@fastify/cookie 8.1.0 → 8.3.0

package/README.md

@@ -72,8 +72,8 @@ app.register(cookie, {
 
 ## Options
 
-- `secret` (`String` | `Array` | `Object`):
-  - A `String` can be passed to use as secret to sign the cookie using [`cookie-signature`](http://npm.im/cookie-signature).
+- `secret` (`String` | `Array` | `Buffer` | `Object`):
+  - A `String` or `Buffer` can be passed to use as secret to sign the cookie using [`cookie-signature`](http://npm.im/cookie-signature).
   - An `Array` can be passed if key rotation is desired. Read more about it in [Rotating signing secret](#rotating-secret).
   - More sophisticated cookie signing mechanisms can be implemented by supplying an `Object`. Read more about it in [Custom cookie signer](#custom-cookie-signer).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/cookie",
-  "version": "8.1.0",
+  "version": "8.3.0",
   "description": "Plugin for fastify to add support for cookies",
   "main": "plugin.js",
   "types": "types/plugin.d.ts",
@@ -47,7 +47,7 @@
     "snazzy": "^9.0.0",
     "standard": "^17.0.0",
     "tap": "^16.0.0",
-    "tsd": "^0.22.0"
+    "tsd": "^0.24.1"
   },
   "dependencies": {
     "cookie": "^0.5.0",

package/plugin.js

@@ -42,7 +42,7 @@ function fastifyCookieSetCookie (reply, name, value, options, signer) {
 }
 
 function fastifyCookieClearCookie (reply, name, options) {
-  const opts = Object.assign({ path: '/' }, options || { }, {
+  const opts = Object.assign({ path: '/' }, options, {
     expires: new Date(1),
     signed: undefined,
     maxAge: undefined
@@ -88,9 +88,9 @@ function plugin (fastify, options, next) {
   if (hook === undefined) {
     return next(new Error('@fastify/cookie: Invalid value provided for the hook-option. You can set the hook-option only to false, \'onRequest\' , \'preParsing\' , \'preValidation\' or \'preHandler\''))
   }
-  const enableRotation = Array.isArray(secret)
+  const isSigner = !secret || (typeof secret.sign === 'function' && typeof secret.unsign === 'function')
   const algorithm = options.algorithm || 'sha256'
-  const signer = typeof secret === 'string' || enableRotation ? new Signer(secret, algorithm) : secret
+  const signer = isSigner ? secret : new Signer(secret, algorithm)
 
   fastify.decorate('parseCookie', parseCookie)
 
@@ -135,8 +135,9 @@ function plugin (fastify, options, next) {
     return fastifyCookieSetCookie(this, name, value, opts, signer)
   }
 
-  function clearCookie (name, options) {
-    return fastifyCookieClearCookie(this, name, options)
+  function clearCookie (name, cookieOptions) {
+    const opts = Object.assign({}, options.parseOptions, cookieOptions)
+    return fastifyCookieClearCookie(this, name, opts)
   }
 }
 

package/signer.js

@@ -25,8 +25,8 @@ function Signer (secrets, algorithm = 'sha256') {
 
 function validateSecrets (secrets) {
   for (const secret of secrets) {
-    if (typeof secret !== 'string') {
-      throw new TypeError('Secret key must be a string.')
+    if (typeof secret !== 'string' && Buffer.isBuffer(secret) === false) {
+      throw new TypeError('Secret key must be a string or Buffer.')
     }
   }
 }

package/test/cookie.test.js

@@ -942,3 +942,51 @@ test('if cookies are not set, then the handler creates an empty req.cookies obje
     t.equal(res.statusCode, 200)
   })
 })
+
+test('clearCookie should include parseOptions', (t) => {
+  t.plan(14)
+  const fastify = Fastify()
+  fastify.register(plugin, {
+    parseOptions: {
+      path: '/test',
+      domain: 'example.com'
+    }
+  })
+
+  const cookieOptions = {
+    path: '/test',
+    maxAge: 36000
+  }
+
+  fastify.get('/test1', (req, reply) => {
+    reply
+      .setCookie('foo', 'foo', cookieOptions)
+      .clearCookie('foo', cookieOptions)
+      .send({ hello: 'world' })
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/test1'
+  }, (err, res) => {
+    t.error(err)
+    t.equal(res.statusCode, 200)
+    t.same(JSON.parse(res.body), { hello: 'world' })
+
+    const cookies = res.cookies
+
+    t.equal(cookies.length, 2)
+    t.equal(cookies[0].name, 'foo')
+    t.equal(cookies[0].value, 'foo')
+    t.equal(cookies[0].maxAge, 36000)
+    t.equal(cookies[0].path, '/test')
+    t.equal(cookies[0].domain, 'example.com')
+
+    t.equal(cookies[1].name, 'foo')
+    t.equal(cookies[1].value, '')
+    t.equal(cookies[1].path, '/test')
+    t.equal(cookies[1].domain, 'example.com')
+
+    t.ok(new Date(cookies[1].expires) < new Date())
+  })
+})

package/test/signer.test.js

@@ -28,13 +28,15 @@ test('default', t => {
   })
 
   t.test('sign', (t) => {
-    t.plan(3)
+    t.plan(5)
 
     const input = 'some-value'
     const result = signer.sign(input)
 
     t.equal(result, sign(input, secret))
     t.equal(result, sign(input, [secret]))
+    t.equal(result, sign(input, Buffer.from(secret)))
+    t.equal(result, sign(input, [Buffer.from(secret)]))
 
     t.throws(() => sign(undefined), 'Cookie value must be provided as a string.')
   })
@@ -61,7 +63,7 @@ test('default', t => {
     t.equal(result.renew, false)
     t.equal(result.value, 'some-value')
     t.same(result, unsign(input, [secret]))
-    t.throws(() => unsign(undefined), 'Secret key must be a string.')
+    t.throws(() => unsign(undefined), 'Secret key must be a string or Buffer.')
     t.throws(() => unsign(undefined, secret), 'Signed cookie string must be provided.')
   })
 })
@@ -117,12 +119,14 @@ test('key rotation', (t) => {
 test('Signer', t => {
   t.plan(2)
 
-  t.test('Signer needs a string as secret', (t) => {
-    t.plan(4)
-    t.throws(() => Signer(1), 'Secret key must be a string.')
-    t.throws(() => Signer(undefined), 'Secret key must be a string.')
+  t.test('Signer needs a string or Buffer as secret', (t) => {
+    t.plan(6)
+    t.throws(() => Signer(1), 'Secret key must be a string or Buffer.')
+    t.throws(() => Signer(undefined), 'Secret key must be a string or Buffer.')
     t.doesNotThrow(() => Signer('secret'))
     t.doesNotThrow(() => Signer(['secret']))
+    t.doesNotThrow(() => Signer(Buffer.from('deadbeef76543210', 'hex')))
+    t.doesNotThrow(() => Signer([Buffer.from('deadbeef76543210', 'hex')]))
   })
 
   t.test('Signer handles algorithm properly', (t) => {

package/types/plugin.d.ts

@@ -100,7 +100,7 @@ declare namespace fastifyCookie {
   }
 
   export class Signer implements SignerBase {
-    constructor (secrets: string | Array<string>, algorithm?: string)
+    constructor (secrets: string | Array<string> | Buffer | Array<Buffer>, algorithm?: string)
     sign: (value: string) => string;
     unsign: (input: string) => UnsignResult;
   }
@@ -128,14 +128,14 @@ declare namespace fastifyCookie {
   type HookType = 'onRequest' | 'preParsing' | 'preValidation' | 'preHandler'  | 'preSerialization';
 
   export interface FastifyCookieOptions {
-    secret?: string | string[] | Signer;
+    secret?: string | string[] | Buffer | Buffer[] | Signer;
     hook?: HookType | false;
     parseOptions?: fastifyCookie.CookieSerializeOptions;
   }
 
-  export type Sign = (value: string, secret: string, algorithm?: string) => string;
-  export type Unsign = (input: string, secret: string, algorithm?: string) => UnsignResult;
-  export type SignerFactory = (secrets: string | Array<string>, algorithm?: string) => SignerBase;
+  export type Sign = (value: string, secret: string | Buffer, algorithm?: string) => string;
+  export type Unsign = (input: string, secret: string | Buffer, algorithm?: string) => UnsignResult;
+  export type SignerFactory = (secrets: string | string[] | Buffer | Buffer[], algorithm?: string) => SignerBase;
 
   export interface UnsignResult {
     valid: boolean;
@@ -157,7 +157,7 @@ declare namespace fastifyCookie {
   export const fastifyCookie: FastifyCookie;
 
   export interface FastifyCookieOptions {
-    secret?: string | string[] | SignerBase;
+    secret?: string | string[] | Buffer | Buffer[] | SignerBase;
     algorithm?: string;
     parseOptions?: CookieSerializeOptions;
   }

package/types/plugin.test-d.ts

@@ -3,8 +3,7 @@ import { expectError, expectType } from 'tsd';
 import * as fastifyCookieStar from '..';
 import fastifyCookieCjsImport = require('..');
 import fastifyCookieDefault, { fastifyCookie as fastifyCookieNamed  } from '..';
-import fastify, { FastifyInstance,  FastifyPluginCallback,  FastifyReply, setCookieWrapper } from 'fastify';
-import { Server } from 'http';
+import fastify, { FastifyInstance, FastifyReply, setCookieWrapper } from 'fastify';
 
 const fastifyCookieCjs = require('..');
 
@@ -212,6 +211,8 @@ appWithCustomSigner.after(() => {
 
 new fastifyCookieStar.Signer('secretString')
 new fastifyCookieStar.Signer(['secretStringInArray'])
+new fastifyCookieStar.Signer(Buffer.from('secretString'))
+new fastifyCookieStar.Signer([Buffer.from('secretStringInArray')])
 const signer = new fastifyCookieStar.Signer(['secretStringInArray'], 'sha256')
 signer.sign('Lorem Ipsum')
 signer.unsign('Lorem Ipsum')