@fastify/cookie 7.2.0 → 7.3.0

package/README.md

@@ -99,7 +99,8 @@ with a value of `'foo'` on the cookie path `/`.
 + `name`: a string name for the cookie to be set
 + `value`: a string value for the cookie
 + `options`: an options object as described in the [cookie serialize][cs] documentation
-  with a extra param "signed" for signed cookie
++ `options.signed`: the cookie should be signed
++ `options.secure`: if set to `true` it will set the Secure-flag. If it is set to `"auto"` Secure-flag is set when the connection is using tls.
 
 #### Securing the cookie
 
@@ -238,9 +239,9 @@ test('Request requires signed cookie', async () => {
 with signerFactory
 
 ```js
-const { signerFactory } = require('@fastify/cookie');
+const { fastifyCookie } = require('@fastify/cookie');
 
-const signer = signerFactory('secret');
+const signer = fastifyCookie.signerFactory('secret');
 const signedValue = signer.sign('test');
 const {valid, renew, value } = signer.unsign(signedValue);
 ```
@@ -248,10 +249,10 @@ const {valid, renew, value } = signer.unsign(signedValue);
 with sign/unsign utilities
 
 ```js
-const { sign, unsign } = require('@fastify/cookie');
+const { fastifyCookie } = require('@fastify/cookie');
 
-const signedValue = sign('test', 'secret');
-const unsignedvalue = unsign(signedValue, 'secret');
+const signedValue = fastifyCookie.sign('test', 'secret');
+const unsignedvalue = fastifyCookie.unsign(signedValue, 'secret');
 ```
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/cookie",
-  "version": "7.2.0",
+  "version": "7.3.0",
   "description": "Plugin for fastify to add support for cookies",
   "main": "plugin.js",
   "types": "plugin.d.ts",
@@ -52,7 +52,7 @@
   "dependencies": {
     "cookie": "^0.5.0",
     "cookie-signature": "^1.1.0",
-    "fastify-plugin": "^3.0.1"
+    "fastify-plugin": "^4.0.0"
   },
   "tsd": {
     "directory": "test"

package/plugin.d.ts

@@ -99,11 +99,11 @@ export interface CookieSerializeOptions {
   path?: string;
   priority?: 'low' | 'medium' | 'high';
   sameSite?: boolean | 'lax' | 'strict' | 'none';
-  secure?: boolean;
+  secure?: boolean | 'auto';
   signed?: boolean;
 }
 
-interface Signer {
+export interface Signer {
   sign: (input: string) => string;
   unsign: (input: string) => {
     valid: boolean;
@@ -112,16 +112,22 @@ interface Signer {
   };
 }
 
-declare const signerFactory: Signer;
-declare const sign: (value: string, secret: string) => string;
-declare const unsign: (input: string, secret: string) => string | false;
-
 export interface FastifyCookieOptions {
   secret?: string | string[] | Signer;
   parseOptions?: CookieSerializeOptions;
 }
 
-declare const fastifyCookie: FastifyPluginCallback<NonNullable<FastifyCookieOptions>>;
+export type Sign  = (value: string, secret: string) => string;
+export type Unsign  = (input: string, secret: string) => string | false;
+export type SignerFactory = (secret: string) => Signer;
+
+export interface FastifyCookie extends FastifyPluginCallback<NonNullable<FastifyCookieOptions>>{
+  signerFactory: SignerFactory;
+  sign: Sign;
+  unsign: Unsign;
+}
+
+declare const fastifyCookie: FastifyCookie;
 
 export default fastifyCookie;
-export { fastifyCookie, signerFactory, sign, unsign };
+export { fastifyCookie };

package/plugin.js

@@ -16,6 +16,15 @@ function fastifyCookieSetCookie (reply, name, value, options, signer) {
     value = signer.sign(value)
   }
 
+  if (opts.secure === 'auto') {
+    if (isConnectionSecure(reply.request)) {
+      opts.secure = true
+    } else {
+      opts.sameSite = 'lax'
+      opts.secure = false
+    }
+  }
+
   const serialized = cookie.serialize(name, value, opts)
   let setCookie = reply.getHeader('Set-Cookie')
   if (!setCookie) {
@@ -96,6 +105,13 @@ function plugin (fastify, options, next) {
   }
 }
 
+function isConnectionSecure (request) {
+  return (
+    request.raw.socket?.encrypted === true ||
+    request.headers['x-forwarded-proto'] === 'https'
+  )
+}
+
 const fastifyCookie = fp(plugin, {
   fastify: '4.x',
   name: '@fastify/cookie'

package/test/cookie.test.js

@@ -776,3 +776,41 @@ test('create signed cookie manually using signCookie decorator', async (t) => {
   t.equal(res.statusCode, 200)
   t.same(JSON.parse(res.body), { unsigned: { value: 'bar', renew: false, valid: true } })
 })
+
+test('handle secure:auto of cookieOptions', async (t) => {
+  const fastify = Fastify()
+
+  await fastify.register(plugin)
+
+  fastify.get('/test1', (req, reply) => {
+    reply
+      .setCookie('foo', 'foo', { path: '/', secure: 'auto' })
+      .send()
+  })
+
+  const res = await fastify.inject({
+    method: 'GET',
+    url: '/test1',
+    headers: { 'x-forwarded-proto': 'https' }
+  })
+
+  const cookies = res.cookies
+  t.equal(cookies.length, 1)
+  t.equal(cookies[0].name, 'foo')
+  t.equal(cookies[0].value, 'foo')
+  t.equal(cookies[0].secure, true)
+  t.equal(cookies[0].path, '/')
+
+  const res2 = await fastify.inject({
+    method: 'GET',
+    url: '/test1'
+  })
+
+  const cookies2 = res2.cookies
+  t.equal(cookies2.length, 1)
+  t.equal(cookies2[0].name, 'foo')
+  t.equal(cookies2[0].value, 'foo')
+  t.equal(cookies2[0].sameSite, 'Lax')
+  t.same(cookies2[0].secure, null)
+  t.equal(cookies2[0].path, '/')
+})

package/test/plugin.test-d.ts

@@ -1,13 +1,10 @@
-import fastify, { FastifyInstance, FastifyPluginCallback, FastifyReply, setCookieWrapper } from 'fastify';
-import { Server } from 'http';
+import cookie from '../plugin';
 import { expectType } from 'tsd';
 import * as fastifyCookieStar from '..';
-import fastifyCookieDefault, {
-  fastifyCookie as fastifyCookieNamed
-} from '..';
-import cookie, { FastifyCookieOptions } from '../plugin';
-
 import fastifyCookieCjsImport = require('..');
+import fastifyCookieDefault, { fastifyCookie as fastifyCookieNamed  } from '..';
+import fastify, { FastifyInstance,  FastifyReply, setCookieWrapper } from 'fastify';
+
 const fastifyCookieCjs = require('..');
 
 const app: FastifyInstance = fastify();
@@ -19,16 +16,24 @@ app.register(fastifyCookieCjsImport.fastifyCookie);
 app.register(fastifyCookieStar.default);
 app.register(fastifyCookieStar.fastifyCookie);
 
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieNamed);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieDefault);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieCjsImport.default);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieCjsImport.fastifyCookie);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(fastifyCookieStar.default);
-expectType<FastifyPluginCallback<FastifyCookieOptions, Server>>(
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieNamed);
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieDefault);
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieCjsImport.default);
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieCjsImport.fastifyCookie);
+expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieStar.default);
+expectType<fastifyCookieStar.FastifyCookie>(
   fastifyCookieStar.fastifyCookie
 );
 expectType<any>(fastifyCookieCjs);
 
+expectType<fastifyCookieStar.Sign>(fastifyCookieDefault.sign);
+expectType<fastifyCookieStar.Unsign>(fastifyCookieDefault.unsign);
+expectType<fastifyCookieStar.SignerFactory >(fastifyCookieDefault.signerFactory );
+
+expectType<fastifyCookieStar.Sign>(fastifyCookieNamed.sign);
+expectType<fastifyCookieStar.Unsign>(fastifyCookieNamed.unsign);
+expectType<fastifyCookieStar.SignerFactory >(fastifyCookieNamed.signerFactory );
+
 const server = fastify();
 
 server.register(cookie);