fix(auth): update logic and add todo

Author: mandarini

packages/core/auth-js/src/GoTrueClient.ts

@@ -2112,10 +2112,13 @@ export default class GoTrueClient {
       return this.detectSessionInUrl(new URL(window.location.href), params)
     }
     // Check for Supabase Auth identifier
-    // Fall back to legacy detection for backwards compatibility with older Auth servers
     if ('sb' in params) {
-      return true
+      // sb is just an identifier
+      // Still require OAuth params to prevent forced logout via crafted URLs with only 'sb'
+      return Boolean(params.access_token || params.error || params.error_description)
     }
+    // TODO @mandarini: Remove this legacy fallback in next major version and return false instead
+    // Legacy detection for backwards compatibility with older Auth servers that don't include 'sb'
     return Boolean(params.access_token || params.error_description)
   }
 

packages/core/auth-js/src/lib/types.ts

@@ -93,10 +93,13 @@ export type GoTrueClientOptions = {
    * @example
    * ```ts
    * detectSessionInUrl: (url, params) => {
-   *   // Prefer sb identifier (available on newer Auth servers)
-   *   if ('sb' in params) return true
    *   // Ignore known third-party OAuth paths
    *   if (url.pathname === '/facebook/redirect') return false
+   *   // Check for sb identifier (available on newer Auth servers)
+   *   // Still require OAuth params to prevent issues with crafted URLs
+   *   if ('sb' in params) {
+   *     return Boolean(params.access_token || params.error || params.error_description)
+   *   }
    *   // Fall back to legacy detection for older Auth servers
    *   return Boolean(params.access_token || params.error_description)
    * }

packages/core/supabase-js/src/lib/types.ts

@@ -63,10 +63,13 @@ export type SupabaseClientOptions<SchemaName> = {
      * @example
      * ```ts
      * detectSessionInUrl: (url, params) => {
-     *   // Prefer sb identifier (available on newer Auth servers)
-     *   if ('sb' in params) return true
      *   // Ignore known third-party OAuth paths
      *   if (url.pathname === '/facebook/redirect') return false
+     *   // Check for sb identifier (available on newer Auth servers)
+     *   // Still require OAuth params to prevent issues with crafted URLs
+     *   if ('sb' in params) {
+     *     return Boolean(params.access_token || params.error || params.error_description)
+     *   }
      *   // Fall back to legacy detection for older Auth servers
      *   return Boolean(params.access_token || params.error_description)
      * }