Access Token Exposure Control

src/server/auth-client.test.ts

@@ -324,7 +324,7 @@ ca/T0LLtgmbMmxSv/MmzIg==
       expect(authClient.handleProfile).toHaveBeenCalled();
     });
 
-    it("should call the access token handler if the path is /auth/access-token", async () => {
+    it("should call the handleAccessToken method if the path is /auth/access-token and enableAccessTokenEndpoint is true", async () => {
       const secret = await generateSecret(32);
       const transactionStore = new TransactionStore({
         secret
@@ -342,6 +342,69 @@ ca/T0LLtgmbMmxSv/MmzIg==
 
         secret,
         appBaseUrl: DEFAULT.appBaseUrl,
+        enableAccessTokenEndpoint: true,
+
+        fetch: getMockAuthorizationServer()
+      });
+      const request = new NextRequest("https://example.com/auth/access-token", {
+        method: "GET"
+      });
+      authClient.handleAccessToken = vi.fn();
+      await authClient.handler(request);
+      expect(authClient.handleAccessToken).toHaveBeenCalled();
+    });
+
+    it("should not call the handleAccessToken method if the path is /auth/access-token but enableAccessTokenEndpoint is false", async () => {
+      const secret = await generateSecret(32);
+      const transactionStore = new TransactionStore({
+        secret
+      });
+      const sessionStore = new StatelessSessionStore({
+        secret
+      });
+      const authClient = new AuthClient({
+        transactionStore,
+        sessionStore,
+
+        domain: DEFAULT.domain,
+        clientId: DEFAULT.clientId,
+        clientSecret: DEFAULT.clientSecret,
+
+        secret,
+        appBaseUrl: DEFAULT.appBaseUrl,
+        enableAccessTokenEndpoint: false,
+
+        fetch: getMockAuthorizationServer()
+      });
+      const request = new NextRequest("https://example.com/auth/access-token", {
+        method: "GET"
+      });
+      authClient.handleAccessToken = vi.fn();
+      const response = await authClient.handler(request);
+      expect(authClient.handleAccessToken).not.toHaveBeenCalled();
+      // When a route doesn't match, the handler returns a NextResponse.next() with status 200
+      expect(response.status).toBe(200);
+    });
+
+    it("should use the default value (true) for enableAccessTokenEndpoint when not explicitly provided", async () => {
+      const secret = await generateSecret(32);
+      const transactionStore = new TransactionStore({
+        secret
+      });
+      const sessionStore = new StatelessSessionStore({
+        secret
+      });
+      const authClient = new AuthClient({
+        transactionStore,
+        sessionStore,
+
+        domain: DEFAULT.domain,
+        clientId: DEFAULT.clientId,
+        clientSecret: DEFAULT.clientSecret,
+
+        secret,
+        appBaseUrl: DEFAULT.appBaseUrl,
+        // enableAccessTokenEndpoint not specified, should default to true
 
         fetch: getMockAuthorizationServer()
       });

src/server/auth-client.ts

@@ -100,6 +100,7 @@ export interface AuthClientOptions {
   allowInsecureRequests?: boolean;
   httpTimeout?: number;
   enableTelemetry?: boolean;
+  enableAccessTokenEndpoint?: boolean;
 }
 
 function createRouteUrl(url: string, base: string) {
@@ -133,6 +134,8 @@ export class AuthClient {
 
   private authorizationServerMetadata?: oauth.AuthorizationServer;
 
+  private readonly enableAccessTokenEndpoint: boolean;
+
   constructor(options: AuthClientOptions) {
     // dependencies
     this.fetch = options.fetch || fetch;
@@ -219,6 +222,8 @@ export class AuthClient {
         process.env.NEXT_PUBLIC_ACCESS_TOKEN_ROUTE || "/auth/access-token",
       ...options.routes
     };
+
+    this.enableAccessTokenEndpoint = options.enableAccessTokenEndpoint ?? true;
   }
 
   async handler(req: NextRequest): Promise<NextResponse> {
@@ -236,7 +241,8 @@ export class AuthClient {
       return this.handleProfile(req);
     } else if (
       method === "GET" &&
-      sanitizedPathname === this.routes.accessToken
+      sanitizedPathname === this.routes.accessToken &&
+      this.enableAccessTokenEndpoint
     ) {
       return this.handleAccessToken(req);
     } else if (

src/server/client.ts

@@ -149,6 +149,19 @@ export interface Auth0ClientOptions {
    * via the `Auth0-Client` header. Defaults to `true`.
    */
   enableTelemetry?: boolean;
+
+  /**
+   * Boolean value to enable the `/auth/access-token` endpoint for use in the client app.
+   *
+   * Defaults to `true`.
+   *
+   * NOTE: Set this to `false` if your client does not need to directly interact with resource servers (Token Mediating Backend). This will be false for most apps.
+   *
+   * A security best practice is to disable this to avoid exposing access tokens to the client app.
+   *
+   * See: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps#name-token-mediating-backend
+   */
+  enableAccessTokenEndpoint?: boolean;
 }
 
 export type PagesRouterRequest = IncomingMessage | NextApiRequest;