From 6aac5978a11cf034233ac52b2e7c0aff813d8939 Mon Sep 17 00:00:00 2001
From: Tushar Pandey <tushar.pandey@okta.com>
Date: Fri, 7 Mar 2025 21:37:44 +0530
Subject: [PATCH] removed trailing slashes from route pathnames

---
 src/server/auth-client.ts | 29 +++++++++++++++--------------
 src/utils/pathUtils.ts    | 12 ++++++++++++
 2 files changed, 27 insertions(+), 14 deletions(-)
 create mode 100644 src/utils/pathUtils.ts

diff --git a/src/server/auth-client.ts b/src/server/auth-client.ts
index a7e625a15..58a6e5502 100644
--- a/src/server/auth-client.ts
+++ b/src/server/auth-client.ts
@@ -15,6 +15,11 @@ import {
   SdkError
 } from "../errors";
 import { LogoutToken, SessionData, TokenSet } from "../types";
+import {
+  ensureNoLeadingSlash,
+  ensureTrailingSlash,
+  removeTrailingSlash
+} from "../utils/pathUtils";
 import { toSafeRedirect } from "../utils/url-helpers";
 import { AbstractSessionStore } from "./session/abstract-session-store";
 import { TransactionState, TransactionStore } from "./transaction-store";
@@ -107,14 +112,6 @@ export interface AuthClientOptions {
   enableTelemetry?: boolean;
 }
 
-function ensureTrailingSlash(value: string) {
-  return value && !value.endsWith('/') ? `${value}/` : value;
-}
-
-function ensureNoLeadingSlash(value: string) {
-  return value && value.startsWith('/') ? value.substring(1, value.length) : value;
-}
-
 function createRouteUrl(url: string, base: string) {
   return new URL(ensureNoLeadingSlash(url), ensureTrailingSlash(base));
 }
@@ -236,21 +233,25 @@ export class AuthClient {
 
   async handler(req: NextRequest): Promise<NextResponse> {
     const { pathname } = req.nextUrl;
+    const sanitizedPathname = removeTrailingSlash(pathname);
     const method = req.method;
 
-    if (method === "GET" && pathname === this.routes.login) {
+    if (method === "GET" && sanitizedPathname === this.routes.login) {
       return this.handleLogin(req);
-    } else if (method === "GET" && pathname === this.routes.logout) {
+    } else if (method === "GET" && sanitizedPathname === this.routes.logout) {
       return this.handleLogout(req);
-    } else if (method === "GET" && pathname === this.routes.callback) {
+    } else if (method === "GET" && sanitizedPathname === this.routes.callback) {
       return this.handleCallback(req);
-    } else if (method === "GET" && pathname === this.routes.profile) {
+    } else if (method === "GET" && sanitizedPathname === this.routes.profile) {
       return this.handleProfile(req);
-    } else if (method === "GET" && pathname === this.routes.accessToken) {
+    } else if (
+      method === "GET" &&
+      sanitizedPathname === this.routes.accessToken
+    ) {
       return this.handleAccessToken(req);
     } else if (
       method === "POST" &&
-      pathname === this.routes.backChannelLogout
+      sanitizedPathname === this.routes.backChannelLogout
     ) {
       return this.handleBackChannelLogout(req);
     } else {
diff --git a/src/utils/pathUtils.ts b/src/utils/pathUtils.ts
new file mode 100644
index 000000000..231557d3e
--- /dev/null
+++ b/src/utils/pathUtils.ts
@@ -0,0 +1,12 @@
+export function ensureTrailingSlash(value: string) {
+  return value && !value.endsWith("/") ? `${value}/` : value;
+}
+
+export function ensureNoLeadingSlash(value: string) {
+  return value && value.startsWith("/")
+    ? value.substring(1, value.length)
+    : value;
+}
+
+export const removeTrailingSlash = (path: string) =>
+  path.endsWith("/") ? path.slice(0, -1) : path;