diff --git a/plugins/auth-backend/src/lib/flow/authFlowHelpers.ts b/plugins/auth-backend/src/lib/flow/authFlowHelpers.ts
index 94ac4fba15..2f1770a3d4 100644
--- a/plugins/auth-backend/src/lib/flow/authFlowHelpers.ts
+++ b/plugins/auth-backend/src/lib/flow/authFlowHelpers.ts
@@ -24,7 +24,10 @@ export const safelyEncodeURIComponent = (value: string) => {
return encodeURIComponent(value).replace(/'/g, '%27');
};
-/** @public */
+/**
+ * @public
+ * @deprecated Use `sendWebMessageResponse` from `@backstage/plugin-auth-node` instead
+ */
export const postMessageResponse = (
res: express.Response,
appOrigin: string,
@@ -69,7 +72,10 @@ export const postMessageResponse = (
res.end(``);
};
-/** @public */
+/**
+ * @public
+ * @deprecated Use inline logic to check that the `X-Requested-With` header is set to `'XMLHttpRequest'` instead.
+ */
export const ensuresXRequestedWith = (req: express.Request) => {
const requiredHeader = req.header('X-Requested-With');
if (!requiredHeader || requiredHeader !== 'XMLHttpRequest') {
diff --git a/plugins/auth-backend/src/lib/flow/types.ts b/plugins/auth-backend/src/lib/flow/types.ts
index f67198a1b0..36f3033b21 100644
--- a/plugins/auth-backend/src/lib/flow/types.ts
+++ b/plugins/auth-backend/src/lib/flow/types.ts
@@ -14,20 +14,10 @@
* limitations under the License.
*/
-import { AuthResponse } from '../../providers/types';
+import { WebMessageResponse as _WebMessageResponse } from '@backstage/plugin-auth-node';
/**
- * Payload sent as a post message after the auth request is complete.
- * If successful then has a valid payload with Auth information else contains an error.
- *
* @public
+ * @deprecated import from `@backstage/plugin-auth-node` instead
*/
-export type WebMessageResponse =
- | {
- type: 'authorization_response';
- response: AuthResponse;
- }
- | {
- type: 'authorization_response';
- error: Error;
- };
+export type WebMessageResponse = _WebMessageResponse;
diff --git a/plugins/auth-backend/src/lib/oauth/helpers.ts b/plugins/auth-backend/src/lib/oauth/helpers.ts
index 2b4e50b477..5e67b072e3 100644
--- a/plugins/auth-backend/src/lib/oauth/helpers.ts
+++ b/plugins/auth-backend/src/lib/oauth/helpers.ts
@@ -16,36 +16,28 @@
import express from 'express';
import { OAuthState } from './types';
-import pickBy from 'lodash/pickBy';
import { CookieConfigurer } from '../../providers/types';
+import {
+ decodeOAuthState,
+ encodeOAuthState,
+} from '@backstage/plugin-auth-node';
-/** @public */
-export const readState = (stateString: string): OAuthState => {
- const state = Object.fromEntries(
- new URLSearchParams(Buffer.from(stateString, 'hex').toString('utf-8')),
- );
- if (
- !state.nonce ||
- !state.env ||
- state.nonce?.length === 0 ||
- state.env?.length === 0
- ) {
- throw Error(`Invalid state passed via request`);
- }
+/**
+ * @public
+ * @deprecated Use `decodeOAuthState` from `@backstage/plugin-auth-node` instead
+ */
+export const readState = decodeOAuthState;
- return state as OAuthState;
-};
+/**
+ * @public
+ * @deprecated Use `encodeOAuthState` from `@backstage/plugin-auth-node` instead
+ */
+export const encodeState = encodeOAuthState;
-/** @public */
-export const encodeState = (state: OAuthState): string => {
- const stateString = new URLSearchParams(
- pickBy(state, value => value !== undefined),
- ).toString();
-
- return Buffer.from(stateString, 'utf-8').toString('hex');
-};
-
-/** @public */
+/**
+ * @public
+ * @deprecated Use inline logic to make sure the session and state nonce matches instead.
+ */
export const verifyNonce = (req: express.Request, providerId: string) => {
const cookieNonce = req.cookies[`${providerId}-nonce`];
const state: OAuthState = readState(req.query.state?.toString() ?? '');