@fastify/cookie 7.3.1 → 8.1.0

package/.github/workflows/ci.yml

@@ -14,4 +14,5 @@ jobs:
   test:
     uses: fastify/workflows/.github/workflows/plugins-ci.yml@v3
     with:
+      license-check: true
       lint: true

package/README.md

@@ -33,7 +33,8 @@ const fastify = require('fastify')()
 
 fastify.register(require('@fastify/cookie'), {
   secret: "my-secret", // for cookies signature
-  parseOptions: {}     // options for parsing cookies
+  hook: 'onRequest', // set to false to disable cookie autoparsing or set autoparsing on any of the following hooks: 'onRequest', 'preParsing', 'preHandler', 'preValidation'. default: 'onRequest'
+  parseOptions: {}  // options for parsing cookies
 })
 
 fastify.get('/', (req, reply) => {
@@ -192,9 +193,9 @@ fastify.register(require('@fastify/cookie'), {
 
 ### Manual cookie unsigning
 
-The method `unsignCookie(value)` is added to the `fastify` instance and the `reply` object
-via the Fastify `decorate` & `decorateReply` APIs. Using it on a signed cookie will call the
-the provided signer's (or the default signer if no custom implementation is provided) `unsign` method on the cookie.
+The method `unsignCookie(value)` is added to the `fastify` instance, to the `request` and the `reply` object
+via the Fastify `decorate`, `decorateRequest` and `decorateReply` APIs, if a secret was provided as option.
+Using it on a signed cookie will call the the provided signer's (or the default signer if no custom implementation is provided) `unsign` method on the cookie.
 
 **Example:**
 
@@ -236,12 +237,12 @@ test('Request requires signed cookie', async () => {
 
 ### Manual signing/unsigning with low level utilities
 
-with signerFactory
+with Signer
 
 ```js
-const { fastifyCookie } = require('@fastify/cookie');
+const { Signer } = require('@fastify/cookie');
 
-const signer = fastifyCookie.signerFactory('secret');
+const signer = new Signer('secret');
 const signedValue = signer.sign('test');
 const {valid, renew, value } = signer.unsign(signedValue);
 ```

package/benchmark/signer-multi.js

@@ -0,0 +1,18 @@
+const Benchmark = require('benchmark')
+const Signer = require('../signer')
+const suite = new Benchmark.Suite()
+
+const signer = Signer(['abcd', 'asdf', 'vadfa'])
+const signedValue = signer.sign('test', 'vadfa')
+
+suite
+  .add('sign', function () {
+    signer.sign('test')
+  })
+  .add('unsign', function () {
+    signer.unsign(signedValue)
+  })
+  .on('cycle', function (event) {
+    console.log(String(event.target))
+  })
+  .run({ delay: 0 })

package/benchmark/signer.js

@@ -0,0 +1,17 @@
+const Benchmark = require('benchmark')
+const Signer = require('../signer')
+const suite = new Benchmark.Suite()
+
+const signer = Signer('abcd')
+const signedValue = signer.sign('test')
+suite
+  .add('sign', function () {
+    signer.sign('test')
+  })
+  .add('unsign', function () {
+    signer.unsign(signedValue)
+  })
+  .on('cycle', function (event) {
+    console.log(String(event.target))
+  })
+  .run({ delay: 0 })

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@fastify/cookie",
-  "version": "7.3.1",
+  "version": "8.1.0",
   "description": "Plugin for fastify to add support for cookies",
   "main": "plugin.js",
-  "types": "plugin.d.ts",
+  "types": "types/plugin.d.ts",
   "scripts": {
     "lint": "standard | snazzy",
     "lint:ci": "standard",
@@ -39,19 +39,18 @@
   },
   "homepage": "https://github.com/fastify/fastify-cookie#readme",
   "devDependencies": {
+    "@fastify/pre-commit": "^2.0.2",
     "@types/node": "^18.0.0",
-    "fastify": "^4.0.0-rc.2",
-    "pre-commit": "^1.2.2",
+    "benchmark": "^2.1.4",
+    "fastify": "^4.0.0",
     "sinon": "^14.0.0",
     "snazzy": "^9.0.0",
     "standard": "^17.0.0",
     "tap": "^16.0.0",
-    "tsd": "^0.22.0",
-    "typescript": "^4.5.5"
+    "tsd": "^0.22.0"
   },
   "dependencies": {
     "cookie": "^0.5.0",
-    "cookie-signature": "^1.1.0",
     "fastify-plugin": "^4.0.0"
   },
   "tsd": {

package/plugin.js

@@ -1,10 +1,9 @@
 'use strict'
 
-const { sign, unsign } = require('cookie-signature')
 const fp = require('fastify-plugin')
 const cookie = require('cookie')
 
-const signerFactory = require('./signer')
+const { Signer, sign, unsign } = require('./signer')
 
 function fastifyCookieSetCookie (reply, name, value, options, signer) {
   const opts = Object.assign({}, options)
@@ -51,34 +50,70 @@ function fastifyCookieClearCookie (reply, name, options) {
   return fastifyCookieSetCookie(reply, name, '', opts)
 }
 
-function onReqHandlerWrapper (fastify) {
-  return function fastifyCookieOnReqHandler (fastifyReq, fastifyRes, done) {
-    fastifyReq.cookies = {} // New container per request. Issue #53
-    const cookieHeader = fastifyReq.raw.headers.cookie
-    if (cookieHeader) {
-      fastifyReq.cookies = fastify.parseCookie(cookieHeader)
+function onReqHandlerWrapper (fastify, hook) {
+  return hook === 'preParsing'
+    ? function fastifyCookieHandler (fastifyReq, fastifyRes, payload, done) {
+      fastifyReq.cookies = {} // New container per request. Issue #53
+      const cookieHeader = fastifyReq.raw.headers.cookie
+      if (cookieHeader) {
+        fastifyReq.cookies = fastify.parseCookie(cookieHeader)
+      }
+      done()
     }
-    done()
+    : function fastifyCookieHandler (fastifyReq, fastifyRes, done) {
+      fastifyReq.cookies = {} // New container per request. Issue #53
+      const cookieHeader = fastifyReq.raw.headers.cookie
+      if (cookieHeader) {
+        fastifyReq.cookies = fastify.parseCookie(cookieHeader)
+      }
+      done()
+    }
+}
+
+function getHook (hook = 'onRequest') {
+  const hooks = {
+    onRequest: 'onRequest',
+    preParsing: 'preParsing',
+    preValidation: 'preValidation',
+    preHandler: 'preHandler',
+    [false]: false
   }
+
+  return hooks[hook]
 }
 
 function plugin (fastify, options, next) {
-  const secret = options.secret || ''
+  const secret = options.secret
+  const hook = getHook(options.hook)
+  if (hook === undefined) {
+    return next(new Error('@fastify/cookie: Invalid value provided for the hook-option. You can set the hook-option only to false, \'onRequest\' , \'preParsing\' , \'preValidation\' or \'preHandler\''))
+  }
   const enableRotation = Array.isArray(secret)
-  const signer = typeof secret === 'string' || enableRotation ? signerFactory(secret) : secret
+  const algorithm = options.algorithm || 'sha256'
+  const signer = typeof secret === 'string' || enableRotation ? new Signer(secret, algorithm) : secret
 
   fastify.decorate('parseCookie', parseCookie)
-  fastify.decorate('signCookie', signCookie)
-  fastify.decorate('unsignCookie', unsignCookie)
+
+  if (typeof secret !== 'undefined') {
+    fastify.decorate('signCookie', signCookie)
+    fastify.decorate('unsignCookie', unsignCookie)
+
+    fastify.decorateRequest('signCookie', signCookie)
+    fastify.decorateRequest('unsignCookie', unsignCookie)
+
+    fastify.decorateReply('signCookie', signCookie)
+    fastify.decorateReply('unsignCookie', unsignCookie)
+  }
 
   fastify.decorateRequest('cookies', null)
-  fastify.decorateRequest('unsignCookie', unsignCookie)
-  fastify.decorateReply('setCookie', setCookie)
   fastify.decorateReply('cookie', setCookie)
+
+  fastify.decorateReply('setCookie', setCookie)
   fastify.decorateReply('clearCookie', clearCookie)
-  fastify.decorateReply('unsignCookie', unsignCookie)
 
-  fastify.addHook('onRequest', onReqHandlerWrapper(fastify))
+  if (hook) {
+    fastify.addHook(hook, onReqHandlerWrapper(fastify, hook))
+  }
 
   next()
 
@@ -127,14 +162,17 @@ const fastifyCookie = fp(plugin, {
  * - `import { fastifyCookie } from 'fastify-cookie'`
  * - `import fastifyCookie from 'fastify-cookie'`
  */
+fastifyCookie.signerFactory = Signer
 fastifyCookie.fastifyCookie = fastifyCookie
 fastifyCookie.default = fastifyCookie
 module.exports = fastifyCookie
 
-fastifyCookie.fastifyCookie.signerFactory = signerFactory
+fastifyCookie.fastifyCookie.signerFactory = Signer
+fastifyCookie.fastifyCookie.Signer = Signer
 fastifyCookie.fastifyCookie.sign = sign
 fastifyCookie.fastifyCookie.unsign = unsign
 
-module.exports.signerFactory = signerFactory
+module.exports.signerFactory = Signer
+module.exports.Signer = Signer
 module.exports.sign = sign
 module.exports.unsign = unsign

package/signer.js

@@ -1,32 +1,116 @@
 'use strict'
 
-const cookieSignature = require('cookie-signature')
+// Inspired by node-cookie-signature
+// https://github.com/tj/node-cookie-signature
+//
+// The MIT License
+// Copyright (c) 2012–2022 LearnBoost <tj@learnboost.com> and other contributors;
 
-module.exports = function (secret) {
-  const secrets = Array.isArray(secret) ? secret : [secret]
-  const [signingKey] = secrets
+const crypto = require('crypto')
 
-  return {
-    sign (value) {
-      return cookieSignature.sign(value, signingKey)
-    },
-    unsign (signedValue) {
-      let valid = false
-      let renew = false
-      let value = null
-
-      for (const key of secrets) {
-        const result = cookieSignature.unsign(signedValue, key)
-
-        if (result !== false) {
-          valid = true
-          renew = key !== signingKey
-          value = result
-          break
-        }
-      }
+const base64PaddingRE = /=/g
+
+function Signer (secrets, algorithm = 'sha256') {
+  if (!(this instanceof Signer)) {
+    return new Signer(secrets, algorithm)
+  }
 
-      return { valid, renew, value }
+  this.secrets = Array.isArray(secrets) ? secrets : [secrets]
+  this.signingKey = this.secrets[0]
+  this.algorithm = algorithm
+
+  validateSecrets(this.secrets)
+  validateAlgorithm(this.algorithm)
+}
+
+function validateSecrets (secrets) {
+  for (const secret of secrets) {
+    if (typeof secret !== 'string') {
+      throw new TypeError('Secret key must be a string.')
     }
   }
 }
+
+function validateAlgorithm (algorithm) {
+  // validate that the algorithm is supported by the node runtime
+  try {
+    crypto.createHmac(algorithm, crypto.randomBytes(16))
+  } catch (e) {
+    throw new TypeError(`Algorithm ${algorithm} not supported.`)
+  }
+}
+
+function _sign (value, secret, algorithm) {
+  if (typeof value !== 'string') {
+    throw new TypeError('Cookie value must be provided as a string.')
+  }
+  return value + '.' + crypto
+    .createHmac(algorithm, secret)
+    .update(value)
+    .digest('base64')
+    // remove base64 padding (=) as it has special meaning in cookies
+    .replace(base64PaddingRE, '')
+}
+
+function _unsign (signedValue, secrets, algorithm) {
+  if (typeof signedValue !== 'string') {
+    throw new TypeError('Signed cookie string must be provided.')
+  }
+  const value = signedValue.slice(0, signedValue.lastIndexOf('.'))
+  const actual = Buffer.from(signedValue.slice(signedValue.lastIndexOf('.') + 1))
+
+  for (const secret of secrets) {
+    const expected = Buffer.from(crypto
+      .createHmac(algorithm, secret)
+      .update(value)
+      .digest('base64')
+      // remove base64 padding (=) as it has special meaning in cookies
+      .replace(base64PaddingRE, ''))
+    if (
+      expected.length === actual.length &&
+      crypto.timingSafeEqual(expected, actual)
+    ) {
+      return {
+        valid: true,
+        renew: secret !== secrets[0],
+        value
+      }
+    }
+  }
+
+  return {
+    valid: false,
+    renew: false,
+    value: null
+  }
+}
+
+Signer.prototype.sign = function (value) {
+  return _sign(value, this.signingKey, this.algorithm)
+}
+
+Signer.prototype.unsign = function (signedValue) {
+  return _unsign(signedValue, this.secrets, this.algorithm)
+}
+
+function sign (value, secret, algorithm = 'sha256') {
+  const secrets = Array.isArray(secret) ? secret : [secret]
+
+  validateSecrets(secrets)
+
+  return _sign(value, secrets[0], algorithm)
+}
+
+function unsign (signedValue, secret, algorithm = 'sha256') {
+  const secrets = Array.isArray(secret) ? secret : [secret]
+
+  validateSecrets(secrets)
+
+  return _unsign(signedValue, secrets, algorithm)
+}
+
+module.exports = Signer
+module.exports.signerFactory = Signer
+module.exports.Signer = Signer
+module.exports.sign = sign
+module.exports.unsign = unsign

package/test/cookie.test.js

@@ -4,7 +4,7 @@ const tap = require('tap')
 const test = tap.test
 const Fastify = require('fastify')
 const sinon = require('sinon')
-const cookieSignature = require('cookie-signature')
+const { sign, unsign } = require('../signer')
 const plugin = require('../')
 
 test('cookies get set correctly', (t) => {
@@ -151,7 +151,7 @@ test('share options for setCookie and clearCookie', (t) => {
     const cookies = res.cookies
     t.equal(cookies.length, 2)
     t.equal(cookies[0].name, 'foo')
-    t.equal(cookies[0].value, cookieSignature.sign('foo', secret))
+    t.equal(cookies[0].value, sign('foo', secret))
     t.equal(cookies[0].maxAge, 36000)
 
     t.equal(cookies[1].name, 'foo')
@@ -190,7 +190,7 @@ test('expires should not be overridden in clearCookie', (t) => {
     const cookies = res.cookies
     t.equal(cookies.length, 2)
     t.equal(cookies[0].name, 'foo')
-    t.equal(cookies[0].value, cookieSignature.sign('foo', secret))
+    t.equal(cookies[0].value, sign('foo', secret))
     const expires = new Date(cookies[0].expires)
     t.ok(expires < new Date(Date.now() + 5000))
 
@@ -378,7 +378,7 @@ test('cookies signature', (t) => {
       const cookies = res.cookies
       t.equal(cookies.length, 1)
       t.equal(cookies[0].name, 'foo')
-      t.equal(cookieSignature.unsign(cookies[0].value, secret), 'foo')
+      t.same(unsign(cookies[0].value, secret), { valid: true, renew: false, value: 'foo' })
     })
   })
 
@@ -406,7 +406,7 @@ test('cookies signature', (t) => {
       const cookies = res.cookies
       t.equal(cookies.length, 1)
       t.equal(cookies[0].name, 'foo')
-      t.equal(cookieSignature.unsign(cookies[0].value, secret1), 'cookieVal') // decode using first key
+      t.same(unsign(cookies[0].value, secret1), { valid: true, renew: false, value: 'cookieVal' }) // decode using first key
     })
   })
 
@@ -427,7 +427,7 @@ test('cookies signature', (t) => {
       method: 'GET',
       url: '/test1',
       headers: {
-        cookie: `foo=${cookieSignature.sign('foo', secret)}`
+        cookie: `foo=${sign('foo', secret)}`
       }
     }, (err, res) => {
       t.error(err)
@@ -452,7 +452,7 @@ test('cookies signature', (t) => {
       method: 'GET',
       url: '/test1',
       headers: {
-        cookie: `foo=${cookieSignature.sign('foo', secret)}`
+        cookie: `foo=${sign('foo', secret)}`
       }
     }, (err, res) => {
       t.error(err)
@@ -477,7 +477,7 @@ test('cookies signature', (t) => {
       method: 'GET',
       url: '/test1',
       headers: {
-        cookie: `foo=${cookieSignature.sign('foo', secret)}`
+        cookie: `foo=${sign('foo', secret)}`
       }
     }, (err, res) => {
       t.error(err)
@@ -503,7 +503,7 @@ test('cookies signature', (t) => {
       method: 'GET',
       url: '/test1',
       headers: {
-        cookie: `foo=${cookieSignature.sign('foo', secret2)}`
+        cookie: `foo=${sign('foo', secret2)}`
       }
     }, (err, res) => {
       t.error(err)
@@ -529,7 +529,7 @@ test('cookies signature', (t) => {
       method: 'GET',
       url: '/test1',
       headers: {
-        cookie: `foo=${cookieSignature.sign('foo', secret2)}`
+        cookie: `foo=${sign('foo', secret2)}`
       }
     }, (err, res) => {
       t.error(err)
@@ -555,7 +555,7 @@ test('cookies signature', (t) => {
       method: 'GET',
       url: '/test1',
       headers: {
-        cookie: `foo=${cookieSignature.sign('foo', 'invalid-secret')}`
+        cookie: `foo=${sign('foo', 'invalid-secret')}`
       }
     }, (err, res) => {
       t.error(err)
@@ -581,7 +581,7 @@ test('cookies signature', (t) => {
       method: 'GET',
       url: '/test1',
       headers: {
-        cookie: `foo=${cookieSignature.sign('foo', 'invalid-secret')}`
+        cookie: `foo=${sign('foo', 'invalid-secret')}`
       }
     }, (err, res) => {
       t.error(err)
@@ -814,3 +814,131 @@ test('handle secure:auto of cookieOptions', async (t) => {
   t.same(cookies2[0].secure, null)
   t.equal(cookies2[0].path, '/')
 })
+
+test('should not decorate fastify, request and reply if no secret was provided', async (t) => {
+  t.plan(8)
+  const fastify = Fastify()
+
+  await fastify.register(plugin)
+
+  t.notOk(fastify.signCookie)
+  t.notOk(fastify.unsignCookie)
+
+  fastify.get('/testDecorators', (req, reply) => {
+    t.notOk(req.signCookie)
+    t.notOk(reply.signCookie)
+    t.notOk(req.unsignCookie)
+    t.notOk(reply.unsignCookie)
+
+    reply.send({
+      unsigned: req.unsignCookie(req.cookies.foo)
+    })
+  })
+
+  const res = await fastify.inject({
+    method: 'GET',
+    url: '/testDecorators'
+  })
+
+  t.equal(res.statusCode, 500)
+  t.same(JSON.parse(res.body), {
+    statusCode: 500,
+    error: 'Internal Server Error',
+    message: 'req.unsignCookie is not a function'
+  })
+})
+
+test('dont add auto cookie parsing to onRequest-hook if hook-option is set to false', (t) => {
+  t.plan(6)
+  const fastify = Fastify()
+  fastify.register(plugin, { hook: false })
+
+  for (const hook of ['preValidation', 'preHandler', 'preParsing']) {
+    fastify.addHook(hook, async (req) => {
+      t.equal(req.cookies, null)
+    })
+  }
+
+  fastify.get('/disable', (req, reply) => {
+    t.equal(req.cookies, null)
+    reply.send()
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/disable',
+    headers: {
+      cookie: 'bar=bar'
+    }
+  }, (err, res) => {
+    t.error(err)
+    t.equal(res.statusCode, 200)
+  })
+})
+
+test('result in an error if hook-option is set to an invalid value', (t) => {
+  t.plan(1)
+  const fastify = Fastify()
+
+  t.rejects(
+    () => fastify.register(plugin, { hook: true }),
+    new Error("@fastify/cookie: Invalid value provided for the hook-option. You can set the hook-option only to false, 'onRequest' , 'preParsing' , 'preValidation' or 'preHandler'")
+  )
+})
+
+test('correct working plugin if hook-option to preParsing', (t) => {
+  t.plan(5)
+  const fastify = Fastify()
+  fastify.register(plugin, { hook: 'preParsing' })
+
+  fastify.addHook('onRequest', async (req) => {
+    t.equal(req.cookies, null)
+  })
+
+  fastify.addHook('preValidation', async (req) => {
+    t.equal(req.cookies.bar, 'bar')
+  })
+
+  fastify.get('/preparsing', (req, reply) => {
+    t.equal(req.cookies.bar, 'bar')
+    reply.send()
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/preparsing',
+    headers: {
+      cookie: 'bar=bar'
+    }
+  }, (err, res) => {
+    t.error(err)
+    t.equal(res.statusCode, 200)
+  })
+})
+
+test('if cookies are not set, then the handler creates an empty req.cookies object', (t) => {
+  t.plan(5)
+  const fastify = Fastify()
+  fastify.register(plugin, { hook: 'preParsing' })
+
+  fastify.addHook('onRequest', async (req) => {
+    t.equal(req.cookies, null)
+  })
+
+  fastify.addHook('preValidation', async (req) => {
+    t.ok(req.cookies)
+  })
+
+  fastify.get('/preparsing', (req, reply) => {
+    t.ok(req.cookies)
+    reply.send()
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/preparsing'
+  }, (err, res) => {
+    t.error(err)
+    t.equal(res.statusCode, 200)
+  })
+})

package/test/signer.test.js

@@ -2,33 +2,67 @@
 
 const { test } = require('tap')
 const sinon = require('sinon')
-const cookieSignature = require('cookie-signature')
-const signerFactory = require('../signer')
+const crypto = require('crypto')
+const { Signer, sign, unsign } = require('../signer')
 
-test('default', (t) => {
-  t.plan(2)
+test('default', t => {
+  t.plan(5)
 
   const secret = 'my-secret'
-  const signer = signerFactory(secret)
+  const signer = Signer(secret)
 
-  t.test('signer.sign', (t) => {
+  t.test('signer.sign should throw if there is no value provided', (t) => {
     t.plan(1)
 
+    t.throws(() => signer.sign(undefined), 'Cookie value must be provided as a string.')
+  })
+
+  t.test('signer.sign', (t) => {
+    t.plan(2)
+
     const input = 'some-value'
     const result = signer.sign(input)
 
-    t.equal(result, cookieSignature.sign(input, secret))
+    t.equal(result, sign(input, secret))
+    t.throws(() => sign(undefined), 'Cookie value must be provided as a string.')
   })
 
-  t.test('signer.unsign', (t) => {
+  t.test('sign', (t) => {
     t.plan(3)
 
-    const input = cookieSignature.sign('some-value', secret)
+    const input = 'some-value'
+    const result = signer.sign(input)
+
+    t.equal(result, sign(input, secret))
+    t.equal(result, sign(input, [secret]))
+
+    t.throws(() => sign(undefined), 'Cookie value must be provided as a string.')
+  })
+
+  t.test('signer.unsign', (t) => {
+    t.plan(4)
+
+    const input = signer.sign('some-value', secret)
     const result = signer.unsign(input)
 
     t.equal(result.valid, true)
     t.equal(result.renew, false)
     t.equal(result.value, 'some-value')
+    t.throws(() => signer.unsign(undefined), 'Signed cookie string must be provided.')
+  })
+
+  t.test('unsign', (t) => {
+    t.plan(6)
+
+    const input = sign('some-value', secret)
+    const result = unsign(input, secret)
+
+    t.equal(result.valid, true)
+    t.equal(result.renew, false)
+    t.equal(result.value, 'some-value')
+    t.same(result, unsign(input, [secret]))
+    t.throws(() => unsign(undefined), 'Secret key must be a string.')
+    t.throws(() => unsign(undefined, secret), 'Signed cookie string must be provided.')
   })
 })
 
@@ -37,11 +71,11 @@ test('key rotation', (t) => {
   const secret1 = 'my-secret-1'
   const secret2 = 'my-secret-2'
   const secret3 = 'my-secret-3'
-  const signer = signerFactory([secret1, secret2, secret3])
-  const unsignSpy = sinon.spy(cookieSignature, 'unsign')
+  const signer = Signer([secret1, secret2, secret3])
+  const signSpy = sinon.spy(crypto, 'createHmac')
 
   t.beforeEach(() => {
-    unsignSpy.resetHistory()
+    signSpy.resetHistory()
   })
 
   t.test('signer.sign always signs using first key', (t) => {
@@ -50,30 +84,51 @@ test('key rotation', (t) => {
     const input = 'some-value'
     const result = signer.sign(input)
 
-    t.equal(result, cookieSignature.sign(input, secret1))
+    t.equal(result, sign(input, secret1))
   })
 
   t.test('signer.unsign tries to decode using all keys till it finds', (t) => {
     t.plan(4)
 
-    const input = cookieSignature.sign('some-value', secret2)
+    const input = sign('some-value', secret2)
+    signSpy.resetHistory()
     const result = signer.unsign(input)
 
     t.equal(result.valid, true)
     t.equal(result.renew, true)
     t.equal(result.value, 'some-value')
-    t.equal(unsignSpy.callCount, 2) // should have returned early when the right key was found
+    t.equal(signSpy.callCount, 2) // should have returned early when the right key was found
   })
 
   t.test('signer.unsign failure response', (t) => {
     t.plan(4)
 
-    const input = cookieSignature.sign('some-value', 'invalid-secret')
+    const input = sign('some-value', 'invalid-secret')
+    signSpy.resetHistory()
     const result = signer.unsign(input)
 
     t.equal(result.valid, false)
     t.equal(result.renew, false)
     t.equal(result.value, null)
-    t.equal(unsignSpy.callCount, 3) // should have tried all 3
+    t.equal(signSpy.callCount, 3) // should have tried all 3
+  })
+})
+
+test('Signer', t => {
+  t.plan(2)
+
+  t.test('Signer needs a string as secret', (t) => {
+    t.plan(4)
+    t.throws(() => Signer(1), 'Secret key must be a string.')
+    t.throws(() => Signer(undefined), 'Secret key must be a string.')
+    t.doesNotThrow(() => Signer('secret'))
+    t.doesNotThrow(() => Signer(['secret']))
+  })
+
+  t.test('Signer handles algorithm properly', (t) => {
+    t.plan(3)
+    t.throws(() => Signer('secret', 'invalid'), 'Algorithm invalid not supported.')
+    t.doesNotThrow(() => Signer('secret', 'sha512'))
+    t.doesNotThrow(() => Signer('secret', 'sha256'))
   })
 })

package/{plugin.d.ts → types/plugin.d.ts}

@@ -3,16 +3,7 @@
 import { FastifyPluginCallback } from "fastify";
 
 declare module "fastify" {
-  interface FastifyInstance {
-    /**
-     * Unsigns the specified cookie using the secret provided.
-     * @param value Cookie value
-     */
-    unsignCookie(value: string): {
-      valid: boolean;
-      renew: boolean;
-      value: string | null;
-    };
+  interface FastifyInstance extends SignerMethods {
     /**
      * Manual cookie parsing method
      * @docs https://github.com/fastify/fastify-cookie#manual-cookie-parsing
@@ -21,29 +12,34 @@ declare module "fastify" {
     parseCookie(cookieHeader: string): {
       [key: string]: string;
     };
+  }
+
+  interface FastifyRequest extends SignerMethods {
     /**
-     * Manual cookie signing method
-     * @docs https://github.com/fastify/fastify-cookie#manual-cookie-parsing
-     * @param value cookie value
+     * Request cookies
      */
-    signCookie(value: string): string;
+    cookies: { [cookieName: string]: string | undefined };
   }
 
-  interface FastifyRequest {
+  interface FastifyReply extends SignerMethods {
     /**
      * Request cookies
      */
     cookies: { [cookieName: string]: string | undefined };
+  }
 
+  interface SignerMethods {
     /**
-     * Unsigns the specified cookie using the secret provided.
+     * Signs the specified cookie using the secret/signer provided.
+     * @param value cookie value
+     */
+     signCookie(value: string): string;
+
+    /**
+     * Unsigns the specified cookie using the secret/signer provided.
      * @param value Cookie value
      */
-    unsignCookie(value: string): {
-      valid: boolean;
-      renew: boolean;
-      value: string | null;
-    };
+    unsignCookie(value: string): fastifyCookie.UnsignResult;
   }
 
   export type setCookieWrapper = (
@@ -89,11 +85,7 @@ declare module "fastify" {
      * Unsigns the specified cookie using the secret provided.
      * @param value Cookie value
      */
-    unsignCookie(value: string): {
-      valid: boolean;
-      renew: boolean;
-      value: string | null;
-    };
+    unsignCookie(value: string): fastifyCookie.UnsignResult;
   }
 }
 
@@ -102,36 +94,54 @@ type FastifyCookiePlugin = FastifyPluginCallback<
 >;
 
 declare namespace fastifyCookie {
-  export interface Signer {
-    sign: (input: string) => string;
-    unsign: (input: string) => {
-      valid: boolean;
-      renew: boolean;
-      value: string | null;
-    };
+  interface SignerBase {
+    sign: (value: string) => string;
+    unsign: (input: string) => UnsignResult;
+  }
+
+  export class Signer implements SignerBase {
+    constructor (secrets: string | Array<string>, algorithm?: string)
+    sign: (value: string) => string;
+    unsign: (input: string) => UnsignResult;
   }
 
   export interface CookieSerializeOptions {
+    /**  The `Domain` attribute. */
     domain?: string;
     encode?(val: string): string;
+    /**  The expiration `date` used for the `Expires` attribute. If both `expires` and `maxAge` are set, then `expires` is used. */
     expires?: Date;
+    /**  The `boolean` value of the `HttpOnly` attribute. Defaults to true. */
     httpOnly?: boolean;
+    /**  A `number` in milliseconds that specifies the `Expires` attribute by adding the specified milliseconds to the current date. If both `expires` and `maxAge` are set, then `expires` is used. */
     maxAge?: number;
+    /**  The `Path` attribute. Defaults to `/` (the root path).  */
     path?: string;
     priority?: "low" | "medium" | "high";
-    sameSite?: boolean | "lax" | "strict" | "none";
-    secure?: boolean;
+    /** A `boolean` or one of the `SameSite` string attributes. E.g.: `lax`, `node` or `strict`.  */
+    sameSite?: 'lax' | 'none' | 'strict' | boolean;
+    /**  The `boolean` value of the `Secure` attribute. Set this option to false when communicating over an unencrypted (HTTP) connection. Value can be set to `auto`; in this case the `Secure` attribute will be set to false for HTTP request, in case of HTTPS it will be set to true.  Defaults to true. */
+    secure?: boolean | 'auto';
     signed?: boolean;
   }
 
+  type HookType = 'onRequest' | 'preParsing' | 'preValidation' | 'preHandler'  | 'preSerialization';
+
   export interface FastifyCookieOptions {
     secret?: string | string[] | Signer;
+    hook?: HookType | false;
     parseOptions?: fastifyCookie.CookieSerializeOptions;
   }
 
-  export type Sign = (value: string, secret: string) => string;
-  export type Unsign = (input: string, secret: string) => string | false;
-  export type SignerFactory = (secret: string) => Signer;
+  export type Sign = (value: string, secret: string, algorithm?: string) => string;
+  export type Unsign = (input: string, secret: string, algorithm?: string) => UnsignResult;
+  export type SignerFactory = (secrets: string | Array<string>, algorithm?: string) => SignerBase;
+
+  export interface UnsignResult {
+    valid: boolean;
+    renew: boolean;
+    value: string | null;
+  }
 
   export const signerFactory: SignerFactory;
   export const sign: Sign;
@@ -139,6 +149,7 @@ declare namespace fastifyCookie {
 
   export interface FastifyCookie extends FastifyCookiePlugin {
     signerFactory: SignerFactory;
+    Signer: Signer;
     sign: Sign;
     unsign: Unsign;
   }
@@ -146,7 +157,8 @@ declare namespace fastifyCookie {
   export const fastifyCookie: FastifyCookie;
 
   export interface FastifyCookieOptions {
-    secret?: string | string[] | Signer;
+    secret?: string | string[] | SignerBase;
+    algorithm?: string;
     parseOptions?: CookieSerializeOptions;
   }
 
@@ -157,4 +169,4 @@ declare function fastifyCookie(
   ...params: Parameters<FastifyCookiePlugin>
 ): ReturnType<FastifyCookiePlugin>;
 
-export = fastifyCookie;
+export = fastifyCookie;

package/{test → types}/plugin.test-d.ts

@@ -1,9 +1,10 @@
-import cookie from '../plugin';
-import { expectType } from 'tsd';
+import cookie from '..';
+import { expectError, expectType } from 'tsd';
 import * as fastifyCookieStar from '..';
 import fastifyCookieCjsImport = require('..');
 import fastifyCookieDefault, { fastifyCookie as fastifyCookieNamed  } from '..';
-import fastify, { FastifyInstance,  FastifyReply, setCookieWrapper } from 'fastify';
+import fastify, { FastifyInstance,  FastifyPluginCallback,  FastifyReply, setCookieWrapper } from 'fastify';
+import { Server } from 'http';
 
 const fastifyCookieCjs = require('..');
 
@@ -58,6 +59,16 @@ server.after((_err) => {
         .send({ hello: 'world' })
     );
   });
+
+  expectType<(value: string) => string>(server.signCookie)
+  expectType<(value: string) => fastifyCookieStar.UnsignResult>(server.unsignCookie)
+
+  server.get('/', (request, reply) => {
+    expectType<(value: string) => string>(request.signCookie)
+    expectType<(value: string) => string>(reply.signCookie)
+    expectType<(value: string) => fastifyCookieStar.UnsignResult>(request.unsignCookie)
+    expectType<(value: string) => fastifyCookieStar.UnsignResult>(reply.unsignCookie)
+  });
 });
 
 const serverWithHttp2 = fastify({ http2: true });
@@ -109,6 +120,10 @@ const appWithImplicitHttpSigned = fastify();
 appWithImplicitHttpSigned.register(cookie, {
   secret: 'testsecret',
 });
+appWithImplicitHttpSigned.register(cookie, {
+  secret: 'testsecret',
+  algorithm: 'sha512'
+});
 appWithImplicitHttpSigned.after(() => {
   server.get('/', (request, reply) => {
     appWithImplicitHttpSigned.unsignCookie(request.cookies.test!);
@@ -194,3 +209,20 @@ appWithCustomSigner.after(() => {
     reply.send({ hello: 'world' })
   })
 })
+
+new fastifyCookieStar.Signer('secretString')
+new fastifyCookieStar.Signer(['secretStringInArray'])
+const signer = new fastifyCookieStar.Signer(['secretStringInArray'], 'sha256')
+signer.sign('Lorem Ipsum')
+signer.unsign('Lorem Ipsum')
+
+const appWithHook: FastifyInstance = fastify();
+
+appWithHook.register(cookie, { hook: false });
+appWithHook.register(cookie, { hook: 'onRequest' });
+appWithHook.register(cookie, { hook: 'preHandler' });
+appWithHook.register(cookie, { hook: 'preParsing' });
+appWithHook.register(cookie, { hook: 'preSerialization' });
+appWithHook.register(cookie, { hook: 'preValidation' });
+expectError(appWithHook.register(cookie, { hook: true }));
+expectError(appWithHook.register(cookie, { hook: 'false' }));