[Tony133]

Proposal:

Two small fixes, both with tests.

• Default cookie path to / (Invalid state with Github provider (err 500) #255)
  The state and PKCE verifier cookies were set without a path, so browsers applied the default-path rule (RFC 6265 §5.1.4): with startRedirectPath: '/login/github' the cookie got Path=/login and was never sent to a callback like /api/auth/github/callback, ending in Invalid state. With /github it happened to get Path=/ and worked, which is exactly what the reporter observed. Now path: '/' is part of the defaults, still overridable through options.cookie; __Host- handling is unchanged. This was very likely also behind "Invalid State" Error in GitHub OAuth2 #295.

• tokenRequestParams on refresh (tokenRequestParams should be passed into OAuth2Token#refresh #292)
  They were only merged into the authorization code exchange. Providers that need client_id/client_secret in the body (Twitch, LinkedIn) failed on getNewAccessTokenUsingRefreshToken unless the caller passed them again by hand. They're now merged into the refresh request too, with explicit params taking precedence.

README updated for both changes.

Upgrade note: cookies set by previous versions may still carry a narrower Path. A user who left a login flow half-way before the upgrade may hit Invalid state until that session cookie expires.

Fixes #255
Fixes #292

[Copilot]

Copilot review overview

🟡 Changes recommended

Direct OAuth2Token.refresh() calls still omit configured tokenRequestParams, leaving part of issue #292 unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Apply tokenRequestParams defaults to refreshes on returned access tokens · New

What changed in this PR

Defaults OAuth cookies to Path=/ and applies configured token parameters during helper-based refreshes.

Changes:

• Adds root-path cookie defaults and documentation.
• Merges tokenRequestParams into refresh helper requests.
• Adds regression tests.

File	Description
index.js	Updates cookie defaults and refresh parameters.
test/​index.test.js	Adds regression coverage.
README.md	Documents the cookie path default.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.