Auth review fixes: persist rotated tokens from polling, harden returnTo

Review feedback on #718:
- /auth/token now proxies Auth.js's own /auth/session handler and
  forwards its Set-Cookie headers: a bare auth() in the route refreshed
  the access token but discarded the rotated refresh-token cookie, so an
  actively-used session still died when the ORIGINAL 14-day refresh
  token expired.
- sanitizeReturnTo also rejects backslashes: browsers normalize \ to /
  in special-scheme URLs, so /\evil.com was a post-login open redirect
  despite the // check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: nofurtherinformation

app/src/app/auth/token/route.ts

@@ -1,17 +1,34 @@
-import {getServerSession} from '@/app/lib/auth';
+import {NextRequest} from 'next/server';
+import {handlers} from '@/auth';
+import {toClientSession} from '@/app/lib/auth';
 
 /**
  * Returns the current client session (fresh access token included) for client
- * polling. getServerSession -> auth() runs the NextAuth jwt callback, which
- * silently refreshes an expiring access token — and unlike server components,
- * route handlers CAN write cookies, so the rotated refresh token is persisted
- * back to the session cookie here.
+ * polling.
+ *
+ * This proxies Auth.js's own /auth/session handler rather than calling auth()
+ * bare: a bare auth() in a route handler runs the jwt callback (refreshing an
+ * expiring token) but DISCARDS the Set-Cookie carrying the rotated pair, so
+ * the browser would keep polling with the original refresh token until it
+ * expired mid-session. The proxied handler's Set-Cookie headers are forwarded
+ * so the rotation is persisted.
  *
  * Responds with JSON `null` when unauthenticated or the refresh failed.
  */
 export const dynamic = 'force-dynamic';
 
-export async function GET() {
-  const session = await getServerSession();
-  return Response.json(session, {headers: {'Cache-Control': 'no-store'}});
+export async function GET(request: NextRequest) {
+  const sessionRequest = new NextRequest(new URL('/auth/session', request.url), {
+    headers: request.headers,
+  });
+  const upstream = await handlers.GET(sessionRequest);
+  const session = upstream.ok ? await upstream.json() : null;
+
+  const response = Response.json(toClientSession(session), {
+    headers: {'Cache-Control': 'no-store'},
+  });
+  for (const cookie of upstream.headers.getSetCookie()) {
+    response.headers.append('Set-Cookie', cookie);
+  }
+  return response;
 }

app/src/app/lib/auth.ts

@@ -18,11 +18,17 @@ export type ClientSession = {
 };
 
 /**
- * Server-side session helper. Returns null when unauthenticated or when the
+ * Map an Auth.js session (from auth() or the /auth/session endpoint's JSON)
+ * to the serializable client shape. Null when unauthenticated or when the
  * silent token refresh has failed (forcing a re-login).
  */
-export const getServerSession = async (): Promise<ClientSession | null> => {
-  const session = await auth();
+export const toClientSession = (
+  session: {
+    user?: SessionUser;
+    accessToken?: string;
+    error?: string;
+  } | null
+): ClientSession | null => {
   if (!session?.user || session.error === 'RefreshTokenError') {
     return null;
   }
@@ -35,3 +41,14 @@ export const getServerSession = async (): Promise<ClientSession | null> => {
     tokenSet: session.accessToken ? {accessToken: session.accessToken} : undefined,
   };
 };
+
+/**
+ * Server-side session helper. Returns null when unauthenticated or when the
+ * silent token refresh has failed (forcing a re-login).
+ *
+ * NOTE: server components cannot write cookies, so a refresh that happens
+ * here is not persisted — that is fine for rendering, but polling endpoints
+ * must go through Auth.js's own handler instead (see app/auth/token/route.ts).
+ */
+export const getServerSession = async (): Promise<ClientSession | null> =>
+  toClientSession(await auth());

app/src/app/utils/sanitizeReturnTo.ts

@@ -1,5 +1,12 @@
-/** Only allow same-origin relative redirect targets; anything else falls back to /. */
+/**
+ * Only allow same-origin relative redirect targets; anything else falls back
+ * to /. Rejects `//host` AND any backslash: browsers normalize `\` to `/`
+ * when resolving special-scheme URLs, so `/\evil.com` is scheme-relative too.
+ */
 export const sanitizeReturnTo = (returnTo: unknown): string =>
-  typeof returnTo === 'string' && returnTo.startsWith('/') && !returnTo.startsWith('//')
+  typeof returnTo === 'string' &&
+  returnTo.startsWith('/') &&
+  !returnTo.startsWith('//') &&
+  !returnTo.includes('\\')
     ? returnTo
     : '/';