@fastify/cookie 11.0.2 → 11.1.0

package/.github/dependabot.yml

@@ -2,12 +2,52 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
     open-pull-requests-limit: 10
 
   - package-ecosystem: "npm"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+    versioning-strategy: "increase-if-necessary"
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+    ignore:
+      # TODO: remove ignore until neostandard support ESLint 10
+      - dependency-name: "eslint"
+      - dependency-name: "neostandard"
+      - dependency-name: "@stylistic/*"
     open-pull-requests-limit: 10
+    groups:
+      # Production dependencies with breaking changes
+      dependencies:
+        dependency-type: "production"
+      # ESLint related dependencies
+      dev-dependencies-eslint:
+        patterns:
+          - "eslint"
+          - "neostandard"
+          - "@stylistic/*"
+      # TypeScript related dependencies
+      dev-dependencies-typescript:
+        patterns:
+          - "@types/*"
+          - "tstyche"
+          - "typescript"

package/.github/workflows/ci.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
      - main
-     - master
      - next
      - 'v*'
     paths-ignore:
@@ -15,9 +14,20 @@ on:
       - 'docs/**'
       - '*.md'
 
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+    group: "${{ github.workflow }}-${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
+    cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   test:
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v5
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v6
     with:
       license-check: true
       lint: true

package/.github/workflows/lock-threads.yml

@@ -0,0 +1,19 @@
+name: Lock Threads
+
+on:
+  schedule:
+    - cron: '0 0 1 * *'
+  workflow_dispatch:
+
+concurrency:
+  group: lock
+
+permissions:
+  contents: read
+
+jobs:
+  lock-threads:
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@v6

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) Fastify
+Copyright (c) 2017-present The Fastify team <https://github.com/fastify/fastify#team>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,10 +1,10 @@
 # @fastify/cookie
 
-[![CI](https://github.com/fastify/fastify-cookie/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/fastify/fastify-cookie/actions/workflows/ci.yml)
+[![CI](https://github.com/fastify/fastify-cookie/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/fastify/fastify-cookie/actions/workflows/ci.yml)
 [![NPM version](https://img.shields.io/npm/v/@fastify/cookie.svg?style=flat)](https://www.npmjs.com/package/@fastify/cookie)
 [![neostandard javascript style](https://img.shields.io/badge/code_style-neostandard-brightgreen?style=flat)](https://github.com/neostandard/neostandard)
 
-A plugin for [Fastify](http://fastify.dev/) that adds support for reading and
+A plugin for [Fastify](https://fastify.dev/) that adds support for reading and
 setting cookies.
 
 This plugin's cookie parsing works via Fastify's `onRequest` hook. Therefore,
@@ -21,10 +21,10 @@ npm i @fastify/cookie
 ### Compatibility
 | Plugin version | Fastify version |
 | ---------------|-----------------|
-| `^10.x`        | `^5.x`          |
-| `^7.x`         | `^4.x`          |
-| `^4.x`         | `^3.x`          |
-| `^2.x`         | `^2.x`          |
+| `>=10.x`       | `^5.x`          |
+| `>=7.x <10.x`  | `^4.x`          |
+| `>=4.x <7.x`   | `^3.x`          |
+| `>=2.x <4.x`   | `^2.x`          |
 | `^1.x`         | `^1.x`          |
 
 Please note that if a Fastify version is out of support, then so are the corresponding versions of this plugin
@@ -95,7 +95,7 @@ fastify.get('/', (req, reply) => {
 ## Options
 
 - `secret` (`String` | `Array` | `Buffer` | `Object`):
-  - A `String` or `Buffer` can be passed to use as secret to sign the cookie using [`cookie-signature`](http://npm.im/cookie-signature).
+  - A `String` or `Buffer` can be passed to use as secret to sign the cookie using [`cookie-signature`](https://www.npmjs.com/package/cookie-signature).
   - An `Array` can be passed if key rotation is desired. Read more about it in [Rotating signing secret](#rotating-secret).
   - More sophisticated cookie signing mechanisms can be implemented by supplying an `Object`. Read more about it in [Custom cookie signer](#custom-cookie-signer).
 
@@ -165,14 +165,14 @@ More information about this can be found in [the proposal](https://github.com/pr
 
 ##### priority
 
-Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute](https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1).
+Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/draft-west-cookie-priority-00#section-4.1).
 
   - `'low'` will set the `Priority` attribute to `Low`.
   - `'medium'` will set the `Priority` attribute to `Medium`, the default priority when not set.
   - `'high'` will set the `Priority` attribute to `High`.
 
 More information about the different priority levels can be found in
-[the specification](https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1).
+[the specification](https://datatracker.ietf.org/doc/html/draft-west-cookie-priority-00#section-4.1).
 
 ⚠️ **Warning:** This is an attribute that has not yet been fully standardized, and may change in the future without reflecting the semver versioning. This also means many clients may ignore the attribute until they understand it.
 
@@ -235,7 +235,7 @@ Following are _some_ of the precautions that should be taken to ensure the integ
 
 - It's important to use `options.httpOnly` cookies to prevent attacks like XSS.
 - Use signed cookies (`options.signed`) to ensure they are not getting tampered wit client-side by an attacker.
-- Use `__Host-` [Cookie Prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Attributes) to avoid Cookie Tossing attacks.
+- Use `__Host-` [Cookie Prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#attributes) to avoid Cookie Tossing attacks.
 - It is important to [use HTTPS for your website/app](https://letsencrypt.org/) to avoid a bunch of other potential security issues like [MITM](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) etc.
 
 ### Clearing

package/package.json

@@ -1,26 +1,22 @@
 {
   "name": "@fastify/cookie",
-  "version": "11.0.2",
+  "version": "11.1.0",
   "description": "Plugin for fastify to add support for cookies",
-  "main": "plugin.js",
+  "main": "index.js",
   "type": "commonjs",
-  "types": "types/plugin.d.ts",
+  "types": "types/index.d.ts",
   "scripts": {
     "coverage": "npm run test:unit -- --coverage-report=html",
     "lint": "eslint",
     "lint:fix": "eslint --fix",
     "test": "npm run test:unit && npm run test:typescript",
-    "test:typescript": "tsd",
+    "test:typescript": "tstyche",
     "test:unit": "c8 --100 node --test",
     "test:unit:verbose": "npm run test:unit -- -Rspec"
   },
-  "precommit": [
-    "lint",
-    "test"
-  ],
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@github.com/fastify/fastify-cookie.git"
+    "url": "git+https://github.com/fastify/fastify-cookie.git"
   },
   "keywords": [
     "fastify",
@@ -62,22 +58,18 @@
     }
   ],
   "devDependencies": {
-    "@fastify/pre-commit": "^2.1.0",
-    "@types/node": "^22.0.0",
+    "@types/node": "^26.0.1",
     "benchmark": "^2.1.4",
-    "c8": "^10.1.2",
+    "c8": "^11.0.0",
     "eslint": "^9.17.0",
     "fastify": "^5.0.0",
-    "neostandard": "^0.12.0",
-    "sinon": "^19.0.2",
-    "tsd": "^0.31.1"
+    "neostandard": "^0.13.0",
+    "sinon": "^22.0.0",
+    "tstyche": "^7.0.0"
   },
   "dependencies": {
     "cookie": "^1.0.0",
-    "fastify-plugin": "^5.0.0"
-  },
-  "tsd": {
-    "directory": "test"
+    "fastify-plugin": "^6.0.0"
   },
   "publishConfig": {
     "access": "public"

package/types/{plugin.test-d.ts → index.tst.ts}

@@ -1,8 +1,12 @@
-import { expectError, expectType } from 'tsd'
+import { expect } from 'tstyche'
 import * as fastifyCookieStar from '..'
 import fastifyCookieCjsImport = require('..')
 import cookie, { fastifyCookie as fastifyCookieNamed, Signer } from '..'
-import fastify, { FastifyInstance, FastifyReply, setCookieWrapper } from 'fastify'
+import fastify, {
+  type FastifyInstance,
+  type FastifyReply,
+  type setCookieWrapper
+} from 'fastify'
 
 const fastifyCookieCjs = require('..')
 
@@ -15,61 +19,72 @@ app.register(fastifyCookieCjsImport.fastifyCookie)
 app.register(fastifyCookieStar.default)
 app.register(fastifyCookieStar.fastifyCookie)
 
-expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieNamed)
-expectType<fastifyCookieStar.FastifyCookie>(cookie)
-expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieCjsImport.default)
-expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieCjsImport.fastifyCookie)
-expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieStar.default)
-expectType<fastifyCookieStar.FastifyCookie>(
+expect(fastifyCookieNamed).type.toBe<fastifyCookieStar.FastifyCookie>()
+expect(cookie).type.toBe<fastifyCookieStar.FastifyCookie>()
+expect(
+  fastifyCookieCjsImport.default
+).type.toBe<fastifyCookieStar.FastifyCookie>()
+expect(
+  fastifyCookieCjsImport.fastifyCookie
+).type.toBe<fastifyCookieStar.FastifyCookie>()
+expect(fastifyCookieStar.default).type.toBe<fastifyCookieStar.FastifyCookie>()
+expect(
   fastifyCookieStar.fastifyCookie
-)
-expectType<any>(fastifyCookieCjs)
+).type.toBe<fastifyCookieStar.FastifyCookie>()
+expect(fastifyCookieCjs).type.toBe<any>()
 
-expectType<fastifyCookieStar.Sign>(cookie.sign)
-expectType<fastifyCookieStar.Unsign>(cookie.unsign)
-expectType<fastifyCookieStar.SignerFactory >(cookie.signerFactory)
+expect(cookie.sign).type.toBe<fastifyCookieStar.Sign>()
+expect(cookie.unsign).type.toBe<fastifyCookieStar.Unsign>()
+expect(cookie.signerFactory).type.toBe<fastifyCookieStar.SignerFactory>()
 
-expectType<fastifyCookieStar.Sign>(fastifyCookieNamed.sign)
-expectType<fastifyCookieStar.Unsign>(fastifyCookieNamed.unsign)
-expectType<fastifyCookieStar.SignerFactory >(fastifyCookieNamed.signerFactory)
+expect(fastifyCookieNamed.sign).type.toBe<fastifyCookieStar.Sign>()
+expect(fastifyCookieNamed.unsign).type.toBe<fastifyCookieStar.Unsign>()
+expect(
+  fastifyCookieNamed.signerFactory
+).type.toBe<fastifyCookieStar.SignerFactory>()
 
 const server = fastify()
 
 server.register(cookie)
 
 server.after((_err) => {
-  expectType< string >(
+  expect(
     server.serializeCookie('sessionId', 'aYb4uTIhdBXC')
-  )
+  ).type.toBe<string>()
 
-  expectType<{ [key: string]: string }>(
-    // See https://github.com/fastify/fastify-cookie#manual-cookie-parsing
-    server.parseCookie('sessionId=aYb4uTIhdBXC')
-  )
+  expect(server.parseCookie('sessionId=aYb4uTIhdBXC')).type.toBe<{
+    [key: string]: string;
+  }>()
 
   server.get('/', (request, reply) => {
     const test = request.cookies.test
-    expectType<string | undefined>(test)
+    expect(test).type.toBe<string | undefined>()
 
-    expectType<setCookieWrapper>(reply.cookie)
-    expectType<setCookieWrapper>(reply.setCookie)
+    expect(reply.cookie).type.toBe<setCookieWrapper>()
+    expect(reply.setCookie).type.toBe<setCookieWrapper>()
 
-    expectType<FastifyReply>(
+    expect(
       reply
         .setCookie('test', test!, { domain: 'example.com', path: '/' })
         .clearCookie('foo')
         .send({ hello: 'world' })
-    )
+    ).type.toBe<FastifyReply>()
   })
 
-  expectType<(value: string) => string>(server.signCookie)
-  expectType<(value: string) => fastifyCookieStar.UnsignResult>(server.unsignCookie)
+  expect(server.signCookie).type.toBe<(value: string) => string>()
+  expect(server.unsignCookie).type.toBe<
+    (value: string) => fastifyCookieStar.UnsignResult
+  >()
 
   server.get('/', (request, reply) => {
-    expectType<(value: string) => string>(request.signCookie)
-    expectType<(value: string) => string>(reply.signCookie)
-    expectType<(value: string) => fastifyCookieStar.UnsignResult>(request.unsignCookie)
-    expectType<(value: string) => fastifyCookieStar.UnsignResult>(reply.unsignCookie)
+    expect(request.signCookie).type.toBe<(value: string) => string>()
+    expect(reply.signCookie).type.toBe<(value: string) => string>()
+    expect(request.unsignCookie).type.toBe<
+      (value: string) => fastifyCookieStar.UnsignResult
+    >()
+    expect(reply.unsignCookie).type.toBe<
+      (value: string) => fastifyCookieStar.UnsignResult
+    >()
   })
 })
 
@@ -97,11 +112,15 @@ testSamesiteOptionsApp.after(() => {
   })
   server.get('/test-samesite-option-false', (request, reply) => {
     const test = request.cookies.test
-    reply.setCookie('test', test!, { sameSite: false }).send({ hello: 'world' })
+    reply
+      .setCookie('test', test!, { sameSite: false })
+      .send({ hello: 'world' })
   })
   server.get('/test-samesite-option-lax', (request, reply) => {
     const test = request.cookies.test
-    reply.setCookie('test', test!, { sameSite: 'lax' }).send({ hello: 'world' })
+    reply
+      .setCookie('test', test!, { sameSite: 'lax' })
+      .send({ hello: 'world' })
   })
   server.get('/test-samesite-option-strict', (request, reply) => {
     const test = request.cookies.test
@@ -120,7 +139,7 @@ testSamesiteOptionsApp.after(() => {
 const appWithImplicitHttpSigned = fastify()
 
 appWithImplicitHttpSigned.register(cookie, {
-  secret: 'testsecret',
+  secret: 'testsecret'
 })
 appWithImplicitHttpSigned.register(cookie, {
   secret: 'testsecret',
@@ -144,20 +163,20 @@ appWithImplicitHttpSigned.after(() => {
 const appWithRotationSecret = fastify()
 
 appWithRotationSecret.register(cookie, {
-  secret: ['testsecret'],
+  secret: ['testsecret']
 })
 appWithRotationSecret.after(() => {
   server.get('/', (request, reply) => {
     reply.unsignCookie(request.cookies.test!)
     const unsigned = reply.unsignCookie('test')
 
-    expectType<boolean>(unsigned.valid)
+    expect(unsigned.valid).type.toBe<boolean>()
     if (unsigned.valid) {
-      expectType<string>(unsigned.value)
+      expect(unsigned.value).type.toBe<string>()
     } else {
-      expectType<null>(unsigned.value)
+      expect(unsigned.value).type.toBe<null>()
     }
-    expectType<boolean>(unsigned.renew)
+    expect(unsigned.renew).type.toBe<boolean>()
 
     reply.send({ hello: 'world' })
   })
@@ -175,25 +194,25 @@ const parseOptions: fastifyCookieStar.CookieSerializeOptions = {
   sameSite: 'lax',
   secure: true,
   signed: true,
-  partitioned: false,
+  partitioned: false
 }
-expectType<fastifyCookieStar.CookieSerializeOptions>(parseOptions)
+expect(parseOptions).type.toBe<fastifyCookieStar.CookieSerializeOptions>()
 
 appWithParseOptions.register(cookie, {
   secret: 'testsecret',
-  parseOptions,
+  parseOptions
 })
 appWithParseOptions.after(() => {
   server.get('/', (request, reply) => {
     const unsigned = reply.unsignCookie(request.cookies.test!)
 
-    expectType<boolean>(unsigned.valid)
+    expect(unsigned.valid).type.toBe<boolean>()
     if (unsigned.valid) {
-      expectType<string>(unsigned.value)
+      expect(unsigned.value).type.toBe<string>()
     } else {
-      expectType<null>(unsigned.value)
+      expect(unsigned.value).type.toBe<null>()
     }
-    expectType<boolean>(unsigned.renew)
+    expect(unsigned.renew).type.toBe<boolean>()
   })
 })
 
@@ -203,7 +222,9 @@ appWithCustomSigner.register(cookie, {
   secret: {
     sign: (x) => x + '.signed',
     unsign: (x) => {
-      if (x.endsWith('.signed')) { return { renew: false, valid: true, value: x.slice(0, -7) } }
+      if (x.endsWith('.signed')) {
+        return { renew: false, valid: true, value: x.slice(0, -7) }
+      }
       return { renew: false, valid: false, value: null }
     }
   }
@@ -213,22 +234,28 @@ appWithCustomSigner.after(() => {
     reply.unsignCookie(request.cookies.test!)
     const unsigned = reply.unsignCookie('test')
 
-    expectType<boolean>(unsigned.valid)
+    expect(unsigned.valid).type.toBe<boolean>()
     if (unsigned.valid) {
-      expectType<string>(unsigned.value)
+      expect(unsigned.value).type.toBe<string>()
     } else {
-      expectType<null>(unsigned.value)
+      expect(unsigned.value).type.toBe<null>()
     }
-    expectType<boolean>(unsigned.renew)
+    expect(unsigned.renew).type.toBe<boolean>()
 
     reply.send({ hello: 'world' })
   })
 })
 
-expectType<Signer>(new fastifyCookieStar.Signer('secretString'))
-expectType<Signer>(new fastifyCookieStar.Signer(['secretStringInArray']))
-expectType<Signer>(new fastifyCookieStar.Signer(Buffer.from('secretString')))
-expectType<Signer>(new fastifyCookieStar.Signer([Buffer.from('secretStringInArray')]))
+expect(new fastifyCookieStar.Signer('secretString')).type.toBe<Signer>()
+expect(
+  new fastifyCookieStar.Signer(['secretStringInArray'])
+).type.toBe<Signer>()
+expect(
+  new fastifyCookieStar.Signer(Buffer.from('secretString'))
+).type.toBe<Signer>()
+expect(
+  new fastifyCookieStar.Signer([Buffer.from('secretStringInArray')])
+).type.toBe<Signer>()
 
 const signer = new fastifyCookieStar.Signer(['secretStringInArray'], 'sha256')
 signer.sign('Lorem Ipsum')
@@ -242,8 +269,22 @@ appWithHook.register(cookie, { hook: 'preHandler' })
 appWithHook.register(cookie, { hook: 'preParsing' })
 appWithHook.register(cookie, { hook: 'preSerialization' })
 appWithHook.register(cookie, { hook: 'preValidation' })
-expectError(appWithHook.register(cookie, { hook: true }))
-expectError(appWithHook.register(cookie, { hook: 'false' }))
 
-expectType<(cookieHeader: string, opts?: fastifyCookieStar.ParseOptions) => { [key: string]: string }>(cookie.parse)
-expectType<(name: string, value: string, opts?: fastifyCookieStar.SerializeOptions) => string>(cookie.serialize)
+expect(appWithHook.register)
+  .type.not.toBeCallableWith(cookie, { hook: true })
+expect(appWithHook.register)
+  .type.not.toBeCallableWith(cookie, { hook: 'false' })
+
+expect(cookie.parse).type.toBe<
+  (
+    cookieHeader: string,
+    opts?: fastifyCookieStar.ParseOptions
+  ) => { [key: string]: string }
+>()
+expect(cookie.serialize).type.toBe<
+  (
+    name: string,
+    value: string,
+    opts?: fastifyCookieStar.SerializeOptions
+  ) => string
+>()

package/.github/stale.yml

@@ -1,21 +0,0 @@
-# Number of days of inactivity before an issue becomes stale
-daysUntilStale: 15
-# Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
-# Issues with these labels will never be considered stale
-exemptLabels:
-  - "discussion"
-  - "feature request"
-  - "bug"
-  - "help wanted"
-  - "plugin suggestion"
-  - "good first issue"
-# Label to use when marking an issue as stale
-staleLabel: stale
-# Comment to post when marking an issue as stale. Set to `false` to disable
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
-  for your contributions.
-# Comment to post when closing a stale issue. Set to `false` to disable
-closeComment: false