[harsh62]

Part 13 of 14 of the auth-unification stack (open parts: #851–#863) · stacked on auth/stack-12-cutover (part 12, #861) · the stack is based on main @ dea4ca20, and part 01 (#850) is merged into main as 48c35f64 · next: #863 · reference PR #711 (closed) held the whole change in one commit.
Merge bottom to top. When the PR below merges, GitHub retargets this one to main.

Problem

A browser sign-in client for a web app on a different origin than its API (L69, decided by the maintainer: build it, as its own PR).

Issue #, if available: see #711

Changes

• createAuthClient() from @aws-blocks/bb-auth/browser-client, also re-exported from @aws-blocks/blocks/ui. Its methods are named after Amplify JS v6: signInWithRedirect, handleSignInRedirect, getCurrentUser, fetchAuthSession, signOut.
• It reuses the native relay flow, with the existing redirect allowlist, PKCE, the nonce and single-use state. Tokens never reach JavaScript or a URL; the session stays in the block's HttpOnly cookie.
• The client trims trailing slashes from its base URL with a linear scan, not a regex (CodeQL's ReDoS alert).
• Two additive routes, mounted only with the federation routes: GET …/session, and JSON from sign-out.
• Docs: the README section Frontend on a different origin, a threat model in DESIGN.md, and MIGRATION.md for AuthOIDC's getClient().

What to review closely: Open: L79. After a provider-side sign-out, the provider returns to the API's origin, not the frontend's. Not yet run against real Cognito managed login.

Validation

Re-cut onto main @ dea4ca20. This branch passed on its own, from a fresh npm ci:

• npm ci
• build
• changeset-guard: its tests and all four checks
• comprehensive's tsc --noEmit
• every test app's tsc --noEmit, matching main's baseline: the same five apps fail as on main (amplify-gen2, extending-blocks-guide, hosting-ssr-nuxt, hosting-ssr-sveltekit, native-bindings), and no other

Part 12's tree, which is the whole stack apart from the stack doc, also passed build, update:api, the fixture regeneration and the live auth-spec check with zero drift, comprehensive's tsc --noEmit, and npm test: 8,857 passed, 0 failed.

An earlier tree of the full stack passed end to end on AWS, on new stacks that were destroyed afterwards: upgrade-in-place from AuthCognito, comprehensive sandbox and production, hosting, native, and the CloudFront front door (see #711). That run came before the later merges of main (#824's synth guards, #797's Swift Blocks entry point, #834's template metadata, #835/#837's native opt-out warnings, #841, #749, #819 and dependency bumps, then #208's submitAuthAction, #807's Swift typed declared-binding results, #637's config-bucket hardening and more dependency bumps, then #736's per-namespace RPC paths, #574's ComputeBase, #910's native escaping, #704's Kotlin Blocks entry point, #907's Next.js 16, #927's hosting security headers and more, then #1042's sandbox-only stub IdP and getDeploymentType(), #1032's fail-closed mock entries, #510's swappable hosting front doors, #949, #827, #948's per-namespace compute and more, then this round's #1024, #1050, #1027's apiWaf, #1076, #962, #902's typed OIDCClient, #674 and more) and before the #856 review fixes.

The bench / summary check is not a required check. It currently fails repo-wide, on unrelated PRs too, because of runner isolation.

Checklist

• PR description included
• Tests are changed or added
• Relevant documentation is changed or added (and PR referenced)

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[changeset-bot]

🦋 Changeset detected

Latest commit: 7b2fbb8

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@aws-blocks/bb-auth	Minor
@aws-blocks/blocks	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[changeset-bot]

🦋 Changeset detected

Latest commit: 260decf

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@aws-blocks/bb-auth	Minor
@aws-blocks/blocks	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[harsh62]

CodeQL alerts on this PR (part 13)

#101 js/polynomial-redos, packages/bb-auth/src/browser-client.ts:233. Fixed. createAuthClient trimmed baseUrl with /\/+$/. That backtracks quadratically on a long run of / followed by another character. It now uses withoutTrailingSlashes(), a linear scan from the end. Test: browser-client.test.ts, "every trailing slash of baseUrl is dropped, in linear time however many there are". It uses 100,000 slashes, then x, then three slashes. It asserts the exact request URL, and a time within 10x of the same call with a short URL on the same machine (at least 250 ms). The old regex takes several seconds at that length. The scan takes about a millisecond.

Commit: e918608a