login failed - that said, this is failing on 1.7.0-beta.2 as well so I'm pretty sure that it's unrelated.

This mostly addresses https://github.com/auth0/auth0-spa-js/issues/307



Patch:
diff --git a/package-lock.json b/package-lock.json
index 81819f1..686c122 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "@auth0/auth0-spa-js",
-  "version": "1.5.0",
+  "version": "1.6.4",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
diff --git a/src/utils.ts b/src/utils.ts
index f289d80..03d3ce3 100644
--- a/src/utils.ts
+++ b/src/utils.ts
@@ -63,10 +63,15 @@ export const runIframe = (
 };
 
 export const openPopup = () => {
+  const width = 400;
+  const height = 600;
+  const left = window.screenX + (window.innerWidth - width) / 2;
+  const top = window.screenY + (window.innerHeight - height) / 2;
+
   const popup = window.open(
     '',
     'auth0:authorize:popup',
-    'left=100,top=100,width=400,height=600,resizable,scrollbars=yes,status=1'
+    `left=${left},top=${top},width=${width},height=${height},resizable,scrollbars=yes,status=1`
   );
   if (!popup) {
     throw new Error('Could not open popup');


Test patch:
diff --git a/__tests__/utils.test.ts b/__tests__/utils.test.ts
index a680a29..41ce0a9 100644
--- a/__tests__/utils.test.ts
+++ b/__tests__/utils.test.ts
@@ -246,7 +246,7 @@ describe('utils', () => {
       expect(window.open).toHaveBeenCalledWith(
         '',
         'auth0:authorize:popup',
-        'left=100,top=100,width=400,height=600,resizable,scrollbars=yes,status=1'
+        'left=312,top=84,width=400,height=600,resizable,scrollbars=yes,status=1'
       );
     });
     it('throws error when the popup is blocked', () => {
Repository: auth0/auth0-spa-js
Pull request #461 (2020-05-13 08:09:02)

[SDK-1649] Fix issue where cache was missed when scope parameter was provided
### Description

Multiple calls to `getTokenSilently` with the `scope` argument (eg `getTokenSilently({ audience: 'https://api/tv-shows', scope: 'read:shows' })`) will miss the cache because the scope argument is not being applied to the SDKs default scopes correctly

### Testing

Subsequent calls to `getTokenSilently` with `audience` and `scope` should not use the network

- [x] This change adds test coverage for new/changed/fixed functionality

### Checklist

- [ ] All active GitHub checks for tests, formatting, and security are passing
- [x] The correct base branch is being used, if not `master`



Patch:
diff --git a/src/Auth0Client.ts b/src/Auth0Client.ts
index 742ebb4..c54958f 100644
--- a/src/Auth0Client.ts
+++ b/src/Auth0Client.ts
@@ -501,9 +501,9 @@ export default class Auth0Client {
   public async getTokenSilently(options: GetTokenSilentlyOptions = {}) {
     const { ignoreCache, ...getTokenOptions } = {
       audience: this.options.audience,
-      scope: getUniqueScopes(this.defaultScope, this.scope, options.scope),
       ignoreCache: false,
-      ...options
+      ...options,
+      scope: getUniqueScopes(this.defaultScope, this.scope, options.scope)
     };
 
     try {


Test patch:
diff --git a/__tests__/Auth0Client.test.ts b/__tests__/Auth0Client.test.ts
index 11db6a7..bec9bfd 100644
--- a/__tests__/Auth0Client.test.ts
+++ b/__tests__/Auth0Client.test.ts
@@ -512,4 +512,34 @@ describe('Auth0Client', () => {
       value: originalUserAgent
     });
   });
+
+  it('uses the cache for multiple token requests with audience and scope', async () => {
+    const auth0 = setup();
+    await login(auth0);
+    jest.spyOn(<any>utils, 'runIframe').mockResolvedValue({
+      access_token: 'my_access_token',
+      state: 'MTIz'
+    });
+    mockFetch.mockResolvedValue(
+      fetchResponse(true, {
+        id_token: 'my_id_token',
+        refresh_token: 'my_refresh_token',
+        access_token: 'my_access_token',
+        expires_in: 86400
+      })
+    );
+    let access_token = await auth0.getTokenSilently({
+      audience: 'foo',
+      scope: 'bar'
+    });
+    expect(access_token).toEqual('my_access_token');
+    expect(utils.runIframe).toHaveBeenCalledTimes(1);
+    (<jest.Mock>utils.runIframe).mockClear();
+    access_token = await auth0.getTokenSilently({
+      audience: 'foo',
+      scope: 'bar'
+    });
+    expect(access_token).toEqual('my_access_token');
+    expect(utils.runIframe).not.toHaveBeenCalled();
+  });
 });
Repository: auth0/auth0-spa-js
Pull request #523 (2020-07-13 10:13:37)

[SDK-1560] Allow issuer as url
### Description

Allow `issuer` option to be passed a fully qualified url

### References

See #428 
https://tools.ietf.org/id/draft-ietf-oauth-discovery-08.html#ASMetadata

### Testing

- [x] This change adds test coverage for new/changed/fixed functionality

### Checklist

- [x] I have added documentation for new/changed functionality in this PR or in auth0.com/docs
- [x] All active GitHub checks for tests, formatting, and security are passing
- [x] The correct base branch is being used, if not `master`



Patch:
diff --git a/src/Auth0Client.ts b/src/Auth0Client.ts
index 5fd6479..fa965af 100644
--- a/src/Auth0Client.ts
+++ b/src/Auth0Client.ts
@@ -82,6 +82,16 @@ const cacheFactory = (location: string) => {
  */
 const isIE11 = () => /Trident.*rv:11\.0/.test(navigator.userAgent);
 
+/**
+ * @ignore
+ */
+const getTokenIssuer = (issuer, domainUrl) => {
+  if (issuer) {
+    return issuer.startsWith('https://') ? issuer : `https://${issuer}/`;
+  }
+  return `${domainUrl}/`;
+};
+
 /**
  * @ignore
  */
@@ -134,10 +144,7 @@ export default class Auth0Client {
     this.scope = this.options.scope;
     this.transactionManager = new TransactionManager();
     this.domainUrl = `https://${this.options.domain}`;
-
-    this.tokenIssuer = this.options.issuer
-      ? `https://${this.options.issuer}/`
-      : `${this.domainUrl}/`;
+    this.tokenIssuer = getTokenIssuer(this.options.issuer, this.domainUrl);
 
     this.defaultScope = getUniqueScopes(
       'openid',


Test patch:
diff --git a/__tests__/Auth0Client.test.ts b/__tests__/Auth0Client.test.ts
index af966b5..c5bd7cd 100644
--- a/__tests__/Auth0Client.test.ts
+++ b/__tests__/Auth0Client.test.ts
@@ -144,6 +144,30 @@ describe('Auth0Client', () => {
     expect((<any>auth0).defaultScope).toBe('openid');
   });
 
+  it('should create issuer from domain', () => {
+    const auth0 = setup({
+      domain: 'test.dev'
+    });
+
+    expect((<any>auth0).tokenIssuer).toEqual('https://test.dev/');
+  });
+
+  it('should allow issuer as a domain', () => {
+    const auth0 = setup({
+      issuer: 'foo.bar.com'
+    });
+
+    expect((<any>auth0).tokenIssuer).toEqual('https://foo.bar.com/');
+  });
+
+  it('should allow issuer as a fully qualified url', () => {
+    const auth0 = setup({
+      issuer: 'https://some.issuer.com/'
+    });
+
+    expect((<any>auth0).tokenIssuer).toEqual('https://some.issuer.com/');
+  });
+
   it('should log the user in and get the token', async () => {
     const auth0 = setup();
     await login(auth0);
Repository: auth0/auth0-spa-js
Pull request #525 (2020-07-13 13:00:38)

[SDK-1798] prevent unnecessary token requests
### Description

Prevents multiple requests when tokens are requested before the first token response (if you're hammering the `getTokenSilently` button)

### References

See #480 

### Testing

- [ ] This change adds test coverage for new/changed/fixed functionality

### Checklist

- [ ] I have added documentation for new/changed functionality in this PR or in auth0.com/docs
- [ ] All active GitHub checks for tests, formatting, and security are passing
- [ ] The correct base branch is being used, if not `master`



Patch:
diff --git a/src/Auth0Client.ts b/src/Auth0Client.ts
index 415337c..5e68d2d 100644
--- a/src/Auth0Client.ts
+++ b/src/Auth0Client.ts
@@ -548,6 +548,8 @@ export default class Auth0Client {
     };
 
     try {
+      await lock.acquireLock(GET_TOKEN_SILENTLY_LOCK_KEY, 5000);
+
       if (!ignoreCache) {
         const cache = this.cache.get(
           {
@@ -559,12 +561,11 @@ export default class Auth0Client {
         );
 
         if (cache && cache.access_token) {
+          await lock.releaseLock(GET_TOKEN_SILENTLY_LOCK_KEY);
           return cache.access_token;
         }
       }
 
-      await lock.acquireLock(GET_TOKEN_SILENTLY_LOCK_KEY, 5000);
-
       const authResult = this.options.useRefreshTokens
         ? await this._getTokenUsingRefreshToken(getTokenOptions)
         : await this._getTokenFromIFrame(getTokenOptions);


Test patch:
diff --git a/__tests__/Auth0Client.test.ts b/__tests__/Auth0Client.test.ts
index 1eb13b1..e222b86 100644
--- a/__tests__/Auth0Client.test.ts
+++ b/__tests__/Auth0Client.test.ts
@@ -14,6 +14,8 @@ jest.mock('es-cookie');
 jest.mock('../src/jwt');
 jest.mock('../src/token.worker');
 
+jest.unmock('browser-tabs-lock');
+
 const mockWindow = <any>global;
 const mockFetch = (mockWindow.fetch = <jest.Mock>unfetch);
 const mockVerify = <jest.Mock>verify;
@@ -604,6 +606,30 @@ describe('Auth0Client', () => {
     });
   });
 
+  it('uses the cache for subsequent requests that occur before the response', async () => {
+    const auth0 = setup();
+    await login(auth0);
+    (auth0 as any).cache.clear();
+    jest.spyOn(<any>utils, 'runIframe').mockResolvedValue({
+      access_token: 'my_access_token',
+      state: 'MTIz'
+    });
+    mockFetch.mockResolvedValue(
+      fetchResponse(true, {
+        id_token: 'my_id_token',
+        access_token: 'my_access_token',
+        expires_in: 86400
+      })
+    );
+    let [access_token] = await Promise.all([
+      auth0.getTokenSilently(),
+      auth0.getTokenSilently(),
+      auth0.getTokenSilently()
+    ]);
+    expect(access_token).toEqual('my_access_token');
+    expect(utils.runIframe).toHaveBeenCalledTimes(1);
+  });
+
   it('uses the cache for multiple token requests with audience and scope', async () => {
     const auth0 = setup();
     await login(auth0);
Repository: auth0/auth0-spa-js
Pull request #560 (2020-08-26 13:57:22)

[SDK-1885] Add some additional state validation
### Description

State validation can be bypassed by passing `Object.prototype` properties as `state` in the callback url params

### Testing

Visit http://localhost:3000?code=foo&state=constructor on the SPA JS playground
Click "handle redirect callback"

Expected: `Invalid State`
Actual: Code exchange is attempted

- [ ] This change adds test coverage for new/changed/fixed functionality

### Checklist

- [ ] I have added documentation for new/changed functionality in this PR or in auth0.com/docs
- [ ] All active GitHub checks for tests, formatting, and security are passing
- [ ] The correct base branch is being used, if not `master`



Patch:
diff --git a/src/Auth0Client.ts b/src/Auth0Client.ts
index a87b774..325c3b0 100644
--- a/src/Auth0Client.ts
+++ b/src/Auth0Client.ts
@@ -450,7 +450,8 @@ export default class Auth0Client {
 
     const transaction = this.transactionManager.get(state);
 
-    if (!transaction) {
+    // Transaction should have a `code_verifier` to do PKCE and a `nonce` for CSRF protection
+    if (!transaction || !transaction.code_verifier || !transaction.nonce) {
       throw new Error('Invalid state');
     }
 


Test patch:
diff --git a/__tests__/Auth0Client.test.ts b/__tests__/Auth0Client.test.ts
index 527ddd8..1ba743b 100644
--- a/__tests__/Auth0Client.test.ts
+++ b/__tests__/Auth0Client.test.ts
@@ -222,6 +222,22 @@ describe('Auth0Client', () => {
     );
   });
 
+  it('should not attempt to log the user in with Object prototype properties as state', async () => {
+    window.history.pushState({}, '', `/?code=foo&state=constructor`);
+    const auth0 = await setup();
+    mockFetch.mockResolvedValueOnce(
+      fetchResponse(true, {
+        id_token: 'my_id_token',
+        refresh_token: 'my_refresh_token',
+        access_token: 'my_access_token',
+        expires_in: 86400
+      })
+    );
+    await expect(auth0.handleRedirectCallback()).rejects.toThrow(
+      'Invalid state'
+    );
+  });
+
   it('uses the cache when expires_in > constant leeway', async () => {
     const auth0 = setup();
     await login(auth0, true, { expires_in: 70 });
diff --git a/__tests__/index.test.ts b/__tests__/index.test.ts
index 7fb3d67..6735e21 100644
--- a/__tests__/index.test.ts
+++ b/__tests__/index.test.ts
@@ -973,7 +973,11 @@ describe('Auth0', () => {
           key: 'property'
         };
 
-        transactionManager.get.mockReturnValue({ appState });
+        transactionManager.get.mockReturnValue({
+          appState,
+          nonce: 'foo',
+          code_verifier: 'bar'
+        });
 
         const queryResult = {
           error: 'unauthorized',
Repository: auth0/nextjs-auth0
Pull request #127 (2020-06-01 12:06:10)

fix for encodeing postLogoutRedirectUri twice

This pr fixes an issue in auth0.handleLogout(req, res) where the post redirect url was encoded twice causing issues logging out on identity. This still falls back to use the default Auth0 logout URL, thus existing behavior is not broken.

### References
Solves the problem described in #126 

### Testing

- [x] This change adds test coverage for new/changed/fixed functionality

### Checklist

- [ ] All active GitHub checks for tests, formatting, and security are passing
- [ ] The correct base branch is being used, if not `master`
- [ ] I have added documentation for new/changed functionality in this PR or in auth0.com/docs


chriskolenko: Can confirm this fixes the double encoding problem for logout.
sandrinodimattia: Thank you 👍  It introduces an other small issue, but I'll fix it separately.

Patch:
diff --git a/src/handlers/logout.ts b/src/handlers/logout.ts
index 561cec22..a417756d 100644
--- a/src/handlers/logout.ts
+++ b/src/handlers/logout.ts
@@ -31,7 +31,7 @@ export default function logoutHandler(
 
     const session = await store.read(req);
     let endSessionUrl;
-    const returnToUrl = encodeURIComponent(options?.returnTo || settings.postLogoutRedirectUri);
+    const returnToUrl = options?.returnTo || settings.postLogoutRedirectUri;
 
     try {
       const client = await clientProvider();


Test patch:
diff --git a/tests/handlers/logout.test.ts b/tests/handlers/logout.test.ts
index cbb4155f..5268af78 100644
--- a/tests/handlers/logout.test.ts
+++ b/tests/handlers/logout.test.ts
@@ -100,7 +100,7 @@ describe('logout handler', () => {
     expect(statusCode).toBe(302);
     expect(headers.location).toBe(
       `https://my-end-session-endpoint/logout` +
-        `?id_token_hint=my-id-token&post_logout_redirect_uri=https%253A%252F%252Fwww.acme.com`
+        `?id_token_hint=my-id-token&post_logout_redirect_uri=https%3A%2F%2Fwww.acme.com`
     );
   });
Repository: auth0/nextjs-auth0
Pull request #233 (2021-01-11 10:37:51)

Prevent caching the `/me` request
Use the `no-store` `Cache-Control` directive to prevent any caching of the `/api/auth/me` url

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control#preventing_caching


Patch:
diff --git a/src/handlers/profile.ts b/src/handlers/profile.ts
index 4c83f48f..9df236d5 100644
--- a/src/handlers/profile.ts
+++ b/src/handlers/profile.ts
@@ -70,6 +70,7 @@ export default function profileHandler(
       return;
     }
 
+    res.setHeader('Cache-Control', 'no-store');
     res.json(session.user);
   };
 }


Test patch:
diff --git a/tests/handlers/profile.test.ts b/tests/handlers/profile.test.ts
index 305478bf..1238b86b 100644
--- a/tests/handlers/profile.test.ts
+++ b/tests/handlers/profile.test.ts
@@ -23,6 +23,14 @@ describe('profile handler', () => {
     expect(profile).toStrictEqual({ nickname: '__test_nickname__', sub: '__test_sub__' });
   });
 
+  test('should not allow caching the profile response', async () => {
+    const baseUrl = await setup(withoutApi);
+    const cookieJar = await login(baseUrl);
+
+    const { res } = await get(baseUrl, '/api/auth/me', { cookieJar, fullResponse: true });
+    expect(res.headers['cache-control']).toEqual('no-store');
+  });
+
   test('should throw if re-fetching with no Access Token', async () => {
     const afterCallback: AfterCallback = (_req, _res, session: Session): Session => {
       delete session.accessToken;