@fastify/cookie 7.0.0 → 7.3.0

package/.github/workflows/ci.yml

@@ -1,48 +1,17 @@
 name: CI
-'on':
+
+on:
   push:
     paths-ignore:
-      - docs/**
+      - 'docs/**'
       - '*.md'
   pull_request:
     paths-ignore:
-      - docs/**
+      - 'docs/**'
       - '*.md'
+
 jobs:
   test:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        node-version:
-          - 14
-          - 16
-          - 18
-        os:
-          - macos-latest
-          - ubuntu-latest
-          - windows-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Use Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: ${{ matrix.node-version }}
-      - name: Install Dependencies
-        run: |
-          npm install --ignore-scripts
-      - name: Lint
-        run: |
-          npm run lint:ci
-      - name: Run Tests
-        run: |
-          npm test
-  automerge:
-    needs: test
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-      contents: write
-    steps:
-      - uses: fastify/github-action-merge-dependabot@v3
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v3
+    with:
+      lint: true

package/README.md

@@ -2,7 +2,6 @@
 
 ![CI](https://github.com/fastify/fastify-cookie/workflows/CI/badge.svg)
 [![NPM version](https://img.shields.io/npm/v/@fastify/cookie.svg?style=flat)](https://www.npmjs.com/package/@fastify/cookie)
-[![Known Vulnerabilities](https://snyk.io/test/github/fastify/fastify-cookie/badge.svg)](https://snyk.io/test/github/fastify/fastify-cookie)
 [![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat)](https://standardjs.com/)
 
 A plugin for [Fastify](http://fastify.io/) that adds support for reading and
@@ -58,7 +57,7 @@ fastify.get('/', (req, reply) => {
 ## TypeScript Example
 
 ```ts
-import { FastifyCookieOptions } from '@fastify/cookie'
+import type { FastifyCookieOptions } from '@fastify/cookie'
 import cookie from '@fastify/cookie'
 import fastify from 'fastify'
 
@@ -100,7 +99,8 @@ with a value of `'foo'` on the cookie path `/`.
 + `name`: a string name for the cookie to be set
 + `value`: a string value for the cookie
 + `options`: an options object as described in the [cookie serialize][cs] documentation
-  with a extra param "signed" for signed cookie
++ `options.signed`: the cookie should be signed
++ `options.secure`: if set to `true` it will set the Secure-flag. If it is set to `"auto"` Secure-flag is set when the connection is using tls.
 
 #### Securing the cookie
 
@@ -202,7 +202,7 @@ the provided signer's (or the default signer if no custom implementation is prov
 fastify.register(require('@fastify/cookie'), { secret: 'my-secret' })
 
 fastify.get('/', (req, rep) => {
-  if (fastify.unsign(req.cookie.foo).valid === false) {
+  if (fastify.unsignCookie(req.cookie.foo).valid === false) {
     rep.send('cookie is invalid')
     return
   }
@@ -211,6 +211,50 @@ fastify.get('/', (req, rep) => {
 })
 ```
 
+### Other cases of manual signing
+
+Sometimes the service under test should only accept requests with signed cookies, but it does not generate them itself.
+
+**Example:**
+
+```js
+
+test('Request requires signed cookie', async () => {
+    const response = await app.inject({
+        method: 'GET',
+        url: '/',
+        headers: {
+          cookies : {
+            'sid': app.signCookie(sidValue)
+          }
+        },
+    });
+
+    expect(response.statusCode).toBe(200);
+});
+```
+
+### Manual signing/unsigning with low level utilities
+
+with signerFactory
+
+```js
+const { fastifyCookie } = require('@fastify/cookie');
+
+const signer = fastifyCookie.signerFactory('secret');
+const signedValue = signer.sign('test');
+const {valid, renew, value } = signer.unsign(signedValue);
+```
+
+with sign/unsign utilities
+
+```js
+const { fastifyCookie } = require('@fastify/cookie');
+
+const signedValue = fastifyCookie.sign('test', 'secret');
+const unsignedvalue = fastifyCookie.unsign(signedValue, 'secret');
+```
+
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/cookie",
-  "version": "7.0.0",
+  "version": "7.3.0",
   "description": "Plugin for fastify to add support for cookies",
   "main": "plugin.js",
   "types": "plugin.d.ts",
@@ -39,19 +39,20 @@
   },
   "homepage": "https://github.com/fastify/fastify-cookie#readme",
   "devDependencies": {
-    "@types/node": "^17.0.16",
+    "@types/node": "^18.0.0",
     "fastify": "^4.0.0-rc.2",
     "pre-commit": "^1.2.2",
     "sinon": "^14.0.0",
     "snazzy": "^9.0.0",
     "standard": "^17.0.0",
     "tap": "^16.0.0",
-    "tsd": "^0.20.0",
+    "tsd": "^0.22.0",
     "typescript": "^4.5.5"
   },
   "dependencies": {
+    "cookie": "^0.5.0",
     "cookie-signature": "^1.1.0",
-    "fastify-plugin": "^3.0.1"
+    "fastify-plugin": "^4.0.0"
   },
   "tsd": {
     "directory": "test"

package/plugin.d.ts

@@ -21,13 +21,19 @@ declare module 'fastify' {
     parseCookie(cookieHeader: string): {
       [key: string]: string;
     };
+    /**
+     * Manual cookie signing method
+     * @docs https://github.com/fastify/fastify-cookie#manual-cookie-parsing
+     * @param value cookie value
+     */
+    signCookie(value: string): string;
   }
 
   interface FastifyRequest {
     /**
      * Request cookies
      */
-    cookies: { [cookieName: string]: string };
+    cookies: { [cookieName: string]: string | undefined };
 
     /**
      * Unsigns the specified cookie using the secret provided.
@@ -91,12 +97,13 @@ export interface CookieSerializeOptions {
   httpOnly?: boolean;
   maxAge?: number;
   path?: string;
+  priority?: 'low' | 'medium' | 'high';
   sameSite?: boolean | 'lax' | 'strict' | 'none';
-  secure?: boolean;
+  secure?: boolean | 'auto';
   signed?: boolean;
 }
 
-interface Signer {
+export interface Signer {
   sign: (input: string) => string;
   unsign: (input: string) => {
     valid: boolean;
@@ -110,7 +117,17 @@ export interface FastifyCookieOptions {
   parseOptions?: CookieSerializeOptions;
 }
 
-declare const fastifyCookie: FastifyPluginCallback<NonNullable<FastifyCookieOptions>>;
+export type Sign  = (value: string, secret: string) => string;
+export type Unsign  = (input: string, secret: string) => string | false;
+export type SignerFactory = (secret: string) => Signer;
+
+export interface FastifyCookie extends FastifyPluginCallback<NonNullable<FastifyCookieOptions>>{
+  signerFactory: SignerFactory;
+  sign: Sign;
+  unsign: Unsign;
+}
+
+declare const fastifyCookie: FastifyCookie;
 
 export default fastifyCookie;
 export { fastifyCookie };

package/plugin.js

@@ -1,7 +1,8 @@
 'use strict'
 
+const { sign, unsign } = require('cookie-signature')
 const fp = require('fastify-plugin')
-const cookie = require('./cookie')
+const cookie = require('cookie')
 
 const signerFactory = require('./signer')
 
@@ -15,6 +16,15 @@ function fastifyCookieSetCookie (reply, name, value, options, signer) {
     value = signer.sign(value)
   }
 
+  if (opts.secure === 'auto') {
+    if (isConnectionSecure(reply.request)) {
+      opts.secure = true
+    } else {
+      opts.sameSite = 'lax'
+      opts.secure = false
+    }
+  }
+
   const serialized = cookie.serialize(name, value, opts)
   let setCookie = reply.getHeader('Set-Cookie')
   if (!setCookie) {
@@ -58,6 +68,7 @@ function plugin (fastify, options, next) {
   const signer = typeof secret === 'string' || enableRotation ? signerFactory(secret) : secret
 
   fastify.decorate('parseCookie', parseCookie)
+  fastify.decorate('signCookie', signCookie)
   fastify.decorate('unsignCookie', unsignCookie)
 
   fastify.decorateRequest('cookies', null)
@@ -76,6 +87,10 @@ function plugin (fastify, options, next) {
     return cookie.parse(cookieHeader, options.parseOptions)
   }
 
+  function signCookie (value) {
+    return signer.sign(value)
+  }
+
   function unsignCookie (value) {
     return signer.unsign(value)
   }
@@ -90,6 +105,13 @@ function plugin (fastify, options, next) {
   }
 }
 
+function isConnectionSecure (request) {
+  return (
+    request.raw.socket?.encrypted === true ||
+    request.headers['x-forwarded-proto'] === 'https'
+  )
+}
+
 const fastifyCookie = fp(plugin, {
   fastify: '4.x',
   name: '@fastify/cookie'
@@ -108,3 +130,11 @@ const fastifyCookie = fp(plugin, {
 fastifyCookie.fastifyCookie = fastifyCookie
 fastifyCookie.default = fastifyCookie
 module.exports = fastifyCookie
+
+fastifyCookie.fastifyCookie.signerFactory = signerFactory
+fastifyCookie.fastifyCookie.sign = sign
+fastifyCookie.fastifyCookie.unsign = unsign
+
+module.exports.signerFactory = signerFactory
+module.exports.sign = sign
+module.exports.unsign = unsign

package/test/cookie.test.js

@@ -243,6 +243,61 @@ test('parses incoming cookies', (t) => {
   })
 })
 
+test('defined and undefined cookies', (t) => {
+  t.plan(23)
+  const fastify = Fastify()
+  fastify.register(plugin)
+
+  // check that it parses the cookies in the onRequest hook
+  for (const hook of ['preValidation', 'preHandler']) {
+    fastify.addHook(hook, (req, reply, done) => {
+      t.ok(req.cookies)
+
+      t.ok(req.cookies.bar)
+      t.notOk(req.cookies.baz)
+
+      t.equal(req.cookies.bar, 'bar')
+      t.equal(req.cookies.baz, undefined)
+      done()
+    })
+  }
+
+  fastify.addHook('preParsing', (req, reply, payload, done) => {
+    t.ok(req.cookies)
+
+    t.ok(req.cookies.bar)
+    t.notOk(req.cookies.baz)
+
+    t.equal(req.cookies.bar, 'bar')
+    t.equal(req.cookies.baz, undefined)
+    done()
+  })
+
+  fastify.get('/test2', (req, reply) => {
+    t.ok(req.cookies)
+
+    t.ok(req.cookies.bar)
+    t.notOk(req.cookies.baz)
+
+    t.equal(req.cookies.bar, 'bar')
+    t.equal(req.cookies.baz, undefined)
+
+    reply.send({ hello: 'world' })
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/test2',
+    headers: {
+      cookie: 'bar=bar'
+    }
+  }, (err, res) => {
+    t.error(err)
+    t.equal(res.statusCode, 200)
+    t.same(JSON.parse(res.body), { hello: 'world' })
+  })
+})
+
 test('does not modify supplied cookie options object', (t) => {
   t.plan(3)
   const expireDate = Date.now() + 1000
@@ -701,3 +756,61 @@ test('cookies set with plugin options parseOptions field', (t) => {
     }
   )
 })
+
+test('create signed cookie manually using signCookie decorator', async (t) => {
+  const fastify = Fastify()
+
+  await fastify.register(plugin, { secret: 'secret' })
+
+  fastify.get('/test1', (req, reply) => {
+    reply.send({
+      unsigned: req.unsignCookie(req.cookies.foo)
+    })
+  })
+
+  const res = await fastify.inject({
+    method: 'GET',
+    url: '/test1',
+    headers: { cookie: `foo=${fastify.signCookie('bar')}` }
+  })
+  t.equal(res.statusCode, 200)
+  t.same(JSON.parse(res.body), { unsigned: { value: 'bar', renew: false, valid: true } })
+})
+
+test('handle secure:auto of cookieOptions', async (t) => {
+  const fastify = Fastify()
+
+  await fastify.register(plugin)
+
+  fastify.get('/test1', (req, reply) => {
+    reply
+      .setCookie('foo', 'foo', { path: '/', secure: 'auto' })
+      .send()
+  })
+
+  const res = await fastify.inject({
+    method: 'GET',
+    url: '/test1',
+    headers: { 'x-forwarded-proto': 'https' }
+  })
+
+  const cookies = res.cookies
+  t.equal(cookies.length, 1)
+  t.equal(cookies[0].name, 'foo')
+  t.equal(cookies[0].value, 'foo')
+  t.equal(cookies[0].secure, true)
+  t.equal(cookies[0].path, '/')
+
+  const res2 = await fastify.inject({
+    method: 'GET',
+    url: '/test1'
+  })
+
+  const cookies2 = res2.cookies
+  t.equal(cookies2.length, 1)
+  t.equal(cookies2[0].name, 'foo')
+  t.equal(cookies2[0].value, 'foo')
+  t.equal(cookies2[0].sameSite, 'Lax')
+  t.same(cookies2[0].secure, null)
+  t.equal(cookies2[0].path, '/')
+})

package/test/plugin.test-d.ts

@@ -1,14 +1,10 @@
-import fastify, { FastifyInstance, FastifyPluginCallback, FastifyReply, setCookieWrapper } from 'fastify';
-import { Server } from 'http';
+import cookie from '../plugin';
 import { expectType } from 'tsd';
 import * as fastifyCookieStar from '..';
-import fastifyCookieDefault, {
-  CookieSerializeOptions,
-  fastifyCookie as fastifyCookieNamed
-} from '..';
-import cookie, { FastifyCookieOptions } from '../plugin';
-
 import fastifyCookieCjsImport = require('..');
+import fastifyCookieDefault, { fastifyCookie as fastifyCookieNamed  } from '..';
+import fastify, { FastifyInstance,  FastifyReply, setCookieWrapper } from 'fastify';
+
 const fastifyCookieCjs = require('..');
 
 const app: FastifyInstance = fastify();
@@ -20,16 +16,24 @@ app.register(fastifyCookieCjsImport.fastifyCookie);
 app.register(fastifyCookieStar.default);
 app.register(fastifyCookieStar.fastifyCookie);
 
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieNamed);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieDefault);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieCjsImport.default);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieCjsImport.fastifyCookie);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieStar.default);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieNamed);
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieDefault);
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieCjsImport.default);
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieCjsImport.fastifyCookie);
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieStar.default);
+expectType<fastifyCookieStar.FastifyCookie>(
   fastifyCookieStar.fastifyCookie
 );
 expectType<any>(fastifyCookieCjs);
 
+expectType<fastifyCookieStar.Sign>(fastifyCookieDefault.sign);
+expectType<fastifyCookieStar.Unsign>(fastifyCookieDefault.unsign);
+expectType<fastifyCookieStar.SignerFactory >(fastifyCookieDefault.signerFactory );
+
+expectType<fastifyCookieStar.Sign>(fastifyCookieNamed.sign);
+expectType<fastifyCookieStar.Unsign>(fastifyCookieNamed.unsign);
+expectType<fastifyCookieStar.SignerFactory >(fastifyCookieNamed.signerFactory );
+
 const server = fastify();
 
 server.register(cookie);
@@ -42,13 +46,14 @@ server.after((_err) => {
 
   server.get('/', (request, reply) => {
     const test = request.cookies.test;
+    expectType<string | undefined>(test);
 
     expectType<setCookieWrapper>(reply.cookie);
     expectType<setCookieWrapper>(reply.setCookie);
 
     expectType<FastifyReply>(
       reply
-        .setCookie('test', test, { domain: 'example.com', path: '/' })
+        .setCookie('test', test!, { domain: 'example.com', path: '/' })
         .clearCookie('foo')
         .send({ hello: 'world' })
     );
@@ -63,7 +68,7 @@ serverWithHttp2.after(() => {
   serverWithHttp2.get('/', (request, reply) => {
     const test = request.cookies.test;
     reply
-      .setCookie('test', test, { domain: 'example.com', path: '/' })
+      .setCookie('test', test!, { domain: 'example.com', path: '/' })
       .clearCookie('foo')
       .send({ hello: 'world' });
   });
@@ -75,26 +80,26 @@ testSamesiteOptionsApp.register(cookie);
 testSamesiteOptionsApp.after(() => {
   server.get('/test-samesite-option-true', (request, reply) => {
     const test = request.cookies.test;
-    reply.setCookie('test', test, { sameSite: true }).send({ hello: 'world' });
+    reply.setCookie('test', test!, { sameSite: true }).send({ hello: 'world' });
   });
   server.get('/test-samesite-option-false', (request, reply) => {
     const test = request.cookies.test;
-    reply.setCookie('test', test, { sameSite: false }).send({ hello: 'world' });
+    reply.setCookie('test', test!, { sameSite: false }).send({ hello: 'world' });
   });
   server.get('/test-samesite-option-lax', (request, reply) => {
     const test = request.cookies.test;
-    reply.setCookie('test', test, { sameSite: 'lax' }).send({ hello: 'world' });
+    reply.setCookie('test', test!, { sameSite: 'lax' }).send({ hello: 'world' });
   });
   server.get('/test-samesite-option-strict', (request, reply) => {
     const test = request.cookies.test;
     reply
-      .setCookie('test', test, { sameSite: 'strict' })
+      .setCookie('test', test!, { sameSite: 'strict' })
       .send({ hello: 'world' });
   });
   server.get('/test-samesite-option-none', (request, reply) => {
     const test = request.cookies.test;
     reply
-      .setCookie('test', test, { sameSite: 'none' })
+      .setCookie('test', test!, { sameSite: 'none' })
       .send({ hello: 'world' });
   });
 });
@@ -106,13 +111,13 @@ appWithImplicitHttpSigned.register(cookie, {
 });
 appWithImplicitHttpSigned.after(() => {
   server.get('/', (request, reply) => {
-    appWithImplicitHttpSigned.unsignCookie(request.cookies.test);
+    appWithImplicitHttpSigned.unsignCookie(request.cookies.test!);
     appWithImplicitHttpSigned.unsignCookie('test');
 
-    reply.unsignCookie(request.cookies.test);
+    reply.unsignCookie(request.cookies.test!);
     reply.unsignCookie('test');
 
-    request.unsignCookie(request.cookies.anotherTest);
+    request.unsignCookie(request.cookies.anotherTest!);
     request.unsignCookie('anotherTest');
 
     reply.send({ hello: 'world' });
@@ -126,7 +131,7 @@ appWithRotationSecret.register(cookie, {
 });
 appWithRotationSecret.after(() => {
   server.get('/', (request, reply) => {
-    reply.unsignCookie(request.cookies.test);
+    reply.unsignCookie(request.cookies.test!);
     const { valid, renew, value } = reply.unsignCookie('test');
 
     expectType<boolean>(valid);
@@ -158,7 +163,7 @@ appWithParseOptions.register(cookie, {
 });
 appWithParseOptions.after(() => {
   server.get('/', (request, reply) => {
-    const { valid, renew, value } = reply.unsignCookie(request.cookies.test);
+    const { valid, renew, value } = reply.unsignCookie(request.cookies.test!);
 
     expectType<boolean>(valid);
     expectType<boolean>(renew);
@@ -179,7 +184,7 @@ appWithCustomSigner.register(cookie, {
 })
 appWithCustomSigner.after(() => {
   server.get('/', (request, reply) => {
-    reply.unsignCookie(request.cookies.test)
+    reply.unsignCookie(request.cookies.test!)
     const { valid, renew, value } = reply.unsignCookie('test')
 
     expectType<boolean>(valid)

package/cookie.js

@@ -1,225 +0,0 @@
-/*!
- * Adapted from https://github.com/jshttp/cookie
- *
- * (The MIT License)
- *
- * Copyright (c) 2012-2014 Roman Shtylman <shtylman@gmail.com>
- * Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
- *
- * Permission is hereby granted, free of charge, to any person obtaining
- * a copy of this software and associated documentation files (the
- * 'Software'), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
- * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
- * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
- * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
- * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-
-'use strict'
-
-/**
- * Module exports.
- * @public
- */
-
-exports.parse = parse
-exports.serialize = serialize
-
-/**
- * Module variables.
- * @private
- */
-
-const decode = decodeURIComponent
-const encode = encodeURIComponent
-
-/**
- * RegExp to match field-content in RFC 7230 sec 3.2
- *
- * field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
- * field-vchar   = VCHAR / obs-text
- * obs-text      = %x80-FF
- */
-
-const fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/ // eslint-disable-line
-
-/**
- * Parse a cookie header.
- *
- * Parse the given cookie header string into an object
- * The object has the various cookies as keys(names) => values
- *
- * @param {string} str
- * @param {object} [options]
- * @return {object}
- * @public
- */
-
-function parse (str, options) {
-  if (typeof str !== 'string') {
-    throw new TypeError('argument str must be a string')
-  }
-
-  const result = {}
-  const dec = (options && options.decode) || decode
-
-  let pos = 0
-  let terminatorPos = 0
-  let eqIdx = 0
-
-  while (true) {
-    if (terminatorPos === str.length) {
-      break
-    }
-    terminatorPos = str.indexOf(';', pos)
-    terminatorPos = (terminatorPos === -1) ? str.length : terminatorPos
-    eqIdx = str.indexOf('=', pos)
-
-    // skip things that don't look like key=value
-    if (eqIdx === -1 || eqIdx > terminatorPos) {
-      pos = terminatorPos + 1
-      continue
-    }
-
-    const key = str.substring(pos, eqIdx++).trim()
-
-    // only assign once
-    if (undefined === result[key]) {
-      const val = (str.charCodeAt(eqIdx) === 0x22)
-        ? str.substring(eqIdx + 1, terminatorPos - 1).trim()
-        : str.substring(eqIdx, terminatorPos).trim()
-
-      result[key] = (dec !== decode || val.indexOf('%') !== -1)
-        ? tryDecode(val, dec)
-        : val
-    }
-    pos = terminatorPos + 1
-  }
-  return result
-}
-
-/**
- * Serialize data into a cookie header.
- *
- * Serialize the a name value pair into a cookie string suitable for
- * http headers. An optional options object specified cookie parameters.
- *
- * serialize('foo', 'bar', { httpOnly: true })
- *   => "foo=bar; httpOnly"
- *
- * @param {string} name
- * @param {string} val
- * @param {object} [options]
- * @return {string}
- * @public
- */
-
-function serialize (name, val, options) {
-  const opt = options || {}
-  const enc = opt.encode || encode
-  if (typeof enc !== 'function') {
-    throw new TypeError('option encode is invalid')
-  }
-
-  if (!fieldContentRegExp.test(name)) {
-    throw new TypeError('argument name is invalid')
-  }
-
-  const value = enc(val)
-  if (value && !fieldContentRegExp.test(value)) {
-    throw new TypeError('argument val is invalid')
-  }
-
-  let str = name + '=' + value
-  if (opt.maxAge != null) {
-    const maxAge = opt.maxAge - 0
-    if (isNaN(maxAge) || !isFinite(maxAge)) {
-      throw new TypeError('option maxAge is invalid')
-    }
-
-    str += '; Max-Age=' + Math.floor(maxAge)
-  }
-
-  if (opt.domain) {
-    if (!fieldContentRegExp.test(opt.domain)) {
-      throw new TypeError('option domain is invalid')
-    }
-
-    str += '; Domain=' + opt.domain
-  }
-
-  if (opt.path) {
-    if (!fieldContentRegExp.test(opt.path)) {
-      throw new TypeError('option path is invalid')
-    }
-
-    str += '; Path=' + opt.path
-  }
-
-  if (opt.expires) {
-    if (typeof opt.expires.toUTCString !== 'function') {
-      throw new TypeError('option expires is invalid')
-    }
-
-    str += '; Expires=' + opt.expires.toUTCString()
-  }
-
-  if (opt.httpOnly) {
-    str += '; HttpOnly'
-  }
-
-  if (opt.secure) {
-    str += '; Secure'
-  }
-
-  if (opt.sameSite) {
-    const sameSite = typeof opt.sameSite === 'string'
-      ? opt.sameSite.toLowerCase()
-      : opt.sameSite
-    switch (sameSite) {
-      case true:
-        str += '; SameSite=Strict'
-        break
-      case 'lax':
-        str += '; SameSite=Lax'
-        break
-      case 'strict':
-        str += '; SameSite=Strict'
-        break
-      case 'none':
-        str += '; SameSite=None'
-        break
-      default:
-        throw new TypeError('option sameSite is invalid')
-    }
-  }
-
-  return str
-}
-
-/**
- * Try decoding a string using a decoding function.
- *
- * @param {string} str
- * @param {function} decode
- * @private
- */
-
-function tryDecode (str, decode) {
-  try {
-    return decode(str)
-  } catch (e) {
-    return str
-  }
-}

package/test/cookie-module.test.js

@@ -1,205 +0,0 @@
-'use strict'
-
-const tap = require('tap')
-const test = tap.test
-
-const cookie = require('../cookie')
-
-test('parse: argument validation', (t) => {
-  t.plan(2)
-  t.throws(cookie.parse.bind(), /argument str must be a string/)
-  t.throws(cookie.parse.bind(null, 42), /argument str must be a string/)
-  t.end()
-})
-
-test('parse: basic', (t) => {
-  t.plan(2)
-  t.same(cookie.parse('foo=bar'), { foo: 'bar' })
-  t.same(cookie.parse('foo=123'), { foo: '123' })
-  t.end()
-})
-
-test('parse: ignore spaces', (t) => {
-  t.plan(1)
-  t.same(cookie.parse('FOO    = bar;   baz  =   raz'), { FOO: 'bar', baz: 'raz' })
-  t.end()
-})
-
-test('parse: escaping', (t) => {
-  t.plan(2)
-  t.same(cookie.parse('foo="bar=123456789&name=Magic+Mouse"'), { foo: 'bar=123456789&name=Magic+Mouse' })
-  t.same(cookie.parse('email=%20%22%2c%3b%2f'), { email: ' ",;/' })
-  t.end()
-})
-
-test('parse: ignore escaping error and return original value', (t) => {
-  t.plan(1)
-  t.same(cookie.parse('foo=%1;bar=bar'), { foo: '%1', bar: 'bar' })
-  t.end()
-})
-
-test('parse: ignore non values', (t) => {
-  t.plan(1)
-  t.same(cookie.parse('foo=%1;bar=bar;HttpOnly;Secure'),
-    { foo: '%1', bar: 'bar' })
-  t.end()
-})
-
-test('parse: unencoded', (t) => {
-  t.plan(2)
-  t.same(cookie.parse('foo="bar=123456789&name=Magic+Mouse"', {
-    decode: function (v) { return v }
-  }), { foo: 'bar=123456789&name=Magic+Mouse' })
-
-  t.same(cookie.parse('email=%20%22%2c%3b%2f', {
-    decode: function (v) { return v }
-  }), { email: '%20%22%2c%3b%2f' })
-  t.end()
-})
-
-test('parse: dates', (t) => {
-  t.plan(1)
-  t.same(cookie.parse('priority=true; expires=Wed, 29 Jan 2014 17:43:25 GMT; Path=/', {
-    decode: function (v) { return v }
-  }), { priority: 'true', Path: '/', expires: 'Wed, 29 Jan 2014 17:43:25 GMT' })
-  t.end()
-})
-
-test('parse: missing value', (t) => {
-  t.plan(1)
-  t.same(cookie.parse('foo; bar=1; fizz= ; buzz=2', {
-    decode: function (v) { return v }
-  }), { bar: '1', fizz: '', buzz: '2' })
-  t.end()
-})
-
-test('parse: assign only once', (t) => {
-  t.plan(3)
-  t.same(cookie.parse('foo=%1;bar=bar;foo=boo'), { foo: '%1', bar: 'bar' })
-  t.same(cookie.parse('foo=false;bar=bar;foo=true'), { foo: 'false', bar: 'bar' })
-  t.same(cookie.parse('foo=;bar=bar;foo=boo'), { foo: '', bar: 'bar' })
-  t.end()
-})
-
-test('serializer: basic', (t) => {
-  t.plan(6)
-  t.same(cookie.serialize('foo', 'bar'), 'foo=bar')
-  t.same(cookie.serialize('foo', 'bar baz'), 'foo=bar%20baz')
-  t.same(cookie.serialize('foo', ''), 'foo=')
-  t.throws(cookie.serialize.bind(cookie, 'foo\n', 'bar'), /argument name is invalid/)
-  t.throws(cookie.serialize.bind(cookie, 'foo\u280a', 'bar'), /argument name is invalid/)
-  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', { encode: 42 }), /option encode is invalid/)
-  t.end()
-})
-
-test('serializer: path', (t) => {
-  t.plan(2)
-  t.same(cookie.serialize('foo', 'bar', { path: '/' }), 'foo=bar; Path=/')
-  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
-    path: '/\n'
-  }), /option path is invalid/)
-  t.end()
-})
-
-test('serializer: secure', (t) => {
-  t.plan(2)
-  t.same(cookie.serialize('foo', 'bar', { secure: true }), 'foo=bar; Secure')
-  t.same(cookie.serialize('foo', 'bar', { secure: false }), 'foo=bar')
-  t.end()
-})
-
-test('serializer: domain', (t) => {
-  t.plan(2)
-  t.same(cookie.serialize('foo', 'bar', { domain: 'example.com' }), 'foo=bar; Domain=example.com')
-  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
-    domain: 'example.com\n'
-  }), /option domain is invalid/)
-  t.end()
-})
-
-test('serializer: httpOnly', (t) => {
-  t.plan(1)
-  t.same(cookie.serialize('foo', 'bar', { httpOnly: true }), 'foo=bar; HttpOnly')
-  t.end()
-})
-
-test('serializer: maxAge', (t) => {
-  t.plan(9)
-  t.throws(function () {
-    cookie.serialize('foo', 'bar', {
-      maxAge: 'buzz'
-    })
-  }, /option maxAge is invalid/)
-
-  t.throws(function () {
-    cookie.serialize('foo', 'bar', {
-      maxAge: Infinity
-    })
-  }, /option maxAge is invalid/)
-
-  t.same(cookie.serialize('foo', 'bar', { maxAge: 1000 }), 'foo=bar; Max-Age=1000')
-  t.same(cookie.serialize('foo', 'bar', { maxAge: '1000' }), 'foo=bar; Max-Age=1000')
-  t.same(cookie.serialize('foo', 'bar', { maxAge: 0 }), 'foo=bar; Max-Age=0')
-  t.same(cookie.serialize('foo', 'bar', { maxAge: '0' }), 'foo=bar; Max-Age=0')
-  t.same(cookie.serialize('foo', 'bar', { maxAge: null }), 'foo=bar')
-  t.same(cookie.serialize('foo', 'bar', { maxAge: undefined }), 'foo=bar')
-  t.same(cookie.serialize('foo', 'bar', { maxAge: 3.14 }), 'foo=bar; Max-Age=3')
-  t.end()
-})
-
-test('serializer: expires', (t) => {
-  t.plan(2)
-  t.same(cookie.serialize('foo', 'bar', {
-    expires: new Date(Date.UTC(2000, 11, 24, 10, 30, 59, 900))
-  }), 'foo=bar; Expires=Sun, 24 Dec 2000 10:30:59 GMT')
-
-  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
-    expires: Date.now()
-  }), /option expires is invalid/)
-  t.end()
-})
-
-test('sameSite', (t) => {
-  t.plan(9)
-  t.same(cookie.serialize('foo', 'bar', { sameSite: true }), 'foo=bar; SameSite=Strict')
-  t.same(cookie.serialize('foo', 'bar', { sameSite: 'Strict' }), 'foo=bar; SameSite=Strict')
-  t.same(cookie.serialize('foo', 'bar', { sameSite: 'strict' }), 'foo=bar; SameSite=Strict')
-  t.same(cookie.serialize('foo', 'bar', { sameSite: 'Lax' }), 'foo=bar; SameSite=Lax')
-  t.same(cookie.serialize('foo', 'bar', { sameSite: 'lax' }), 'foo=bar; SameSite=Lax')
-  t.same(cookie.serialize('foo', 'bar', { sameSite: 'None' }), 'foo=bar; SameSite=None')
-  t.same(cookie.serialize('foo', 'bar', { sameSite: 'none' }), 'foo=bar; SameSite=None')
-  t.same(cookie.serialize('foo', 'bar', { sameSite: false }), 'foo=bar')
-
-  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
-    sameSite: 'foo'
-  }), /option sameSite is invalid/)
-  t.end()
-})
-
-test('escaping', (t) => {
-  t.plan(1)
-  t.same(cookie.serialize('cat', '+ '), 'cat=%2B%20')
-  t.end()
-})
-
-test('parse->serialize', (t) => {
-  t.plan(2)
-  t.same(cookie.parse(cookie.serialize('cat', 'foo=123&name=baz five')),
-    { cat: 'foo=123&name=baz five' })
-
-  t.same(cookie.parse(cookie.serialize('cat', ' ";/')),
-    { cat: ' ";/' })
-  t.end()
-})
-
-test('unencoded', (t) => {
-  t.plan(2)
-  t.same(cookie.serialize('cat', '+ ', {
-    encode: function (value) { return value }
-  }), 'cat=+ ')
-
-  t.throws(cookie.serialize.bind(cookie, 'cat', '+ \n', {
-    encode: function (value) { return value }
-  }), /argument val is invalid/)
-  t.end()
-})