@fastify/cookie 7.1.0 → 7.3.1

package/README.md

@@ -99,7 +99,8 @@ with a value of `'foo'` on the cookie path `/`.
 + `name`: a string name for the cookie to be set
 + `value`: a string value for the cookie
 + `options`: an options object as described in the [cookie serialize][cs] documentation
-  with a extra param "signed" for signed cookie
++ `options.signed`: the cookie should be signed
++ `options.secure`: if set to `true` it will set the Secure-flag. If it is set to `"auto"` Secure-flag is set when the connection is using tls.
 
 #### Securing the cookie
 
@@ -201,7 +202,7 @@ the provided signer's (or the default signer if no custom implementation is prov
 fastify.register(require('@fastify/cookie'), { secret: 'my-secret' })
 
 fastify.get('/', (req, rep) => {
-  if (fastify.unsign(req.cookie.foo).valid === false) {
+  if (fastify.unsignCookie(req.cookie.foo).valid === false) {
     rep.send('cookie is invalid')
     return
   }
@@ -210,6 +211,50 @@ fastify.get('/', (req, rep) => {
 })
 ```
 
+### Other cases of manual signing
+
+Sometimes the service under test should only accept requests with signed cookies, but it does not generate them itself.
+
+**Example:**
+
+```js
+
+test('Request requires signed cookie', async () => {
+    const response = await app.inject({
+        method: 'GET',
+        url: '/',
+        headers: {
+          cookies : {
+            'sid': app.signCookie(sidValue)
+          }
+        },
+    });
+
+    expect(response.statusCode).toBe(200);
+});
+```
+
+### Manual signing/unsigning with low level utilities
+
+with signerFactory
+
+```js
+const { fastifyCookie } = require('@fastify/cookie');
+
+const signer = fastifyCookie.signerFactory('secret');
+const signedValue = signer.sign('test');
+const {valid, renew, value } = signer.unsign(signedValue);
+```
+
+with sign/unsign utilities
+
+```js
+const { fastifyCookie } = require('@fastify/cookie');
+
+const signedValue = fastifyCookie.sign('test', 'secret');
+const unsignedvalue = fastifyCookie.unsign(signedValue, 'secret');
+```
+
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/cookie",
-  "version": "7.1.0",
+  "version": "7.3.1",
   "description": "Plugin for fastify to add support for cookies",
   "main": "plugin.js",
   "types": "plugin.d.ts",
@@ -52,7 +52,7 @@
   "dependencies": {
     "cookie": "^0.5.0",
     "cookie-signature": "^1.1.0",
-    "fastify-plugin": "^3.0.1"
+    "fastify-plugin": "^4.0.0"
   },
   "tsd": {
     "directory": "test"

package/plugin.d.ts

@@ -1,8 +1,8 @@
 /// <reference types='node' />
 
-import { FastifyPluginCallback } from 'fastify';
+import { FastifyPluginCallback } from "fastify";
 
-declare module 'fastify' {
+declare module "fastify" {
   interface FastifyInstance {
     /**
      * Unsigns the specified cookie using the secret provided.
@@ -21,6 +21,12 @@ declare module 'fastify' {
     parseCookie(cookieHeader: string): {
       [key: string]: string;
     };
+    /**
+     * Manual cookie signing method
+     * @docs https://github.com/fastify/fastify-cookie#manual-cookie-parsing
+     * @param value cookie value
+     */
+    signCookie(value: string): string;
   }
 
   interface FastifyRequest {
@@ -43,7 +49,7 @@ declare module 'fastify' {
   export type setCookieWrapper = (
     name: string,
     value: string,
-    options?: CookieSerializeOptions
+    options?: fastifyCookie.CookieSerializeOptions
   ) => FastifyReply;
 
   interface FastifyReply {
@@ -57,20 +63,27 @@ declare module 'fastify' {
     setCookie(
       name: string,
       value: string,
-      options?: CookieSerializeOptions
+      options?: fastifyCookie.CookieSerializeOptions
     ): this;
 
     /**
      * @alias setCookie
      */
-    cookie(name: string, value: string, options?: CookieSerializeOptions): this;
+    cookie(
+      name: string,
+      value: string,
+      options?: fastifyCookie.CookieSerializeOptions
+    ): this;
 
     /**
      * clear response cookie
      * @param name Cookie name
      * @param options Serialize options
      */
-    clearCookie(name: string, options?: CookieSerializeOptions): this;
+    clearCookie(
+      name: string,
+      options?: fastifyCookie.CookieSerializeOptions
+    ): this;
 
     /**
      * Unsigns the specified cookie using the secret provided.
@@ -84,34 +97,64 @@ declare module 'fastify' {
   }
 }
 
-export interface CookieSerializeOptions {
-  domain?: string;
-  encode?(val: string): string;
-  expires?: Date;
-  httpOnly?: boolean;
-  maxAge?: number;
-  path?: string;
-  priority?: 'low' | 'medium' | 'high';
-  sameSite?: boolean | 'lax' | 'strict' | 'none';
-  secure?: boolean;
-  signed?: boolean;
-}
+type FastifyCookiePlugin = FastifyPluginCallback<
+  NonNullable<fastifyCookie.FastifyCookieOptions>
+>;
 
-interface Signer {
-  sign: (input: string) => string;
-  unsign: (input: string) => {
-    valid: boolean;
-    renew: boolean;
-    value: string | null;
-  };
-}
+declare namespace fastifyCookie {
+  export interface Signer {
+    sign: (input: string) => string;
+    unsign: (input: string) => {
+      valid: boolean;
+      renew: boolean;
+      value: string | null;
+    };
+  }
+
+  export interface CookieSerializeOptions {
+    domain?: string;
+    encode?(val: string): string;
+    expires?: Date;
+    httpOnly?: boolean;
+    maxAge?: number;
+    path?: string;
+    priority?: "low" | "medium" | "high";
+    sameSite?: boolean | "lax" | "strict" | "none";
+    secure?: boolean;
+    signed?: boolean;
+  }
+
+  export interface FastifyCookieOptions {
+    secret?: string | string[] | Signer;
+    parseOptions?: fastifyCookie.CookieSerializeOptions;
+  }
+
+  export type Sign = (value: string, secret: string) => string;
+  export type Unsign = (input: string, secret: string) => string | false;
+  export type SignerFactory = (secret: string) => Signer;
+
+  export const signerFactory: SignerFactory;
+  export const sign: Sign;
+  export const unsign: Unsign;
+
+  export interface FastifyCookie extends FastifyCookiePlugin {
+    signerFactory: SignerFactory;
+    sign: Sign;
+    unsign: Unsign;
+  }
+
+  export const fastifyCookie: FastifyCookie;
+
+  export interface FastifyCookieOptions {
+    secret?: string | string[] | Signer;
+    parseOptions?: CookieSerializeOptions;
+  }
 
-export interface FastifyCookieOptions {
-  secret?: string | string[] | Signer;
-  parseOptions?: CookieSerializeOptions;
+  export { fastifyCookie as default };
 }
 
-declare const fastifyCookie: FastifyPluginCallback<NonNullable<FastifyCookieOptions>>;
+declare function fastifyCookie(
+  ...params: Parameters<FastifyCookiePlugin>
+): ReturnType<FastifyCookiePlugin>;
 
-export default fastifyCookie;
-export { fastifyCookie };
+export = fastifyCookie;

package/plugin.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const { sign, unsign } = require('cookie-signature')
 const fp = require('fastify-plugin')
 const cookie = require('cookie')
 
@@ -15,6 +16,15 @@ function fastifyCookieSetCookie (reply, name, value, options, signer) {
     value = signer.sign(value)
   }
 
+  if (opts.secure === 'auto') {
+    if (isConnectionSecure(reply.request)) {
+      opts.secure = true
+    } else {
+      opts.sameSite = 'lax'
+      opts.secure = false
+    }
+  }
+
   const serialized = cookie.serialize(name, value, opts)
   let setCookie = reply.getHeader('Set-Cookie')
   if (!setCookie) {
@@ -58,6 +68,7 @@ function plugin (fastify, options, next) {
   const signer = typeof secret === 'string' || enableRotation ? signerFactory(secret) : secret
 
   fastify.decorate('parseCookie', parseCookie)
+  fastify.decorate('signCookie', signCookie)
   fastify.decorate('unsignCookie', unsignCookie)
 
   fastify.decorateRequest('cookies', null)
@@ -76,6 +87,10 @@ function plugin (fastify, options, next) {
     return cookie.parse(cookieHeader, options.parseOptions)
   }
 
+  function signCookie (value) {
+    return signer.sign(value)
+  }
+
   function unsignCookie (value) {
     return signer.unsign(value)
   }
@@ -90,6 +105,13 @@ function plugin (fastify, options, next) {
   }
 }
 
+function isConnectionSecure (request) {
+  return (
+    request.raw.socket?.encrypted === true ||
+    request.headers['x-forwarded-proto'] === 'https'
+  )
+}
+
 const fastifyCookie = fp(plugin, {
   fastify: '4.x',
   name: '@fastify/cookie'
@@ -108,3 +130,11 @@ const fastifyCookie = fp(plugin, {
 fastifyCookie.fastifyCookie = fastifyCookie
 fastifyCookie.default = fastifyCookie
 module.exports = fastifyCookie
+
+fastifyCookie.fastifyCookie.signerFactory = signerFactory
+fastifyCookie.fastifyCookie.sign = sign
+fastifyCookie.fastifyCookie.unsign = unsign
+
+module.exports.signerFactory = signerFactory
+module.exports.sign = sign
+module.exports.unsign = unsign

package/test/cookie.test.js

@@ -756,3 +756,61 @@ test('cookies set with plugin options parseOptions field', (t) => {
     }
   )
 })
+
+test('create signed cookie manually using signCookie decorator', async (t) => {
+  const fastify = Fastify()
+
+  await fastify.register(plugin, { secret: 'secret' })
+
+  fastify.get('/test1', (req, reply) => {
+    reply.send({
+      unsigned: req.unsignCookie(req.cookies.foo)
+    })
+  })
+
+  const res = await fastify.inject({
+    method: 'GET',
+    url: '/test1',
+    headers: { cookie: `foo=${fastify.signCookie('bar')}` }
+  })
+  t.equal(res.statusCode, 200)
+  t.same(JSON.parse(res.body), { unsigned: { value: 'bar', renew: false, valid: true } })
+})
+
+test('handle secure:auto of cookieOptions', async (t) => {
+  const fastify = Fastify()
+
+  await fastify.register(plugin)
+
+  fastify.get('/test1', (req, reply) => {
+    reply
+      .setCookie('foo', 'foo', { path: '/', secure: 'auto' })
+      .send()
+  })
+
+  const res = await fastify.inject({
+    method: 'GET',
+    url: '/test1',
+    headers: { 'x-forwarded-proto': 'https' }
+  })
+
+  const cookies = res.cookies
+  t.equal(cookies.length, 1)
+  t.equal(cookies[0].name, 'foo')
+  t.equal(cookies[0].value, 'foo')
+  t.equal(cookies[0].secure, true)
+  t.equal(cookies[0].path, '/')
+
+  const res2 = await fastify.inject({
+    method: 'GET',
+    url: '/test1'
+  })
+
+  const cookies2 = res2.cookies
+  t.equal(cookies2.length, 1)
+  t.equal(cookies2[0].name, 'foo')
+  t.equal(cookies2[0].value, 'foo')
+  t.equal(cookies2[0].sameSite, 'Lax')
+  t.same(cookies2[0].secure, null)
+  t.equal(cookies2[0].path, '/')
+})

package/test/plugin.test-d.ts

@@ -1,13 +1,10 @@
-import fastify, { FastifyInstance, FastifyPluginCallback, FastifyReply, setCookieWrapper } from 'fastify';
-import { Server } from 'http';
+import cookie from '../plugin';
 import { expectType } from 'tsd';
 import * as fastifyCookieStar from '..';
-import fastifyCookieDefault, {
-  fastifyCookie as fastifyCookieNamed
-} from '..';
-import cookie, { FastifyCookieOptions } from '../plugin';
-
 import fastifyCookieCjsImport = require('..');
+import fastifyCookieDefault, { fastifyCookie as fastifyCookieNamed  } from '..';
+import fastify, { FastifyInstance,  FastifyReply, setCookieWrapper } from 'fastify';
+
 const fastifyCookieCjs = require('..');
 
 const app: FastifyInstance = fastify();
@@ -19,16 +16,24 @@ app.register(fastifyCookieCjsImport.fastifyCookie);
 app.register(fastifyCookieStar.default);
 app.register(fastifyCookieStar.fastifyCookie);
 
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieNamed);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieDefault);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieCjsImport.default);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieCjsImport.fastifyCookie);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieStar.default);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieNamed);
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieDefault);
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieCjsImport.default);
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieCjsImport.fastifyCookie);
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieStar.default);
+expectType<fastifyCookieStar.FastifyCookie>(
   fastifyCookieStar.fastifyCookie
 );
 expectType<any>(fastifyCookieCjs);
 
+expectType<fastifyCookieStar.Sign>(fastifyCookieDefault.sign);
+expectType<fastifyCookieStar.Unsign>(fastifyCookieDefault.unsign);
+expectType<fastifyCookieStar.SignerFactory >(fastifyCookieDefault.signerFactory );
+
+expectType<fastifyCookieStar.Sign>(fastifyCookieNamed.sign);
+expectType<fastifyCookieStar.Unsign>(fastifyCookieNamed.unsign);
+expectType<fastifyCookieStar.SignerFactory >(fastifyCookieNamed.signerFactory );
+
 const server = fastify();
 
 server.register(cookie);