Prevent nowProvider from being passed to authorize endpoint

__tests__/Auth0Client/constructor.test.ts

@@ -7,7 +7,7 @@ import * as scope from '../../src/scope';
 
 // @ts-ignore
 
-import { loginWithRedirectFn, setupFn } from './helpers';
+import { assertUrlEquals, loginWithRedirectFn, setupFn } from './helpers';
 
 import { TEST_CLIENT_ID, TEST_CODE_CHALLENGE, TEST_DOMAIN } from '../constants';
 import { ICache } from '../../src/cache';
@@ -33,15 +33,6 @@ jest
 
 jest.spyOn(utils, 'runPopup');
 
-const assertUrlEquals = (actualUrl, host, path, queryParams) => {
-  const url = new URL(actualUrl);
-  expect(url.host).toEqual(host);
-  expect(url.pathname).toEqual(path);
-  for (let [key, value] of Object.entries(queryParams)) {
-    expect(url.searchParams.get(key)).toEqual(value);
-  }
-};
-
 const setup = setupFn(mockVerify);
 
 describe('Auth0Client', () => {

__tests__/Auth0Client/helpers.ts

@@ -27,7 +27,7 @@ const authorizationResponse: AuthenticationResult = {
   state: TEST_STATE
 };
 
-export const assertPostFn = mockFetch => {
+export const assertPostFn = (mockFetch: jest.Mock) => {
   return (
     url: string,
     body: any,
@@ -51,12 +51,37 @@ export const assertPostFn = mockFetch => {
   };
 };
 
-export const assertUrlEquals = (actualUrl, host, path, queryParams) => {
+/**
+ * Extracts the keys and values from an IterableIterator and applies
+ * them to an object.
+ * @param itor The iterable
+ * @returns An object with the keys and values from the iterable
+ */
+const itorToObject = <K extends string | number | symbol, V>(
+  itor: IterableIterator<[K, V]>
+): Record<K, V> =>
+  [...itor].reduce((m, [key, value]) => {
+    m[key] = value;
+    return m;
+  }, {} as Record<K, V>);
+
+export const assertUrlEquals = (
+  actualUrl: URL | string,
+  host: string,
+  path: string,
+  queryParams: Record<string, string>,
+  strict: boolean = false
+) => {
   const url = new URL(actualUrl);
+  const searchParamsObj = itorToObject(url.searchParams.entries());
+
   expect(url.host).toEqual(host);
   expect(url.pathname).toEqual(path);
-  for (let [key, value] of Object.entries(queryParams)) {
-    expect(url.searchParams.get(key)).toEqual(value);
+
+  if (strict) {
+    expect(searchParamsObj).toStrictEqual(queryParams);
+  } else {
+    expect(searchParamsObj).toMatchObject(queryParams);
   }
 };
 
@@ -66,7 +91,7 @@ export const fetchResponse = (ok, json) =>
     json: () => Promise.resolve(json)
   });
 
-export const setupFn = mockVerify => {
+export const setupFn = (mockVerify: jest.Mock) => {
   return (config?: Partial<Auth0ClientOptions>, claims?: Partial<IdToken>) => {
     const auth0 = new Auth0Client(
       Object.assign(

__tests__/Auth0Client/loginWithRedirect.test.ts

@@ -109,17 +109,24 @@ describe('Auth0Client', () => {
 
       const url = new URL(mockWindow.location.assign.mock.calls[0][0]);
 
-      assertUrlEquals(url, TEST_DOMAIN, '/authorize', {
-        client_id: TEST_CLIENT_ID,
-        redirect_uri: TEST_REDIRECT_URI,
-        scope: TEST_SCOPES,
-        response_type: 'code',
-        response_mode: 'query',
-        state: TEST_STATE,
-        nonce: TEST_NONCE,
-        code_challenge: TEST_CODE_CHALLENGE,
-        code_challenge_method: 'S256'
-      });
+      assertUrlEquals(
+        url,
+        TEST_DOMAIN,
+        '/authorize',
+        {
+          auth0Client: expect.any(String),
+          client_id: TEST_CLIENT_ID,
+          redirect_uri: TEST_REDIRECT_URI,
+          scope: TEST_SCOPES,
+          response_type: 'code',
+          response_mode: 'query',
+          state: TEST_STATE,
+          nonce: TEST_NONCE,
+          code_challenge: TEST_CODE_CHALLENGE,
+          code_challenge_method: 'S256'
+        },
+        true // strict mode
+      );
 
       assertPost(
         'https://auth0_domain/oauth/token',
@@ -453,5 +460,46 @@ describe('Auth0Client', () => {
         }
       );
     });
+
+    it('should not include client options on the URL', async () => {
+      // ** IMPORTANT **: if adding a new client option, ensure it is added to the destructure
+      // list in Auth0Client._getParams so that it is not sent to the IdP
+      const auth0 = setup({
+        useRefreshTokens: true,
+        advancedOptions: {
+          defaultScope: 'openid profile email offline_access'
+        },
+        useCookiesForTransactions: true,
+        authorizeTimeoutInSeconds: 10,
+        cacheLocation: 'localstorage',
+        legacySameSiteCookie: true,
+        nowProvider: () => Date.now(),
+        sessionCheckExpiryDays: 1,
+        useFormData: true
+      });
+
+      await loginWithRedirect(auth0);
+
+      const url = new URL(mockWindow.location.assign.mock.calls[0][0]);
+
+      assertUrlEquals(
+        url,
+        TEST_DOMAIN,
+        '/authorize',
+        {
+          auth0Client: expect.any(String),
+          client_id: TEST_CLIENT_ID,
+          redirect_uri: TEST_REDIRECT_URI,
+          scope: 'openid profile email offline_access',
+          response_type: 'code',
+          response_mode: 'query',
+          state: TEST_STATE,
+          nonce: TEST_NONCE,
+          code_challenge: TEST_CODE_CHALLENGE,
+          code_challenge_method: 'S256'
+        },
+        true // strict mode
+      );
+    });
   });
 });

src/Auth0Client.ts

@@ -309,21 +309,28 @@ export default class Auth0Client {
     code_challenge: string,
     redirect_uri: string
   ): AuthorizeOptions {
+    // These options should be excluded from the authorize URL,
+    // as they're options for the client and not for the IdP.
+    // ** IMPORTANT ** If adding a new client option, include it in this destructure list.
     const {
-      domain,
-      leeway,
       useRefreshTokens,
       useCookiesForTransactions,
       useFormData,
       auth0Client,
       cacheLocation,
       advancedOptions,
       detailedResponse,
-      ...withoutClientOptions
+      nowProvider,
+      authorizeTimeoutInSeconds,
+      legacySameSiteCookie,
+      sessionCheckExpiryDays,
+      domain,
+      leeway,
+      ...loginOptions
     } = this.options;
 
     return {
-      ...withoutClientOptions,
+      ...loginOptions,
       ...authorizeOptions,
       scope: getUniqueScopes(
         this.defaultScope,
@@ -339,6 +346,7 @@ export default class Auth0Client {
       code_challenge_method: 'S256'
     };
   }
+
   private _authorizeUrl(authorizeOptions: AuthorizeOptions) {
     return this._url(`/authorize?${createQueryParams(authorizeOptions)}`);
   }

tsconfig.test.json

@@ -1,6 +1,7 @@
 {
   "extends": "./tsconfig.json",
   "compilerOptions": {
-    "noImplicitAny": false
+    "noImplicitAny": false,
+    "target": "es6"
   }
 }