fix: reject invalid nonce format instead of silently regenerating

Old cached URLs with standard base64 nonces (containing = padding)
are now rejected with a clear error message instead of silently
regenerating. This maintains the integrity of signed form data.

Users with old cached authentication URLs will see:
"Invalid nonce format. Please generate a new authentication URL."

Author: andris9

lib/routes-ui.js

@@ -4433,10 +4433,13 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
             // throws if invalid or unknown app ID
             const oAuth2Client = await oauth2Apps.getClient(oauth2App.id);
 
-            // Validate nonce format (base64url, 21-22 chars) or generate new one
-            // This handles old cached URLs that may have standard base64 nonces
-            const isValidNonce = data.n && /^[A-Za-z0-9_-]{21,22}$/.test(data.n);
-            const nonce = isValidNonce ? data.n : crypto.randomBytes(NONCE_BYTES).toString('base64url');
+            const nonce = data.n || crypto.randomBytes(NONCE_BYTES).toString('base64url');
+
+            // Validate nonce format (base64url, 21-22 chars)
+            if (!/^[A-Za-z0-9_-]{21,22}$/.test(nonce)) {
+                let error = Boom.boomify(new Error('Invalid nonce format. Please generate a new authentication URL.'), { statusCode: 400 });
+                throw error;
+            }
 
             // store account data with atomic SET + EX
             await redis.set(`${REDIS_PREFIX}account:add:${nonce}`, JSON.stringify(accountData), 'EX', Math.floor(MAX_FORM_TTL / 1000));

lib/ui-routes/account-routes.js

@@ -518,10 +518,13 @@ function init(args) {
             // throws if invalid or unknown app ID
             const oAuth2Client = await oauth2Apps.getClient(oauth2App.id);
 
-            // Validate nonce format (base64url, 21-22 chars) or generate new one
-            // This handles old cached URLs that may have standard base64 nonces
-            const isValidNonce = data.n && /^[A-Za-z0-9_-]{21,22}$/.test(data.n);
-            const nonce = isValidNonce ? data.n : crypto.randomBytes(NONCE_BYTES).toString('base64url');
+            const nonce = data.n || crypto.randomBytes(NONCE_BYTES).toString('base64url');
+
+            // Validate nonce format (base64url, 21-22 chars)
+            if (!/^[A-Za-z0-9_-]{21,22}$/.test(nonce)) {
+                let error = Boom.boomify(new Error('Invalid nonce format. Please generate a new authentication URL.'), { statusCode: 400 });
+                throw error;
+            }
 
             // store account data with atomic SET + EX
             await redis.set(`${REDIS_PREFIX}account:add:${nonce}`, JSON.stringify(accountData), 'EX', Math.floor(MAX_FORM_TTL / 1000));

test/oauth-nonce-test.js

@@ -97,26 +97,26 @@ test('OAuth nonce encoding tests', async t => {
         assert.strictEqual(incorrectUsages.length, 0, `Found NONCE_BYTES with incorrect encoding:\n${incorrectUsages.join('\n')}`);
     });
 
-    await t.test('nonce validation pattern used where data.n is consumed', async () => {
-        // Verify that files using data.n validate the format before using it
-        // This prevents old cached URLs with base64 nonces from causing errors
-        const filesToCheck = [
-            { file: 'lib/routes-ui.js', pattern: /isValidNonce.*data\.n.*test\(data\.n\)/ },
-            { file: 'lib/ui-routes/account-routes.js', pattern: /isValidNonce.*data\.n.*test\(data\.n\)/ }
-        ];
+    await t.test('nonce validation with error for invalid format', async () => {
+        // Verify that files using data.n validate the format and throw error if invalid
+        // This rejects old cached URLs with standard base64 nonces
+        const filesToCheck = ['lib/routes-ui.js', 'lib/ui-routes/account-routes.js'];
+
+        // Pattern: validates nonce and throws Boom error for invalid format
+        const validationPattern = /if.*!.*test\(nonce\).*\{[\s\S]*?Boom\.boomify.*Invalid nonce format/;
 
         const missingValidation = [];
 
-        for (const { file, pattern } of filesToCheck) {
+        for (const file of filesToCheck) {
             const filePath = path.join(__dirname, '..', file);
             if (fs.existsSync(filePath)) {
                 const content = fs.readFileSync(filePath, 'utf8');
-                if (!pattern.test(content)) {
-                    missingValidation.push(`${file}: missing nonce validation pattern`);
+                if (!validationPattern.test(content)) {
+                    missingValidation.push(`${file}: missing nonce validation with error`);
                 }
             }
         }
 
-        assert.strictEqual(missingValidation.length, 0, `Files using data.n must validate nonce format:\n${missingValidation.join('\n')}`);
+        assert.strictEqual(missingValidation.length, 0, `Files using data.n must validate and reject invalid nonces:\n${missingValidation.join('\n')}`);
     });
 });