fix(auth0-server-js): align connection-token cache read with loginHint and forward verified iss on backchannel logout

[Piyush-85]

Summary

• Connection-token cache read (loginHint predicate): getAccessTokenForConnection was matching cached entries by connection alone, ignoring loginHint. A multi-account user with two Google tokens (e.g. work@ and personal@) would always receive the first cached entry regardless of which account was requested. The read predicate now mirrors the write predicate exactly: connection && (!loginHint || tokenSet.loginHint === loginHint). Single-account callers (no loginHint) are unchanged.

• Backchannel logout iss forwarding (resolver mode): The resolver path was overwriting logoutTokenClaims.iss with the unverified decodeIssuer result. Now it prefers the verified iss already present on logoutTokenClaims (logoutTokenClaims.iss ?? issuer), falling back to the decoded value only when absent. The static path already passes logoutTokenClaims directly — once @auth0/auth0-auth-js ships verifyLogoutToken returning iss, both paths automatically forward the verified issuer to deleteByLogoutToken, enabling cross-issuer session isolation (shared signing key scenario).

Test plan

• getAccessTokenForConnection - multi-account: returns the loginHint-matching entry, not the first
• getAccessTokenForConnection - no-hint call: still hits cache without a network exchange
• getAccessTokenForConnection - miss on loginHint: falls through to a fresh exchange and appends a new entry
• handleBackchannelLogout - static mode updated: asserts iss is now forwarded
• handleBackchannelLogout - cross-issuer isolation: only the matching-issuer session is deleted when iss differs
• handleBackchannelLogout - backward compatibility: a store ignoring iss still deletes by sub/sid
• npm test in packages/auth0-server-js — 512 pass, 0 fail

[coderabbitai]

Warning

Review limit reached

Next included review available in 39 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 760fbdf4-433e-4732-885d-15af72b0f105

📥 Commits

Reviewing files that changed from the base of the PR and between e8de286 and c6308ad.

📒 Files selected for processing (2)

• packages/auth0-server-js/src/server-client.spec.ts
• packages/auth0-server-js/src/server-client.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}