+7

.changeset/wet-bears-try.md

reviewed

··· 1 1 + --- 2 2 + '@atcute/oauth-browser-client': patch 3 3 + --- 4 4 + 5 5 + check if retried request returns a new nonce 6 6 + 7 7 + in case the authorization server is set up to always return a new nonce every request.

+13 -1

packages/oauth/browser-client/lib/dpop.ts

reviewed

··· 167 167 const nextRequest = new Request(input, init); 168 168 nextRequest.headers.set('dpop', nextProof); 169 169 170 170 - return await fetch(nextRequest); 170 170 + const retryResponse = await fetch(nextRequest); 171 171 + 172 172 + // Check if the server returned another new nonce in the retry response 173 173 + const retryNonce = retryResponse.headers.get('dpop-nonce'); 174 174 + if (retryNonce !== null && retryNonce !== nextNonce) { 175 175 + try { 176 176 + nonces.set(origin, retryNonce); 177 177 + } catch { 178 178 + // Ignore write errors 179 179 + } 180 180 + } 181 181 + 182 182 + return retryResponse; 171 183 } 172 184 }; 173 185 };