@fastify/cookie 6.0.0

package/.editorconfig

@@ -0,0 +1,13 @@
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+# [*.md]
+# trim_trailing_whitespace = false

package/.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

package/.github/stale.yml

@@ -0,0 +1,21 @@
+# Number of days of inactivity before an issue becomes stale
+daysUntilStale: 15
+# Number of days of inactivity before a stale issue is closed
+daysUntilClose: 7
+# Issues with these labels will never be considered stale
+exemptLabels:
+  - "discussion"
+  - "feature request"
+  - "bug"
+  - "help wanted"
+  - "plugin suggestion"
+  - "good first issue"
+# Label to use when marking an issue as stale
+staleLabel: stale
+# Comment to post when marking an issue as stale. Set to `false` to disable
+markComment: >
+  This issue has been automatically marked as stale because it has not had
+  recent activity. It will be closed if no further activity occurs. Thank you
+  for your contributions.
+# Comment to post when closing a stale issue. Set to `false` to disable
+closeComment: false

package/.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: CI
+'on':
+  push:
+    paths-ignore:
+      - docs/**
+      - '*.md'
+  pull_request:
+    paths-ignore:
+      - docs/**
+      - '*.md'
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        node-version:
+          - 10
+          - 12
+          - 14
+          - 16
+        os:
+          - macos-latest
+          - ubuntu-latest
+          - windows-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Use Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Install Dependencies
+        run: |
+          npm install --ignore-scripts
+      - name: Lint
+        run: |
+          npm run lint:ci
+      - name: Run Tests
+        run: |
+          npm test
+  automerge:
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: write
+    steps:
+      - uses: fastify/github-action-merge-dependabot@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}

package/.taprc

@@ -0,0 +1,3 @@
+100: true
+check-coverage: true
+coverage: true

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Fastify
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,206 @@
+# fastify-cookie
+
+![CI](https://github.com/fastify/fastify-cookie/workflows/CI/badge.svg)
+[![NPM version](https://img.shields.io/npm/v/fastify-cookie.svg?style=flat)](https://www.npmjs.com/package/fastify-cookie)
+[![Known Vulnerabilities](https://snyk.io/test/github/fastify/fastify-cookie/badge.svg)](https://snyk.io/test/github/fastify/fastify-cookie)
+[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat)](https://standardjs.com/)
+
+A plugin for [Fastify](http://fastify.io/) that adds support for reading and
+setting cookies.
+
+This plugin's cookie parsing works via Fastify's `onRequest` hook. Therefore,
+you should register it prior to any other `onRequest` hooks that will depend
+upon this plugin's actions.
+
+`fastify-cookie` [v2.x](https://github.com/fastify/fastify-cookie/tree/v2.x)
+supports both Fastify@1 and Fastify@2.
+`fastify-cookie` v3 only supports Fastify@2.
+
+## Example
+
+```js
+const fastify = require('fastify')()
+
+fastify.register(require('fastify-cookie'), {
+  secret: "my-secret", // for cookies signature
+  parseOptions: {}     // options for parsing cookies
+})
+
+fastify.get('/', (req, reply) => {
+  const aCookieValue = req.cookies.cookieName
+  // `reply.unsignCookie()` is also available
+  const bCookie = req.unsignCookie(req.cookies.cookieSigned);
+  reply
+    .setCookie('foo', 'foo', {
+      domain: 'example.com',
+      path: '/'
+    })
+    .cookie('baz', 'baz') // alias for setCookie
+    .setCookie('bar', 'bar', {
+      path: '/',
+      signed: true
+    })
+    .send({ hello: 'world' })
+})
+```
+
+## TypeScript Example
+
+```ts
+import { FastifyCookieOptions } from 'fastify-cookie'
+import cookie from 'fastify-cookie'
+import fastify from 'fastify'
+
+const app = fastify()
+
+app.register(cookie, {
+  secret: "my-secret", // for cookies signature
+  parseOptions: {}     // options for parsing cookies
+} as FastifyCookieOptions)
+```
+
+## Options
+
+- `secret` (`String` | `Array` | `Object`):
+  - A `String` can be passed to use as secret to sign the cookie using [`cookie-signature`](http://npm.im/cookie-signature).
+  - An `Array` can be passed if key rotation is desired. Read more about it in [Rotating signing secret](#rotating-secret).
+  - More sophisticated cookie signing mechanisms can be implemented by supplying an `Object`. Read more about it in [Custom cookie signer](#custom-cookie-signer).
+
+- `parseOptions`: An `Object` to pass as options to [cookie parse](https://github.com/jshttp/cookie#cookieparsestr-options).
+
+## API
+
+### Parsing
+
+Cookies are parsed in the `onRequest` Fastify hook and attached to the request
+as an object named `cookies`. Thus, if a request contains the header
+`Cookie: foo=foo` then, within your handler, `req.cookies.foo` would equal
+`'foo'`.
+
+You can pass options to the [cookie parse](https://github.com/jshttp/cookie#cookieparsestr-options) by setting an object named `parseOptions` in the plugin config object.
+
+### Sending
+
+The method `setCookie(name, value, options)`, and its alias `cookie(name, value, options)`, are added to the `reply` object
+via the Fastify `decorateReply` API. Thus, in a request handler,
+`reply.setCookie('foo', 'foo', {path: '/'})` will set a cookie named `foo`
+with a value of `'foo'` on the cookie path `/`.
+
++ `name`: a string name for the cookie to be set
++ `value`: a string value for the cookie
++ `options`: an options object as described in the [cookie serialize][cs] documentation
+  with a extra param "signed" for signed cookie
+
+#### Securing the cookie
+
+Following are _some_ of the precautions that should be taken to ensure the integrity of an application:
+
+- It's important to use `options.httpOnly` cookies to prevent attacks like XSS.
+- Use signed cookies (`options.signed`) to ensure they are not getting tampered with on client-side by an attacker.
+- Use `__Host-` [Cookie Prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Attributes) to avoid Cookie Tossing attacks.
+- it's important to [use HTTPS for your website/app](https://letsencrypt.org/) to avoid a bunch of other potential security issues like [MITM](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) etc.
+
+### Clearing
+
+The method `clearCookie(name, options)` is added to the `reply` object
+via the Fastify `decorateReply` API. Thus, in a request handler,
+`reply.clearCookie('foo', {path: '/'})` will clear a cookie named `foo`
+on the cookie path `/`.
+
++ `name`: a string name for the cookie to be cleared
++ `options`: an options object as described in the [cookie serialize][cs]
+documentation. Its optional to pass `options` object
+
+### Manual cookie parsing
+
+The method `parseCookie(cookieHeader)` is added to the `fastify` instance
+via the Fastify `decorate` API. Thus, `fastify.parseCookie('sessionId=aYb4uTIhdBXC')`
+will parse the raw cookie header and return an object `{ "sessionId": "aYb4uTIhdBXC" }`.
+
+[cs]: https://www.npmjs.com/package/cookie#options-1
+
+<a id="rotating-secret"></a>
+### Rotating signing secret
+
+Key rotation is when an encryption key is retired and replaced by generating a new cryptographic key. To implement rotation, supply an `Array` of keys to `secret` option.
+
+**Example:**
+```js
+fastify.register(require('fastify-cookie'), {
+  secret: [key1, key2]
+})
+```
+
+The plugin will **always** use the first key (`key1`) to sign cookies. When parsing incoming cookies, it will iterate over the supplied array to see if any of the available keys are able to decode the given signed cookie. This ensures that any old signed cookies are still valid.
+
+Note:
+- Key rotation is **only** achieved by redeploying the server again with the new `secret` array.
+- Iterating through all secrets is an expensive process, so the rotation list should contain as few keys as possible. Ideally, only the current key and the most recently retired key.
+- Although previously signed cookies are valid even after rotation, cookies should be updated with the new key as soon as possible. See the following example for how to accomplish this.
+
+**Example:**
+```js
+fastify.get('/', (req, reply) => {
+  const result = reply.unsignCookie(req.cookies.myCookie)
+
+  if (result.valid && result.renew) {
+    // Setting the same cookie again, this time plugin will sign it with a new key
+    reply.setCookie('myCookie', result.value, {
+      domain: 'example.com', // same options as before
+      path: '/',
+      signed: true
+    })
+  }
+})
+```
+
+<a id="custom-cookie-signer"></a>
+### Custom cookie signer
+
+The `secret` option optionally accepts an object with `sign` and `unsign` functions. This allows for implementing a custom cookie signing mechanism. See the following example:
+
+**Example:**
+```js
+fastify.register(require('fastify-cookie'), {
+  secret: {
+    sign: (value) => {
+      // sign using custom logic
+      return signedValue
+    },
+    unsign: (value) => {
+      // unsign using custom logic
+      return {
+        valid: true, // the cookie has been unsigned successfully
+        renew: false, // the cookie has been unsigned with an old secret
+        value: 'unsignedValue'
+      }
+    }
+  }
+})
+```
+
+### Manual cookie unsigning
+
+The method `unsignCookie(value)` is added to the `fastify` instance and the `reply` object
+via the Fastify `decorate` & `decorateReply` APIs. Using it on a signed cookie will call the
+the provided signer's (or the default signer if no custom implementation is provided) `unsign` method on the cookie.
+
+**Example:**
+
+```js
+fastify.register(require('fastify-cookie'), { secret: 'my-secret' })
+
+fastify.get('/', (req, rep) => {
+  if (fastify.unsign(req.cookie.foo).valid === false) {
+    rep.send('cookie is invalid')
+    return
+  }
+
+  rep.send('cookie is valid')
+})
+```
+
+
+## License
+
+[MIT License](http://jsumners.mit-license.org/)

package/cookie.js

@@ -0,0 +1,225 @@
+/*!
+ * Adapted from https://github.com/jshttp/cookie
+ *
+ * (The MIT License)
+ *
+ * Copyright (c) 2012-2014 Roman Shtylman <shtylman@gmail.com>
+ * Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * 'Software'), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+'use strict'
+
+/**
+ * Module exports.
+ * @public
+ */
+
+exports.parse = parse
+exports.serialize = serialize
+
+/**
+ * Module variables.
+ * @private
+ */
+
+const decode = decodeURIComponent
+const encode = encodeURIComponent
+
+/**
+ * RegExp to match field-content in RFC 7230 sec 3.2
+ *
+ * field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
+ * field-vchar   = VCHAR / obs-text
+ * obs-text      = %x80-FF
+ */
+
+const fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/ // eslint-disable-line
+
+/**
+ * Parse a cookie header.
+ *
+ * Parse the given cookie header string into an object
+ * The object has the various cookies as keys(names) => values
+ *
+ * @param {string} str
+ * @param {object} [options]
+ * @return {object}
+ * @public
+ */
+
+function parse (str, options) {
+  if (typeof str !== 'string') {
+    throw new TypeError('argument str must be a string')
+  }
+
+  const result = {}
+  const dec = (options && options.decode) || decode
+
+  let pos = 0
+  let terminatorPos = 0
+  let eqIdx = 0
+
+  while (true) {
+    if (terminatorPos === str.length) {
+      break
+    }
+    terminatorPos = str.indexOf(';', pos)
+    terminatorPos = (terminatorPos === -1) ? str.length : terminatorPos
+    eqIdx = str.indexOf('=', pos)
+
+    // skip things that don't look like key=value
+    if (eqIdx === -1 || eqIdx > terminatorPos) {
+      pos = terminatorPos + 1
+      continue
+    }
+
+    const key = str.substring(pos, eqIdx++).trim()
+
+    // only assign once
+    if (undefined === result[key]) {
+      const val = (str.charCodeAt(eqIdx) === 0x22)
+        ? str.substring(eqIdx + 1, terminatorPos - 1).trim()
+        : str.substring(eqIdx, terminatorPos).trim()
+
+      result[key] = (dec !== decode || val.indexOf('%') !== -1)
+        ? tryDecode(val, dec)
+        : val
+    }
+    pos = terminatorPos + 1
+  }
+  return result
+}
+
+/**
+ * Serialize data into a cookie header.
+ *
+ * Serialize the a name value pair into a cookie string suitable for
+ * http headers. An optional options object specified cookie parameters.
+ *
+ * serialize('foo', 'bar', { httpOnly: true })
+ *   => "foo=bar; httpOnly"
+ *
+ * @param {string} name
+ * @param {string} val
+ * @param {object} [options]
+ * @return {string}
+ * @public
+ */
+
+function serialize (name, val, options) {
+  const opt = options || {}
+  const enc = opt.encode || encode
+  if (typeof enc !== 'function') {
+    throw new TypeError('option encode is invalid')
+  }
+
+  if (!fieldContentRegExp.test(name)) {
+    throw new TypeError('argument name is invalid')
+  }
+
+  const value = enc(val)
+  if (value && !fieldContentRegExp.test(value)) {
+    throw new TypeError('argument val is invalid')
+  }
+
+  let str = name + '=' + value
+  if (opt.maxAge != null) {
+    const maxAge = opt.maxAge - 0
+    if (isNaN(maxAge) || !isFinite(maxAge)) {
+      throw new TypeError('option maxAge is invalid')
+    }
+
+    str += '; Max-Age=' + Math.floor(maxAge)
+  }
+
+  if (opt.domain) {
+    if (!fieldContentRegExp.test(opt.domain)) {
+      throw new TypeError('option domain is invalid')
+    }
+
+    str += '; Domain=' + opt.domain
+  }
+
+  if (opt.path) {
+    if (!fieldContentRegExp.test(opt.path)) {
+      throw new TypeError('option path is invalid')
+    }
+
+    str += '; Path=' + opt.path
+  }
+
+  if (opt.expires) {
+    if (typeof opt.expires.toUTCString !== 'function') {
+      throw new TypeError('option expires is invalid')
+    }
+
+    str += '; Expires=' + opt.expires.toUTCString()
+  }
+
+  if (opt.httpOnly) {
+    str += '; HttpOnly'
+  }
+
+  if (opt.secure) {
+    str += '; Secure'
+  }
+
+  if (opt.sameSite) {
+    const sameSite = typeof opt.sameSite === 'string'
+      ? opt.sameSite.toLowerCase()
+      : opt.sameSite
+    switch (sameSite) {
+      case true:
+        str += '; SameSite=Strict'
+        break
+      case 'lax':
+        str += '; SameSite=Lax'
+        break
+      case 'strict':
+        str += '; SameSite=Strict'
+        break
+      case 'none':
+        str += '; SameSite=None'
+        break
+      default:
+        throw new TypeError('option sameSite is invalid')
+    }
+  }
+
+  return str
+}
+
+/**
+ * Try decoding a string using a decoding function.
+ *
+ * @param {string} str
+ * @param {function} decode
+ * @private
+ */
+
+function tryDecode (str, decode) {
+  try {
+    return decode(str)
+  } catch (e) {
+    return str
+  }
+}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@fastify/cookie",
+  "version": "6.0.0",
+  "description": "Plugin for fastify to add support for cookies",
+  "main": "plugin.js",
+  "types": "plugin.d.ts",
+  "scripts": {
+    "lint": "standard | snazzy",
+    "lint:ci": "standard",
+    "lint:fix": "standard --fix",
+    "test": "npm run unit && npm run typescript",
+    "typescript": "tsd",
+    "unit": "tap -J \"test/*.test.js\"",
+    "unit:report": "npm run unit -- --coverage-report=html",
+    "unit:verbose": "npm run unit -- -Rspec"
+  },
+  "precommit": [
+    "lint",
+    "test"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/fastify/fastify-cookie.git"
+  },
+  "keywords": [
+    "fastify",
+    "cookie"
+  ],
+  "author": "James Sumners <james.sumners@gmail.com>",
+  "contributors": [
+    {
+      "name": "Salman Mitha",
+      "email": "SalmanMitha@gmail.com"
+    }
+  ],
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/fastify/fastify-cookie/issues"
+  },
+  "homepage": "https://github.com/fastify/fastify-cookie#readme",
+  "devDependencies": {
+    "@types/node": "^17.0.16",
+    "fastify": "^3.27.1",
+    "pre-commit": "^1.2.2",
+    "sinon": "^13.0.1",
+    "snazzy": "^9.0.0",
+    "standard": "^17.0.0",
+    "tap": "^16.0.0",
+    "tsd": "^0.20.0",
+    "typescript": "^4.5.5"
+  },
+  "dependencies": {
+    "cookie-signature": "^1.1.0",
+    "fastify-plugin": "^3.0.1"
+  },
+  "tsd": {
+    "directory": "test"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}