@fastify/cookie 9.0.4 → 9.2.0

package/.gitattributes

@@ -0,0 +1,2 @@
+# Set default behavior to automatically convert line endings
+* text=auto eol=lf

package/README.md

@@ -77,7 +77,89 @@ app.register(cookie, {
   - An `Array` can be passed if key rotation is desired. Read more about it in [Rotating signing secret](#rotating-secret).
   - More sophisticated cookie signing mechanisms can be implemented by supplying an `Object`. Read more about it in [Custom cookie signer](#custom-cookie-signer).
 
-- `parseOptions`: An `Object` to pass as options to [cookie parse](https://github.com/jshttp/cookie#cookieparsestr-options).
+- `parseOptions`: An `Object` to modify the serialization of set cookies.
+
+#### parseOptions
+
+##### domain
+
+Specifies the value for the [`Domain` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.3). By default, no
+domain is set, and most clients will consider the cookie to apply to only the current domain.
+
+##### encode
+
+Specifies a function that will be used to encode a cookie's value. Since value of a cookie
+has a limited character set (and must be a simple string), this function can be used to encode
+a value into a string suited for a cookie's value.
+
+The default function is the global `encodeURIComponent`, which will encode a JavaScript string
+into UTF-8 byte sequences and then URL-encode any that fall outside of the cookie range.
+
+##### expires
+
+Specifies the `Date` object to be the value for the [`Expires` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.1).
+By default, no expiration is set, and most clients will consider this a "non-persistent cookie" and
+will delete it on a condition like exiting a web browser application.
+
+**Note:** the [cookie storage model specification](https://datatracker.ietf.org/doc/html/rfc6265#section-5.3) states that if both `expires` and
+`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients by obey this,
+so if both are set, they should point to the same date and time.
+
+##### httpOnly
+
+Specifies the `boolean` value for the [`HttpOnly` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.6). When truthy,
+the `HttpOnly` attribute is set, otherwise it is not. By default, the `HttpOnly` attribute is not set.
+
+**Note:** be careful when setting this to `true`, as compliant clients will not allow client-side
+JavaScript to see the cookie in `document.cookie`.
+
+##### maxAge
+
+Specifies the `number` (in seconds) to be the value for the [`Max-Age` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.2).
+The given number will be converted to an integer by rounding down. By default, no maximum age is set.
+
+**Note:** the [cookie storage model specification](https://datatracker.ietf.org/doc/html/rfc6265#section-5.3) states that if both `expires` and
+`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients by obey this,
+so if both are set, they should point to the same date and time.
+
+##### partitioned
+
+Specifies the `boolean` value for the [`Partitioned` `Set-Cookie`](https://datatracker.ietf.org/doc/html/draft-cutler-httpbis-partitioned-cookies#section-2.1)
+attribute. When truthy, the `Partitioned` attribute is set, otherwise it is not. By default, the
+`Partitioned` attribute is not set.
+
+⚠️ **Warning:** [This is an attribute that has not yet been fully standardized](https://github.com/fastify/fastify-cookie/pull/261#issuecomment-1803234334), and may change in the future without reflecting the semver versioning. This also means many clients may ignore the attribute until they understand it.
+
+More information about can be found in [the proposal](https://github.com/privacycg/CHIPS).
+
+##### path
+
+Specifies the value for the [`Path` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.4). By default, the path
+is considered the ["default path"](https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.4).
+
+##### sameSite
+
+Specifies the `boolean` or `string` to be the value for the [`SameSite` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-09#section-5.4.7).
+
+  - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+  - `false` will not set the `SameSite` attribute.
+  - `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
+  - `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie.
+  - `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+
+More information about the different enforcement levels can be found in
+[the specification](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-09#section-5.4.7).
+
+**Note:** This is an attribute that has not yet been fully standardized, and may change in the future.
+This also means many clients may ignore this attribute until they understand it.
+
+##### secure
+
+Specifies the `boolean` value for the [`Secure` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.5). When truthy,
+the `Secure` attribute is set, otherwise it is not. By default, the `Secure` attribute is not set.
+
+**Note:** be careful when setting this to `true`, as compliant clients will not send the cookie back to
+the server in the future if the browser does not have an HTTPS connection.
 
 ## API
 

package/cookie.js

@@ -0,0 +1,231 @@
+/*!
+ * Adapted from https://github.com/jshttp/cookie
+ *
+ * (The MIT License)
+ *
+ * Copyright (c) 2012-2014 Roman Shtylman <shtylman@gmail.com>
+ * Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * 'Software'), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+'use strict'
+
+/**
+ * Module exports.
+ * @public
+ */
+
+exports.parse = parse
+exports.serialize = serialize
+
+/**
+ * Module variables.
+ * @private
+ */
+
+const decode = decodeURIComponent
+const encode = encodeURIComponent
+
+/**
+ * RegExp to match field-content in RFC 7230 sec 3.2
+ *
+ * field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
+ * field-vchar   = VCHAR / obs-text
+ * obs-text      = %x80-FF
+ */
+
+const fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/ // eslint-disable-line
+
+/**
+ * Parse a cookie header.
+ *
+ * Parse the given cookie header string into an object
+ * The object has the various cookies as keys(names) => values
+ *
+ * @param {string} str
+ * @param {object} [options]
+ * @return {object}
+ * @public
+ */
+
+function parse (str, options) {
+  if (typeof str !== 'string') {
+    throw new TypeError('argument str must be a string')
+  }
+
+  const result = {}
+  const dec = (options && options.decode) || decode
+
+  let pos = 0
+  let terminatorPos = 0
+  let eqIdx = 0
+
+  while (true) {
+    if (terminatorPos === str.length) {
+      break
+    }
+    terminatorPos = str.indexOf(';', pos)
+    terminatorPos = (terminatorPos === -1) ? str.length : terminatorPos
+    eqIdx = str.indexOf('=', pos)
+
+    // skip things that don't look like key=value
+    if (eqIdx === -1 || eqIdx > terminatorPos) {
+      pos = terminatorPos + 1
+      continue
+    }
+
+    const key = str.substring(pos, eqIdx++).trim()
+
+    // only assign once
+    if (result[key] === undefined) {
+      const val = (str.charCodeAt(eqIdx) === 0x22)
+        ? str.substring(eqIdx + 1, terminatorPos - 1).trim()
+        : str.substring(eqIdx, terminatorPos).trim()
+
+      result[key] = (dec !== decode || val.indexOf('%') !== -1)
+        ? tryDecode(val, dec)
+        : val
+    }
+    pos = terminatorPos + 1
+  }
+  return result
+}
+
+/**
+ * Serialize data into a cookie header.
+ *
+ * Serialize the a name value pair into a cookie string suitable for
+ * http headers. An optional options object specified cookie parameters.
+ *
+ * serialize('foo', 'bar', { httpOnly: true })
+ *   => "foo=bar; httpOnly"
+ *
+ * @param {string} name
+ * @param {string} val
+ * @param {object} [options]
+ * @return {string}
+ * @public
+ */
+
+function serialize (name, val, options) {
+  const opt = options || {}
+  const enc = opt.encode || encode
+  if (typeof enc !== 'function') {
+    throw new TypeError('option encode is invalid')
+  }
+
+  if (!fieldContentRegExp.test(name)) {
+    throw new TypeError('argument name is invalid')
+  }
+
+  const value = enc(val)
+  if (value && !fieldContentRegExp.test(value)) {
+    throw new TypeError('argument val is invalid')
+  }
+
+  let str = name + '=' + value
+  if (opt.maxAge != null) {
+    const maxAge = opt.maxAge - 0
+    if (isNaN(maxAge) || !isFinite(maxAge)) {
+      throw new TypeError('option maxAge is invalid')
+    }
+
+    str += '; Max-Age=' + Math.floor(maxAge)
+  }
+
+  if (opt.domain) {
+    if (!fieldContentRegExp.test(opt.domain)) {
+      throw new TypeError('option domain is invalid')
+    }
+
+    str += '; Domain=' + opt.domain
+  }
+
+  if (opt.path) {
+    if (!fieldContentRegExp.test(opt.path)) {
+      throw new TypeError('option path is invalid')
+    }
+
+    str += '; Path=' + opt.path
+  }
+
+  if (opt.expires) {
+    if (typeof opt.expires.toUTCString !== 'function') {
+      throw new TypeError('option expires is invalid')
+    }
+
+    str += '; Expires=' + opt.expires.toUTCString()
+  }
+
+  if (opt.httpOnly) {
+    str += '; HttpOnly'
+  }
+
+  if (opt.secure) {
+    str += '; Secure'
+  }
+
+  // Draft implementation to support Chrome from 2024-Q1 forward.
+  // See https://datatracker.ietf.org/doc/html/draft-cutler-httpbis-partitioned-cookies#section-2.1
+  if (opt.partitioned) {
+    str += '; Partitioned'
+  }
+
+  if (opt.sameSite) {
+    const sameSite = typeof opt.sameSite === 'string'
+      ? opt.sameSite.toLowerCase()
+      : opt.sameSite
+    switch (sameSite) {
+      case true:
+        str += '; SameSite=Strict'
+        break
+      case 'lax':
+        str += '; SameSite=Lax'
+        break
+      case 'strict':
+        str += '; SameSite=Strict'
+        break
+      case 'none':
+        str += '; SameSite=None'
+        break
+      default:
+        throw new TypeError('option sameSite is invalid')
+    }
+  }
+
+  return str
+}
+
+/**
+ * Try decoding a string using a decoding function.
+ *
+ * @param {string} str
+ * @param {function} decode
+ * @private
+ */
+
+function tryDecode (str, decode) {
+  try {
+    return decode(str)
+  } catch (e) {
+    return str
+  }
+}

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@fastify/cookie",
-  "version": "9.0.4",
+  "version": "9.2.0",
   "description": "Plugin for fastify to add support for cookies",
   "main": "plugin.js",
+  "type": "commonjs",
   "types": "types/plugin.d.ts",
   "scripts": {
     "coverage": "npm run test:unit -- --coverage-report=html",
@@ -43,15 +44,15 @@
     "@types/node": "^20.1.0",
     "benchmark": "^2.1.4",
     "fastify": "^4.0.0",
-    "sinon": "^15.0.0",
+    "sinon": "^17.0.0",
     "snazzy": "^9.0.0",
     "standard": "^17.0.0",
     "tap": "^16.0.0",
-    "tsd": "^0.28.0"
+    "tsd": "^0.29.0"
   },
   "dependencies": {
-    "cookie": "^0.5.0",
-    "fastify-plugin": "^4.0.0"
+    "fastify-plugin": "^4.0.0",
+    "cookie-signature": "^1.1.0"
   },
   "tsd": {
     "directory": "test"

package/plugin.js

@@ -1,7 +1,7 @@
 'use strict'
 
 const fp = require('fastify-plugin')
-const cookie = require('cookie')
+const cookie = require('./cookie')
 
 const { Signer, sign, unsign } = require('./signer')
 
@@ -9,7 +9,7 @@ const kReplySetCookies = Symbol('fastify.reply.setCookies')
 const kReplySetCookiesHookRan = Symbol('fastify.reply.setCookiesHookRan')
 
 function fastifyCookieSetCookie (reply, name, value, options) {
-  parseCookies(reply.context.server, reply.request, reply)
+  parseCookies(reply.server, reply.request, reply)
 
   const opts = Object.assign({}, options)
 
@@ -51,11 +51,9 @@ function fastifyCookieClearCookie (reply, name, options) {
 function parseCookies (fastify, request, reply) {
   if (reply[kReplySetCookies]) return
 
-  request.cookies = {} // New container per request. Issue #53
   const cookieHeader = request.raw.headers.cookie
-  if (cookieHeader) {
-    request.cookies = fastify.parseCookie(cookieHeader)
-  }
+
+  request.cookies = cookieHeader ? fastify.parseCookie(cookieHeader) : {} // New container per request. Issue #53
   reply[kReplySetCookies] = new Map()
 }
 
@@ -116,18 +114,6 @@ function fastifyCookieOnSendHandler (fastifyReq, fastifyRes, payload, done) {
   done()
 }
 
-function getHook (hook = 'onRequest') {
-  const hooks = {
-    onRequest: 'onRequest',
-    preParsing: 'preParsing',
-    preValidation: 'preValidation',
-    preHandler: 'preHandler',
-    [false]: false
-  }
-
-  return hooks[hook]
-}
-
 function plugin (fastify, options, next) {
   const secret = options.secret
   const hook = getHook(options.hook)
@@ -140,7 +126,7 @@ function plugin (fastify, options, next) {
   fastify.decorate('serializeCookie', cookie.serialize)
   fastify.decorate('parseCookie', parseCookie)
 
-  if (typeof secret !== 'undefined') {
+  if (secret !== undefined) {
     fastify.decorate('signCookie', signCookie)
     fastify.decorate('unsignCookie', unsignCookie)
 
@@ -190,6 +176,18 @@ function plugin (fastify, options, next) {
   }
 }
 
+function getHook (hook = 'onRequest') {
+  const hooks = {
+    onRequest: 'onRequest',
+    preParsing: 'preParsing',
+    preValidation: 'preValidation',
+    preHandler: 'preHandler',
+    [false]: false
+  }
+
+  return hooks[hook]
+}
+
 function isConnectionSecure (request) {
   return (
     request.raw.socket?.encrypted === true ||
@@ -212,15 +210,9 @@ const fastifyCookie = fp(plugin, {
  * - `import { fastifyCookie } from 'fastify-cookie'`
  * - `import fastifyCookie from 'fastify-cookie'`
  */
-fastifyCookie.signerFactory = Signer
-fastifyCookie.fastifyCookie = fastifyCookie
-fastifyCookie.default = fastifyCookie
 module.exports = fastifyCookie
-
-fastifyCookie.fastifyCookie.signerFactory = Signer
-fastifyCookie.fastifyCookie.Signer = Signer
-fastifyCookie.fastifyCookie.sign = sign
-fastifyCookie.fastifyCookie.unsign = unsign
+module.exports.default = fastifyCookie // supersedes fastifyCookie.default = fastifyCookie
+module.exports.fastifyCookie = fastifyCookie // supersedes fastifyCookie.fastifyCookie = fastifyCookie
 
 module.exports.signerFactory = Signer
 module.exports.Signer = Signer

package/signer.js

@@ -6,9 +6,9 @@
 // The MIT License
 // Copyright (c) 2012–2022 LearnBoost <tj@learnboost.com> and other contributors;
 
-const crypto = require('crypto')
+const crypto = require('node:crypto')
 
-const base64PaddingRE = /=/g
+const base64PaddingRE = /=/gu
 
 function Signer (secrets, algorithm = 'sha256') {
   if (!(this instanceof Signer)) {

package/test/cookie-module.test.js

@@ -0,0 +1,205 @@
+'use strict'
+
+const tap = require('tap')
+const test = tap.test
+
+const cookie = require('../cookie')
+
+test('parse: argument validation', (t) => {
+  t.plan(2)
+  t.throws(cookie.parse.bind(), /argument str must be a string/)
+  t.throws(cookie.parse.bind(null, 42), /argument str must be a string/)
+  t.end()
+})
+
+test('parse: basic', (t) => {
+  t.plan(2)
+  t.same(cookie.parse('foo=bar'), { foo: 'bar' })
+  t.same(cookie.parse('foo=123'), { foo: '123' })
+  t.end()
+})
+
+test('parse: ignore spaces', (t) => {
+  t.plan(1)
+  t.same(cookie.parse('FOO    = bar;   baz  =   raz'), { FOO: 'bar', baz: 'raz' })
+  t.end()
+})
+
+test('parse: escaping', (t) => {
+  t.plan(2)
+  t.same(cookie.parse('foo="bar=123456789&name=Magic+Mouse"'), { foo: 'bar=123456789&name=Magic+Mouse' })
+  t.same(cookie.parse('email=%20%22%2c%3b%2f'), { email: ' ",;/' })
+  t.end()
+})
+
+test('parse: ignore escaping error and return original value', (t) => {
+  t.plan(1)
+  t.same(cookie.parse('foo=%1;bar=bar'), { foo: '%1', bar: 'bar' })
+  t.end()
+})
+
+test('parse: ignore non values', (t) => {
+  t.plan(1)
+  t.same(cookie.parse('foo=%1;bar=bar;HttpOnly;Secure'),
+    { foo: '%1', bar: 'bar' })
+  t.end()
+})
+
+test('parse: unencoded', (t) => {
+  t.plan(2)
+  t.same(cookie.parse('foo="bar=123456789&name=Magic+Mouse"', {
+    decode: function (v) { return v }
+  }), { foo: 'bar=123456789&name=Magic+Mouse' })
+
+  t.same(cookie.parse('email=%20%22%2c%3b%2f', {
+    decode: function (v) { return v }
+  }), { email: '%20%22%2c%3b%2f' })
+  t.end()
+})
+
+test('parse: dates', (t) => {
+  t.plan(1)
+  t.same(cookie.parse('priority=true; expires=Wed, 29 Jan 2014 17:43:25 GMT; Path=/', {
+    decode: function (v) { return v }
+  }), { priority: 'true', Path: '/', expires: 'Wed, 29 Jan 2014 17:43:25 GMT' })
+  t.end()
+})
+
+test('parse: missing value', (t) => {
+  t.plan(1)
+  t.same(cookie.parse('foo; bar=1; fizz= ; buzz=2', {
+    decode: function (v) { return v }
+  }), { bar: '1', fizz: '', buzz: '2' })
+  t.end()
+})
+
+test('parse: assign only once', (t) => {
+  t.plan(3)
+  t.same(cookie.parse('foo=%1;bar=bar;foo=boo'), { foo: '%1', bar: 'bar' })
+  t.same(cookie.parse('foo=false;bar=bar;foo=true'), { foo: 'false', bar: 'bar' })
+  t.same(cookie.parse('foo=;bar=bar;foo=boo'), { foo: '', bar: 'bar' })
+  t.end()
+})
+
+test('serializer: basic', (t) => {
+  t.plan(6)
+  t.same(cookie.serialize('foo', 'bar'), 'foo=bar')
+  t.same(cookie.serialize('foo', 'bar baz'), 'foo=bar%20baz')
+  t.same(cookie.serialize('foo', ''), 'foo=')
+  t.throws(cookie.serialize.bind(cookie, 'foo\n', 'bar'), /argument name is invalid/)
+  t.throws(cookie.serialize.bind(cookie, 'foo\u280a', 'bar'), /argument name is invalid/)
+  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', { encode: 42 }), /option encode is invalid/)
+  t.end()
+})
+
+test('serializer: path', (t) => {
+  t.plan(2)
+  t.same(cookie.serialize('foo', 'bar', { path: '/' }), 'foo=bar; Path=/')
+  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
+    path: '/\n'
+  }), /option path is invalid/)
+  t.end()
+})
+
+test('serializer: secure', (t) => {
+  t.plan(2)
+  t.same(cookie.serialize('foo', 'bar', { secure: true }), 'foo=bar; Secure')
+  t.same(cookie.serialize('foo', 'bar', { secure: false }), 'foo=bar')
+  t.end()
+})
+
+test('serializer: domain', (t) => {
+  t.plan(2)
+  t.same(cookie.serialize('foo', 'bar', { domain: 'example.com' }), 'foo=bar; Domain=example.com')
+  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
+    domain: 'example.com\n'
+  }), /option domain is invalid/)
+  t.end()
+})
+
+test('serializer: httpOnly', (t) => {
+  t.plan(1)
+  t.same(cookie.serialize('foo', 'bar', { httpOnly: true }), 'foo=bar; HttpOnly')
+  t.end()
+})
+
+test('serializer: maxAge', (t) => {
+  t.plan(9)
+  t.throws(function () {
+    cookie.serialize('foo', 'bar', {
+      maxAge: 'buzz'
+    })
+  }, /option maxAge is invalid/)
+
+  t.throws(function () {
+    cookie.serialize('foo', 'bar', {
+      maxAge: Infinity
+    })
+  }, /option maxAge is invalid/)
+
+  t.same(cookie.serialize('foo', 'bar', { maxAge: 1000 }), 'foo=bar; Max-Age=1000')
+  t.same(cookie.serialize('foo', 'bar', { maxAge: '1000' }), 'foo=bar; Max-Age=1000')
+  t.same(cookie.serialize('foo', 'bar', { maxAge: 0 }), 'foo=bar; Max-Age=0')
+  t.same(cookie.serialize('foo', 'bar', { maxAge: '0' }), 'foo=bar; Max-Age=0')
+  t.same(cookie.serialize('foo', 'bar', { maxAge: null }), 'foo=bar')
+  t.same(cookie.serialize('foo', 'bar', { maxAge: undefined }), 'foo=bar')
+  t.same(cookie.serialize('foo', 'bar', { maxAge: 3.14 }), 'foo=bar; Max-Age=3')
+  t.end()
+})
+
+test('serializer: expires', (t) => {
+  t.plan(2)
+  t.same(cookie.serialize('foo', 'bar', {
+    expires: new Date(Date.UTC(2000, 11, 24, 10, 30, 59, 900))
+  }), 'foo=bar; Expires=Sun, 24 Dec 2000 10:30:59 GMT')
+
+  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
+    expires: Date.now()
+  }), /option expires is invalid/)
+  t.end()
+})
+
+test('sameSite', (t) => {
+  t.plan(9)
+  t.same(cookie.serialize('foo', 'bar', { sameSite: true }), 'foo=bar; SameSite=Strict')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: 'Strict' }), 'foo=bar; SameSite=Strict')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: 'strict' }), 'foo=bar; SameSite=Strict')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: 'Lax' }), 'foo=bar; SameSite=Lax')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: 'lax' }), 'foo=bar; SameSite=Lax')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: 'None' }), 'foo=bar; SameSite=None')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: 'none' }), 'foo=bar; SameSite=None')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: false }), 'foo=bar')
+
+  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
+    sameSite: 'foo'
+  }), /option sameSite is invalid/)
+  t.end()
+})
+
+test('escaping', (t) => {
+  t.plan(1)
+  t.same(cookie.serialize('cat', '+ '), 'cat=%2B%20')
+  t.end()
+})
+
+test('parse->serialize', (t) => {
+  t.plan(2)
+  t.same(cookie.parse(cookie.serialize('cat', 'foo=123&name=baz five')),
+    { cat: 'foo=123&name=baz five' })
+
+  t.same(cookie.parse(cookie.serialize('cat', ' ";/')),
+    { cat: ' ";/' })
+  t.end()
+})
+
+test('unencoded', (t) => {
+  t.plan(2)
+  t.same(cookie.serialize('cat', '+ ', {
+    encode: function (value) { return value }
+  }), 'cat=+ ')
+
+  t.throws(cookie.serialize.bind(cookie, 'cat', '+ \n', {
+    encode: function (value) { return value }
+  }), /argument val is invalid/)
+  t.end()
+})

package/test/cookie.test.js

@@ -1,7 +1,6 @@
 'use strict'
 
-const tap = require('tap')
-const test = tap.test
+const { test } = require('tap')
 const Fastify = require('fastify')
 const sinon = require('sinon')
 const { sign, unsign } = require('../signer')
@@ -93,6 +92,46 @@ test('should set multiple cookies', (t) => {
   })
 })
 
+test('should set multiple cookies', (t) => {
+  t.plan(12)
+  const fastify = Fastify()
+  fastify.register(plugin)
+
+  fastify.get('/', (req, reply) => {
+    reply
+      .setCookie('foo', 'foo')
+      .cookie('bar', 'test', {
+        partitioned: true
+      })
+      .setCookie('wee', 'woo', {
+        partitioned: true,
+        secure: true
+      })
+      .send({ hello: 'world' })
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/'
+  }, (err, res) => {
+    t.error(err)
+    t.equal(res.statusCode, 200)
+    t.same(JSON.parse(res.body), { hello: 'world' })
+
+    const cookies = res.cookies
+    t.equal(cookies.length, 3)
+    t.equal(cookies[0].name, 'foo')
+    t.equal(cookies[0].value, 'foo')
+    t.equal(cookies[1].name, 'bar')
+    t.equal(cookies[1].value, 'test')
+    t.equal(cookies[2].name, 'wee')
+    t.equal(cookies[2].value, 'woo')
+
+    t.equal(res.headers['set-cookie'][1], 'bar=test; Partitioned')
+    t.equal(res.headers['set-cookie'][2], 'wee=woo; Secure; Partitioned')
+  })
+})
+
 test('cookies get set correctly with millisecond dates', (t) => {
   t.plan(8)
   const fastify = Fastify()

package/test/signer.test.js

@@ -2,7 +2,7 @@
 
 const { test } = require('tap')
 const sinon = require('sinon')
-const crypto = require('crypto')
+const crypto = require('node:crypto')
 const { Signer, sign, unsign } = require('../signer')
 
 test('default', t => {

package/types/plugin.d.ts

@@ -125,9 +125,9 @@ declare namespace fastifyCookie {
     httpOnly?: boolean;
     /**  A `number` in seconds that specifies the `Expires` attribute by adding the specified seconds to the current date. If both `expires` and `maxAge` are set, then `expires` is used. */
     maxAge?: number;
+    partitioned?: boolean;
     /**  The `Path` attribute. Defaults to `/` (the root path).  */
     path?: string;
-    priority?: "low" | "medium" | "high";
     /** A `boolean` or one of the `SameSite` string attributes. E.g.: `lax`, `none` or `strict`.  */
     sameSite?: 'lax' | 'none' | 'strict' | boolean;
     /**  The `boolean` value of the `Secure` attribute. Set this option to false when communicating over an unencrypted (HTTP) connection. Value can be set to `auto`; in this case the `Secure` attribute will be set to false for HTTP request, in case of HTTPS it will be set to true.  Defaults to true. */

package/types/plugin.test-d.ts

@@ -172,6 +172,7 @@ const parseOptions: fastifyCookieStar.CookieSerializeOptions = {
   sameSite: 'lax',
   secure: true,
   signed: true,
+  partitioned: false,
 };
 expectType<fastifyCookieStar.CookieSerializeOptions>(parseOptions);