@fastify/cookie 11.0.0 → 11.0.2

package/.github/workflows/ci.yml

@@ -17,7 +17,7 @@ on:
 
 jobs:
   test:
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v5.0.0
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v5
     with:
       license-check: true
       lint: true

package/README.md

@@ -1,32 +1,35 @@
 # @fastify/cookie
 
-![CI](https://github.com/fastify/fastify-cookie/workflows/CI/badge.svg)
+[![CI](https://github.com/fastify/fastify-cookie/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/fastify/fastify-cookie/actions/workflows/ci.yml)
 [![NPM version](https://img.shields.io/npm/v/@fastify/cookie.svg?style=flat)](https://www.npmjs.com/package/@fastify/cookie)
-[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat)](https://standardjs.com/)
+[![neostandard javascript style](https://img.shields.io/badge/code_style-neostandard-brightgreen?style=flat)](https://github.com/neostandard/neostandard)
 
 A plugin for [Fastify](http://fastify.dev/) that adds support for reading and
 setting cookies.
 
 This plugin's cookie parsing works via Fastify's `onRequest` hook. Therefore,
-you should register it prior to any other `onRequest` hooks that will depend
+you should register it before any other `onRequest` hooks that will depend
 upon this plugin's actions.
 
 It is also possible to [import the low-level cookie parsing and serialization functions](#importing-serialize-and-parse).
 
-`@fastify/cookie` [v2.x](https://github.com/fastify/fastify-cookie/tree/v2.x)
-supports both Fastify@1 and Fastify@2.
-`@fastify/cookie` v3 only supports Fastify@2.
-
-## Installation
+## Install
 ```sh
 npm i @fastify/cookie
 ```
 
-or
+### Compatibility
+| Plugin version | Fastify version |
+| ---------------|-----------------|
+| `^10.x`        | `^5.x`          |
+| `^7.x`         | `^4.x`          |
+| `^4.x`         | `^3.x`          |
+| `^2.x`         | `^2.x`          |
+| `^1.x`         | `^1.x`          |
 
-```sh
-yarn add @fastify/cookie
-```
+Please note that if a Fastify version is out of support, then so are the corresponding versions of this plugin
+in the table above.
+See [Fastify's LTS policy](https://github.com/fastify/fastify/blob/main/docs/Reference/LTS.md) for more details.
 
 ## Example
 
@@ -115,7 +118,7 @@ domain is set, and most clients will consider the cookie to apply to only the cu
 
 ##### encode
 
-Specifies a function that will be used to encode a cookie's value. Since value of a cookie
+Specifies a function that will be used to encode a cookie's value. Since the value of a cookie
 has a limited character set (and must be a simple string), this function can be used to encode
 a value into a string suited for a cookie's value.
 
@@ -129,13 +132,13 @@ By default, no expiration is set, and most clients will consider this a "non-per
 will delete it on a condition like exiting a web browser application.
 
 **Note:** the [cookie storage model specification](https://datatracker.ietf.org/doc/html/rfc6265#section-5.3) states that if both `expires` and
-`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients by obey this,
+`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients obey this,
 so if both are set, they should point to the same date and time.
 
 ##### httpOnly
 
 Specifies the `boolean` value for the [`HttpOnly` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.6). When truthy,
-the `HttpOnly` attribute is set, otherwise it is not. By default, the `HttpOnly` attribute is not set.
+the `HttpOnly` attribute is set, otherwise, it is not. By default, the `HttpOnly` attribute is not set.
 
 **Note:** be careful when setting this to `true`, as compliant clients will not allow client-side
 JavaScript to see the cookie in `document.cookie`.
@@ -146,7 +149,7 @@ Specifies the `number` (in seconds) to be the value for the [`Max-Age` `Set-Cook
 The given number will be converted to an integer by rounding down. By default, no maximum age is set.
 
 **Note:** the [cookie storage model specification](https://datatracker.ietf.org/doc/html/rfc6265#section-5.3) states that if both `expires` and
-`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients by obey this,
+`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients obey this,
 so if both are set, they should point to the same date and time.
 
 ##### partitioned
@@ -157,7 +160,7 @@ attribute. When truthy, the `Partitioned` attribute is set, otherwise it is not.
 
 ⚠️ **Warning:** [This is an attribute that has not yet been fully standardized](https://github.com/fastify/fastify-cookie/pull/261#issuecomment-1803234334), and may change in the future without reflecting the semver versioning. This also means many clients may ignore the attribute until they understand it.
 
-More information about can be found in [the proposal](https://github.com/privacycg/CHIPS).
+More information about this can be found in [the proposal](https://github.com/privacycg/CHIPS).
 
 
 ##### priority
@@ -197,7 +200,7 @@ This also means many clients may ignore this attribute until they understand it.
 ##### secure
 
 Specifies the `boolean` value for the [`Secure` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.5). When truthy,
-the `Secure` attribute is set, otherwise it is not. By default, the `Secure` attribute is not set.
+the `Secure` attribute is set, otherwise, it is not. By default, the `Secure` attribute is not set.
 
 **Note:** be careful when setting this to `true`, as compliant clients will not send the cookie back to
 the server in the future if the browser does not have an HTTPS connection.
@@ -231,9 +234,9 @@ with a value of `'foo'` on the cookie path `/`.
 Following are _some_ of the precautions that should be taken to ensure the integrity of an application:
 
 - It's important to use `options.httpOnly` cookies to prevent attacks like XSS.
-- Use signed cookies (`options.signed`) to ensure they are not getting tampered with on client-side by an attacker.
+- Use signed cookies (`options.signed`) to ensure they are not getting tampered wit client-side by an attacker.
 - Use `__Host-` [Cookie Prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Attributes) to avoid Cookie Tossing attacks.
-- it's important to [use HTTPS for your website/app](https://letsencrypt.org/) to avoid a bunch of other potential security issues like [MITM](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) etc.
+- It is important to [use HTTPS for your website/app](https://letsencrypt.org/) to avoid a bunch of other potential security issues like [MITM](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) etc.
 
 ### Clearing
 
@@ -244,7 +247,7 @@ on the cookie path `/`.
 
 + `name`: a string name for the cookie to be cleared
 + `options`: an options object as described in the [cookie serialize][cs]
-documentation. Its optional to pass `options` object
+documentation. It is optional to pass an `options` object
 
 ### Manual cookie parsing
 
@@ -279,7 +282,7 @@ fastify.get('/', (req, reply) => {
   const result = reply.unsignCookie(req.cookies.myCookie)
 
   if (result.valid && result.renew) {
-    // Setting the same cookie again, this time plugin will sign it with a new key
+    // Setting the same cookie again, this time the plugin will sign it with a new key
     reply.setCookie('myCookie', result.value, {
       domain: 'example.com', // same options as before
       path: '/',
@@ -317,8 +320,8 @@ fastify.register(require('@fastify/cookie'), {
 ### Manual cookie unsigning
 
 The method `unsignCookie(value)` is added to the `fastify` instance, to the `request` and the `reply` object
-via the Fastify `decorate`, `decorateRequest` and `decorateReply` APIs, if a secret was provided as option.
-Using it on a signed cookie will call the the provided signer's (or the default signer if no custom implementation is provided) `unsign` method on the cookie.
+via the Fastify `decorate`, `decorateRequest`, and `decorateReply` APIs, if a secret was provided as an option.
+Using it on a signed cookie will call the provided signer's (or the default signer if no custom implementation is provided) `unsign` method on the cookie.
 
 **Example:**
 
@@ -358,9 +361,9 @@ test('Request requires signed cookie', async () => {
 });
 ```
 
-### Manual signing/unsigning with low level utilities
+### Manual signing/unsigning with low-level utilities
 
-with Signer
+With Signer:
 
 ```js
 const { Signer } = require('@fastify/cookie');
@@ -370,7 +373,7 @@ const signedValue = signer.sign('test');
 const {valid, renew, value } = signer.unsign(signedValue);
 ```
 
-with sign/unsign utilities
+With sign/unsign utilities:
 
 ```js
 const { fastifyCookie } = require('@fastify/cookie');
@@ -382,4 +385,4 @@ const unsignedvalue = fastifyCookie.unsign(signedValue, 'secret');
 
 ## License
 
-[MIT License](http://jsumners.mit-license.org/)
+Licensed under [MIT](./LICENSE).

package/benchmark/cookie-multi.js

@@ -8,7 +8,7 @@ const secret = 'testsecret'
 const fastify = Fastify()
 fastify.register(plugin, { secret })
 
-fastify.get('/', (req, reply) => {
+fastify.get('/', (_req, reply) => {
   reply
     .setCookie('foo', 'foo')
     .setCookie('foo', 'foo', { path: '/1' })

package/benchmark/cookie.js

@@ -8,7 +8,7 @@ const secret = 'testsecret'
 const fastify = Fastify()
 fastify.register(plugin, { secret })
 
-fastify.get('/', (req, reply) => {
+fastify.get('/', (_req, reply) => {
   reply
     .setCookie('foo', 'foo', { path: '/' })
     .send({ hello: 'world' })

package/eslint.config.js

@@ -0,0 +1,6 @@
+'use strict'
+
+module.exports = require('neostandard')({
+  ignores: require('neostandard').resolveIgnoresFromGitignore(),
+  ts: true
+})

package/package.json

@@ -1,18 +1,17 @@
 {
   "name": "@fastify/cookie",
-  "version": "11.0.0",
+  "version": "11.0.2",
   "description": "Plugin for fastify to add support for cookies",
   "main": "plugin.js",
   "type": "commonjs",
   "types": "types/plugin.d.ts",
   "scripts": {
     "coverage": "npm run test:unit -- --coverage-report=html",
-    "lint": "standard | snazzy",
-    "lint:ci": "standard",
-    "lint:fix": "standard --fix",
+    "lint": "eslint",
+    "lint:fix": "eslint --fix",
     "test": "npm run test:unit && npm run test:typescript",
     "test:typescript": "tsd",
-    "test:unit": "tap",
+    "test:unit": "c8 --100 node --test",
     "test:unit:verbose": "npm run test:unit -- -Rspec"
   },
   "precommit": [
@@ -32,6 +31,19 @@
     {
       "name": "Salman Mitha",
       "email": "SalmanMitha@gmail.com"
+    },
+    {
+      "name": "Matteo Collina",
+      "email": "hello@matteocollina.com"
+    },
+    {
+      "name": "Manuel Spigolon",
+      "email": "behemoth89@gmail.com"
+    },
+    {
+      "name": "Frazer Smith",
+      "email": "frazer.dev@icloud.com",
+      "url": "https://github.com/fdawgs"
     }
   ],
   "license": "MIT",
@@ -39,20 +51,29 @@
     "url": "https://github.com/fastify/fastify-cookie/issues"
   },
   "homepage": "https://github.com/fastify/fastify-cookie#readme",
+  "funding": [
+    {
+      "type": "github",
+      "url": "https://github.com/sponsors/fastify"
+    },
+    {
+      "type": "opencollective",
+      "url": "https://opencollective.com/fastify"
+    }
+  ],
   "devDependencies": {
     "@fastify/pre-commit": "^2.1.0",
     "@types/node": "^22.0.0",
     "benchmark": "^2.1.4",
+    "c8": "^10.1.2",
+    "eslint": "^9.17.0",
     "fastify": "^5.0.0",
+    "neostandard": "^0.12.0",
     "sinon": "^19.0.2",
-    "snazzy": "^9.0.0",
-    "standard": "^17.1.0",
-    "tap": "^18.6.1",
     "tsd": "^0.31.1"
   },
   "dependencies": {
     "cookie": "^1.0.0",
-    "cookie-signature": "^1.2.1",
     "fastify-plugin": "^5.0.0"
   },
   "tsd": {

package/plugin.js

@@ -59,7 +59,7 @@ function parseCookies (fastify, request, reply) {
 
 function onReqHandlerWrapper (fastify, hook) {
   return hook === 'preParsing'
-    ? function fastifyCookieHandler (fastifyReq, fastifyRes, payload, done) {
+    ? function fastifyCookieHandler (fastifyReq, fastifyRes, _payload, done) {
       parseCookies(fastify, fastifyReq, fastifyRes)
       done()
     }
@@ -98,7 +98,7 @@ function setCookies (reply) {
   reply[kReplySetCookies].clear()
 }
 
-function fastifyCookieOnSendHandler (fastifyReq, fastifyRes, payload, done) {
+function fastifyCookieOnSendHandler (_fastifyReq, fastifyRes, _payload, done) {
   if (!fastifyRes[kReplySetCookies]) {
     done()
     return

package/signer.js

@@ -36,7 +36,7 @@ function validateAlgorithm (algorithm) {
   // validate that the algorithm is supported by the node runtime
   try {
     crypto.createHmac(algorithm, crypto.randomBytes(16))
-  } catch (e) {
+  } catch {
     throw new TypeError(`Algorithm ${algorithm} not supported.`)
   }
 }