Advisories for Npm/Express-Openid-Connect package

Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the requiresAuth middleware, either directly or through the default authRequired option, is vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under example.com are protected with the requiresAuth middleware, a visit to http://example.com//google.com will be redirected to google.com after login because …

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. It does not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities.