Function encodeOAuthState

server/api/auth/atproto.get.ts:143–168

* This function encodes the OAuth state by generating a random SID, storing it * in a cookie, and returning a JSON string containing the original state and * the SID. The cookie is used to validate the authenticity of the callback * request later. * * This mechanism allows to bind a particular

(event: H3Event, data: OAuthStateData)

 * @returns A JSON string encapsulating the original state and the generated SID
 */
function encodeOAuthState(event: H3Event, data: OAuthStateData): string {
  const id = generateRandomHexString()
  // This uses an ephemeral cookie instead of useSession() to avoid polluting
  // the session with ephemeral OAuth-specific data. The cookie is set with a
  // short expiration time to limit the window of potential misuse, and is
  // deleted immediately after validating the callback to clean up any remnants
  // of the authentication flow. Using useSession() for this would require
  // additional logic to clean up the session in case of expired ephemeral data.

  // We use the id as cookie name to allow multiple concurrent auth flows (e.g.
  // user opens multiple tabs and initiates auth in both, or initiates auth,
  // waits for a while, then initiates again before completing the first one),
  // without risk of cookie value collisions between them. The cookie value is a
  // constant since the actual value doesn't matter - it's just used as a flag
  // to validate the presence of the cookie on callback.
  setCookie(event, `${OAUTH_REQUEST_COOKIE_PREFIX}_${id}`, '1', {
    maxAge: 60 * 5,
    httpOnly: true,
    // secure only if NOT in dev mode
    secure: !import.meta.dev,
    sameSite: 'lax',
    path: event.path.split('?', 1)[0],
  })

  return JSON.stringify({ data, id })
}

function generateRandomHexString(byteLength: number = 16): string {
  return Array.from(crypto.getRandomValues(new Uint8Array(byteLength)), byte =>