fix: add explicit security options to OAuth cookies to prevent state mismatch errors

[bisand]

Fix: Add proper security options to OAuth state and PKCE cookies

The Problem
The OAuth state and PKCE verifier cookies were being set without any explicit options, which caused two main issues:

Security vulnerabilities:

• Cookies were accessible to JavaScript (XSS risk)
• Cookies could be sent over HTTP (man-in-the-middle risk)
• No CSRF protection

Browser compatibility:

• Modern browsers have started enforcing stricter cookie policies by default
• Without explicit sameSite settings, some browsers drop cookies during OAuth redirects
• This caused "state mismatch" errors, especially with providers like Okta

What This PR Does:

Adds explicit cookie security options to both handleState() and handlePkceVerifier():

setCookie(event, 'nuxt-auth-state', state, {
  httpOnly: true,
  secure: process.env.NODE_ENV !== 'development',
  sameSite: 'lax',
  maxAge: 60 * 10, // 10 minutes
  path: '/',
})

Why these specific options:

• httpOnly: true - Prevents JavaScript access, blocks XSS attacks
• secure: true in production - HTTPS only when it matters
• sameSite: 'lax' - Allows cookies during OAuth redirects while preventing CSRF
• maxAge: 600 - OAuth flows should complete within 10 minutes
• path: '/' - Available across the entire application

Impact

This affects all OAuth providers in the library (GitHub, Google, Microsoft, Azure B2C, Okta, Auth0, Keycloak, etc.) since they all use these utility functions.

No breaking changes - the functions work exactly the same, just more securely.

Why !== 'development' instead of === 'production'
Using the negative check means if NODE_ENV is undefined or misspelled, cookies default to secure mode. Better to have secure cookies break local dev (easy to fix) than accidentally ship insecure cookies to production.

Testing
Tested OAuth flows with several providers in both dev and production modes. The state mismatch errors are gone, and cookies are properly secured.

[Copilot]

Pull Request Overview

This PR fixes OAuth security vulnerabilities and browser compatibility issues by adding explicit security options to OAuth state and PKCE verifier cookies. The changes prevent state mismatch errors that were occurring with modern browsers, particularly with providers like Okta.

Key changes:

• Added comprehensive cookie security options to handlePkceVerifier() and handleState() functions
• Implemented httpOnly, secure, sameSite, maxAge, and path options for both OAuth cookies
• Used environment-based secure flag configuration for development vs production

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/atinux/nuxt-auth-utils@463

commit: 8f9134e