@fastify/cookie 11.0.1 → 11.1.0

package/.github/dependabot.yml

@@ -2,12 +2,52 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
     open-pull-requests-limit: 10
 
   - package-ecosystem: "npm"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+    versioning-strategy: "increase-if-necessary"
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+    ignore:
+      # TODO: remove ignore until neostandard support ESLint 10
+      - dependency-name: "eslint"
+      - dependency-name: "neostandard"
+      - dependency-name: "@stylistic/*"
     open-pull-requests-limit: 10
+    groups:
+      # Production dependencies with breaking changes
+      dependencies:
+        dependency-type: "production"
+      # ESLint related dependencies
+      dev-dependencies-eslint:
+        patterns:
+          - "eslint"
+          - "neostandard"
+          - "@stylistic/*"
+      # TypeScript related dependencies
+      dev-dependencies-typescript:
+        patterns:
+          - "@types/*"
+          - "tstyche"
+          - "typescript"

package/.github/workflows/ci.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
      - main
-     - master
      - next
      - 'v*'
     paths-ignore:
@@ -15,9 +14,20 @@ on:
       - 'docs/**'
       - '*.md'
 
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+    group: "${{ github.workflow }}-${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
+    cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   test:
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v5.0.0
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v6
     with:
       license-check: true
       lint: true

package/.github/workflows/lock-threads.yml

@@ -0,0 +1,19 @@
+name: Lock Threads
+
+on:
+  schedule:
+    - cron: '0 0 1 * *'
+  workflow_dispatch:
+
+concurrency:
+  group: lock
+
+permissions:
+  contents: read
+
+jobs:
+  lock-threads:
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@v6

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) Fastify
+Copyright (c) 2017-present The Fastify team <https://github.com/fastify/fastify#team>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,32 +1,35 @@
 # @fastify/cookie
 
-![CI](https://github.com/fastify/fastify-cookie/workflows/CI/badge.svg)
+[![CI](https://github.com/fastify/fastify-cookie/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/fastify/fastify-cookie/actions/workflows/ci.yml)
 [![NPM version](https://img.shields.io/npm/v/@fastify/cookie.svg?style=flat)](https://www.npmjs.com/package/@fastify/cookie)
-[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat)](https://standardjs.com/)
+[![neostandard javascript style](https://img.shields.io/badge/code_style-neostandard-brightgreen?style=flat)](https://github.com/neostandard/neostandard)
 
-A plugin for [Fastify](http://fastify.dev/) that adds support for reading and
+A plugin for [Fastify](https://fastify.dev/) that adds support for reading and
 setting cookies.
 
 This plugin's cookie parsing works via Fastify's `onRequest` hook. Therefore,
-you should register it prior to any other `onRequest` hooks that will depend
+you should register it before any other `onRequest` hooks that will depend
 upon this plugin's actions.
 
 It is also possible to [import the low-level cookie parsing and serialization functions](#importing-serialize-and-parse).
 
-`@fastify/cookie` [v2.x](https://github.com/fastify/fastify-cookie/tree/v2.x)
-supports both Fastify@1 and Fastify@2.
-`@fastify/cookie` v3 only supports Fastify@2.
-
-## Installation
+## Install
 ```sh
 npm i @fastify/cookie
 ```
 
-or
+### Compatibility
+| Plugin version | Fastify version |
+| ---------------|-----------------|
+| `>=10.x`       | `^5.x`          |
+| `>=7.x <10.x`  | `^4.x`          |
+| `>=4.x <7.x`   | `^3.x`          |
+| `>=2.x <4.x`   | `^2.x`          |
+| `^1.x`         | `^1.x`          |
 
-```sh
-yarn add @fastify/cookie
-```
+Please note that if a Fastify version is out of support, then so are the corresponding versions of this plugin
+in the table above.
+See [Fastify's LTS policy](https://github.com/fastify/fastify/blob/main/docs/Reference/LTS.md) for more details.
 
 ## Example
 
@@ -92,7 +95,7 @@ fastify.get('/', (req, reply) => {
 ## Options
 
 - `secret` (`String` | `Array` | `Buffer` | `Object`):
-  - A `String` or `Buffer` can be passed to use as secret to sign the cookie using [`cookie-signature`](http://npm.im/cookie-signature).
+  - A `String` or `Buffer` can be passed to use as secret to sign the cookie using [`cookie-signature`](https://www.npmjs.com/package/cookie-signature).
   - An `Array` can be passed if key rotation is desired. Read more about it in [Rotating signing secret](#rotating-secret).
   - More sophisticated cookie signing mechanisms can be implemented by supplying an `Object`. Read more about it in [Custom cookie signer](#custom-cookie-signer).
 
@@ -115,7 +118,7 @@ domain is set, and most clients will consider the cookie to apply to only the cu
 
 ##### encode
 
-Specifies a function that will be used to encode a cookie's value. Since value of a cookie
+Specifies a function that will be used to encode a cookie's value. Since the value of a cookie
 has a limited character set (and must be a simple string), this function can be used to encode
 a value into a string suited for a cookie's value.
 
@@ -129,13 +132,13 @@ By default, no expiration is set, and most clients will consider this a "non-per
 will delete it on a condition like exiting a web browser application.
 
 **Note:** the [cookie storage model specification](https://datatracker.ietf.org/doc/html/rfc6265#section-5.3) states that if both `expires` and
-`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients by obey this,
+`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients obey this,
 so if both are set, they should point to the same date and time.
 
 ##### httpOnly
 
 Specifies the `boolean` value for the [`HttpOnly` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.6). When truthy,
-the `HttpOnly` attribute is set, otherwise it is not. By default, the `HttpOnly` attribute is not set.
+the `HttpOnly` attribute is set, otherwise, it is not. By default, the `HttpOnly` attribute is not set.
 
 **Note:** be careful when setting this to `true`, as compliant clients will not allow client-side
 JavaScript to see the cookie in `document.cookie`.
@@ -146,7 +149,7 @@ Specifies the `number` (in seconds) to be the value for the [`Max-Age` `Set-Cook
 The given number will be converted to an integer by rounding down. By default, no maximum age is set.
 
 **Note:** the [cookie storage model specification](https://datatracker.ietf.org/doc/html/rfc6265#section-5.3) states that if both `expires` and
-`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients by obey this,
+`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients obey this,
 so if both are set, they should point to the same date and time.
 
 ##### partitioned
@@ -157,19 +160,19 @@ attribute. When truthy, the `Partitioned` attribute is set, otherwise it is not.
 
 ⚠️ **Warning:** [This is an attribute that has not yet been fully standardized](https://github.com/fastify/fastify-cookie/pull/261#issuecomment-1803234334), and may change in the future without reflecting the semver versioning. This also means many clients may ignore the attribute until they understand it.
 
-More information about can be found in [the proposal](https://github.com/privacycg/CHIPS).
+More information about this can be found in [the proposal](https://github.com/privacycg/CHIPS).
 
 
 ##### priority
 
-Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute](https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1).
+Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/draft-west-cookie-priority-00#section-4.1).
 
   - `'low'` will set the `Priority` attribute to `Low`.
   - `'medium'` will set the `Priority` attribute to `Medium`, the default priority when not set.
   - `'high'` will set the `Priority` attribute to `High`.
 
 More information about the different priority levels can be found in
-[the specification](https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1).
+[the specification](https://datatracker.ietf.org/doc/html/draft-west-cookie-priority-00#section-4.1).
 
 ⚠️ **Warning:** This is an attribute that has not yet been fully standardized, and may change in the future without reflecting the semver versioning. This also means many clients may ignore the attribute until they understand it.
 
@@ -197,7 +200,7 @@ This also means many clients may ignore this attribute until they understand it.
 ##### secure
 
 Specifies the `boolean` value for the [`Secure` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.5). When truthy,
-the `Secure` attribute is set, otherwise it is not. By default, the `Secure` attribute is not set.
+the `Secure` attribute is set, otherwise, it is not. By default, the `Secure` attribute is not set.
 
 **Note:** be careful when setting this to `true`, as compliant clients will not send the cookie back to
 the server in the future if the browser does not have an HTTPS connection.
@@ -231,9 +234,9 @@ with a value of `'foo'` on the cookie path `/`.
 Following are _some_ of the precautions that should be taken to ensure the integrity of an application:
 
 - It's important to use `options.httpOnly` cookies to prevent attacks like XSS.
-- Use signed cookies (`options.signed`) to ensure they are not getting tampered with on client-side by an attacker.
-- Use `__Host-` [Cookie Prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Attributes) to avoid Cookie Tossing attacks.
-- it's important to [use HTTPS for your website/app](https://letsencrypt.org/) to avoid a bunch of other potential security issues like [MITM](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) etc.
+- Use signed cookies (`options.signed`) to ensure they are not getting tampered wit client-side by an attacker.
+- Use `__Host-` [Cookie Prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#attributes) to avoid Cookie Tossing attacks.
+- It is important to [use HTTPS for your website/app](https://letsencrypt.org/) to avoid a bunch of other potential security issues like [MITM](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) etc.
 
 ### Clearing
 
@@ -244,7 +247,7 @@ on the cookie path `/`.
 
 + `name`: a string name for the cookie to be cleared
 + `options`: an options object as described in the [cookie serialize][cs]
-documentation. Its optional to pass `options` object
+documentation. It is optional to pass an `options` object
 
 ### Manual cookie parsing
 
@@ -279,7 +282,7 @@ fastify.get('/', (req, reply) => {
   const result = reply.unsignCookie(req.cookies.myCookie)
 
   if (result.valid && result.renew) {
-    // Setting the same cookie again, this time plugin will sign it with a new key
+    // Setting the same cookie again, this time the plugin will sign it with a new key
     reply.setCookie('myCookie', result.value, {
       domain: 'example.com', // same options as before
       path: '/',
@@ -317,8 +320,8 @@ fastify.register(require('@fastify/cookie'), {
 ### Manual cookie unsigning
 
 The method `unsignCookie(value)` is added to the `fastify` instance, to the `request` and the `reply` object
-via the Fastify `decorate`, `decorateRequest` and `decorateReply` APIs, if a secret was provided as option.
-Using it on a signed cookie will call the the provided signer's (or the default signer if no custom implementation is provided) `unsign` method on the cookie.
+via the Fastify `decorate`, `decorateRequest`, and `decorateReply` APIs, if a secret was provided as an option.
+Using it on a signed cookie will call the provided signer's (or the default signer if no custom implementation is provided) `unsign` method on the cookie.
 
 **Example:**
 
@@ -358,9 +361,9 @@ test('Request requires signed cookie', async () => {
 });
 ```
 
-### Manual signing/unsigning with low level utilities
+### Manual signing/unsigning with low-level utilities
 
-with Signer
+With Signer:
 
 ```js
 const { Signer } = require('@fastify/cookie');
@@ -370,7 +373,7 @@ const signedValue = signer.sign('test');
 const {valid, renew, value } = signer.unsign(signedValue);
 ```
 
-with sign/unsign utilities
+With sign/unsign utilities:
 
 ```js
 const { fastifyCookie } = require('@fastify/cookie');
@@ -382,4 +385,4 @@ const unsignedvalue = fastifyCookie.unsign(signedValue, 'secret');
 
 ## License
 
-[MIT License](http://jsumners.mit-license.org/)
+Licensed under [MIT](./LICENSE).

package/benchmark/cookie-multi.js

@@ -8,7 +8,7 @@ const secret = 'testsecret'
 const fastify = Fastify()
 fastify.register(plugin, { secret })
 
-fastify.get('/', (req, reply) => {
+fastify.get('/', (_req, reply) => {
   reply
     .setCookie('foo', 'foo')
     .setCookie('foo', 'foo', { path: '/1' })

package/benchmark/cookie.js

@@ -8,7 +8,7 @@ const secret = 'testsecret'
 const fastify = Fastify()
 fastify.register(plugin, { secret })
 
-fastify.get('/', (req, reply) => {
+fastify.get('/', (_req, reply) => {
   reply
     .setCookie('foo', 'foo', { path: '/' })
     .send({ hello: 'world' })

package/eslint.config.js

@@ -0,0 +1,6 @@
+'use strict'
+
+module.exports = require('neostandard')({
+  ignores: require('neostandard').resolveIgnoresFromGitignore(),
+  ts: true
+})

package/{plugin.js → index.js}

@@ -59,7 +59,7 @@ function parseCookies (fastify, request, reply) {
 
 function onReqHandlerWrapper (fastify, hook) {
   return hook === 'preParsing'
-    ? function fastifyCookieHandler (fastifyReq, fastifyRes, payload, done) {
+    ? function fastifyCookieHandler (fastifyReq, fastifyRes, _payload, done) {
       parseCookies(fastify, fastifyReq, fastifyRes)
       done()
     }
@@ -98,7 +98,7 @@ function setCookies (reply) {
   reply[kReplySetCookies].clear()
 }
 
-function fastifyCookieOnSendHandler (fastifyReq, fastifyRes, payload, done) {
+function fastifyCookieOnSendHandler (_fastifyReq, fastifyRes, _payload, done) {
   if (!fastifyRes[kReplySetCookies]) {
     done()
     return

package/package.json

@@ -1,27 +1,22 @@
 {
   "name": "@fastify/cookie",
-  "version": "11.0.1",
+  "version": "11.1.0",
   "description": "Plugin for fastify to add support for cookies",
-  "main": "plugin.js",
+  "main": "index.js",
   "type": "commonjs",
-  "types": "types/plugin.d.ts",
+  "types": "types/index.d.ts",
   "scripts": {
     "coverage": "npm run test:unit -- --coverage-report=html",
-    "lint": "standard | snazzy",
-    "lint:ci": "standard",
-    "lint:fix": "standard --fix",
+    "lint": "eslint",
+    "lint:fix": "eslint --fix",
     "test": "npm run test:unit && npm run test:typescript",
-    "test:typescript": "tsd",
-    "test:unit": "tap",
+    "test:typescript": "tstyche",
+    "test:unit": "c8 --100 node --test",
     "test:unit:verbose": "npm run test:unit -- -Rspec"
   },
-  "precommit": [
-    "lint",
-    "test"
-  ],
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@github.com/fastify/fastify-cookie.git"
+    "url": "git+https://github.com/fastify/fastify-cookie.git"
   },
   "keywords": [
     "fastify",
@@ -32,6 +27,19 @@
     {
       "name": "Salman Mitha",
       "email": "SalmanMitha@gmail.com"
+    },
+    {
+      "name": "Matteo Collina",
+      "email": "hello@matteocollina.com"
+    },
+    {
+      "name": "Manuel Spigolon",
+      "email": "behemoth89@gmail.com"
+    },
+    {
+      "name": "Frazer Smith",
+      "email": "frazer.dev@icloud.com",
+      "url": "https://github.com/fdawgs"
     }
   ],
   "license": "MIT",
@@ -39,23 +47,29 @@
     "url": "https://github.com/fastify/fastify-cookie/issues"
   },
   "homepage": "https://github.com/fastify/fastify-cookie#readme",
+  "funding": [
+    {
+      "type": "github",
+      "url": "https://github.com/sponsors/fastify"
+    },
+    {
+      "type": "opencollective",
+      "url": "https://opencollective.com/fastify"
+    }
+  ],
   "devDependencies": {
-    "@fastify/pre-commit": "^2.1.0",
-    "@types/node": "^22.0.0",
+    "@types/node": "^26.0.1",
     "benchmark": "^2.1.4",
+    "c8": "^11.0.0",
+    "eslint": "^9.17.0",
     "fastify": "^5.0.0",
-    "sinon": "^19.0.2",
-    "snazzy": "^9.0.0",
-    "standard": "^17.1.0",
-    "tap": "^18.6.1",
-    "tsd": "^0.31.1"
+    "neostandard": "^0.13.0",
+    "sinon": "^22.0.0",
+    "tstyche": "^7.0.0"
   },
   "dependencies": {
     "cookie": "^1.0.0",
-    "fastify-plugin": "^5.0.0"
-  },
-  "tsd": {
-    "directory": "test"
+    "fastify-plugin": "^6.0.0"
   },
   "publishConfig": {
     "access": "public"

package/signer.js

@@ -36,7 +36,7 @@ function validateAlgorithm (algorithm) {
   // validate that the algorithm is supported by the node runtime
   try {
     crypto.createHmac(algorithm, crypto.randomBytes(16))
-  } catch (e) {
+  } catch {
     throw new TypeError(`Algorithm ${algorithm} not supported.`)
   }
 }