@fastify/cookie 9.1.0 → 9.3.0

package/.gitattributes

@@ -0,0 +1,2 @@
+# Set default behavior to automatically convert line endings
+* text=auto eol=lf

package/README.md

@@ -4,13 +4,15 @@
 [![NPM version](https://img.shields.io/npm/v/@fastify/cookie.svg?style=flat)](https://www.npmjs.com/package/@fastify/cookie)
 [![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat)](https://standardjs.com/)
 
-A plugin for [Fastify](http://fastify.io/) that adds support for reading and
+A plugin for [Fastify](http://fastify.dev/) that adds support for reading and
 setting cookies.
 
 This plugin's cookie parsing works via Fastify's `onRequest` hook. Therefore,
 you should register it prior to any other `onRequest` hooks that will depend
 upon this plugin's actions.
 
+It is also possible to [import the low-level cookie parsing and serialization functions](#importing-serialize-and-parse).
+
 `@fastify/cookie` [v2.x](https://github.com/fastify/fastify-cookie/tree/v2.x)
 supports both Fastify@1 and Fastify@2.
 `@fastify/cookie` v3 only supports Fastify@2.
@@ -70,6 +72,23 @@ app.register(cookie, {
 } as FastifyCookieOptions)
 ```
 
+## Importing `serialize` and `parse`
+
+```js
+const { serialize, parse } = require('@fastify/cookie')
+const fastify = require('fastify')()
+
+fastify.get('/', (req, reply) => {
+  const cookie = serialize('lang', 'en', {
+    maxAge: 60_000,
+  })
+
+  reply.header('Set-Cookie', cookie)
+
+  reply.send('Language set!')
+})
+```
+
 ## Options
 
 - `secret` (`String` | `Array` | `Buffer` | `Object`):
@@ -77,7 +96,89 @@ app.register(cookie, {
   - An `Array` can be passed if key rotation is desired. Read more about it in [Rotating signing secret](#rotating-secret).
   - More sophisticated cookie signing mechanisms can be implemented by supplying an `Object`. Read more about it in [Custom cookie signer](#custom-cookie-signer).
 
-- `parseOptions`: An `Object` to pass as options to [cookie parse](https://github.com/jshttp/cookie#cookieparsestr-options).
+- `parseOptions`: An `Object` to modify the serialization of set cookies.
+
+#### parseOptions
+
+##### domain
+
+Specifies the value for the [`Domain` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.3). By default, no
+domain is set, and most clients will consider the cookie to apply to only the current domain.
+
+##### encode
+
+Specifies a function that will be used to encode a cookie's value. Since value of a cookie
+has a limited character set (and must be a simple string), this function can be used to encode
+a value into a string suited for a cookie's value.
+
+The default function is the global `encodeURIComponent`, which will encode a JavaScript string
+into UTF-8 byte sequences and then URL-encode any that fall outside of the cookie range.
+
+##### expires
+
+Specifies the `Date` object to be the value for the [`Expires` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.1).
+By default, no expiration is set, and most clients will consider this a "non-persistent cookie" and
+will delete it on a condition like exiting a web browser application.
+
+**Note:** the [cookie storage model specification](https://datatracker.ietf.org/doc/html/rfc6265#section-5.3) states that if both `expires` and
+`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients by obey this,
+so if both are set, they should point to the same date and time.
+
+##### httpOnly
+
+Specifies the `boolean` value for the [`HttpOnly` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.6). When truthy,
+the `HttpOnly` attribute is set, otherwise it is not. By default, the `HttpOnly` attribute is not set.
+
+**Note:** be careful when setting this to `true`, as compliant clients will not allow client-side
+JavaScript to see the cookie in `document.cookie`.
+
+##### maxAge
+
+Specifies the `number` (in seconds) to be the value for the [`Max-Age` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.2).
+The given number will be converted to an integer by rounding down. By default, no maximum age is set.
+
+**Note:** the [cookie storage model specification](https://datatracker.ietf.org/doc/html/rfc6265#section-5.3) states that if both `expires` and
+`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients by obey this,
+so if both are set, they should point to the same date and time.
+
+##### partitioned
+
+Specifies the `boolean` value for the [`Partitioned` `Set-Cookie`](https://datatracker.ietf.org/doc/html/draft-cutler-httpbis-partitioned-cookies#section-2.1)
+attribute. When truthy, the `Partitioned` attribute is set, otherwise it is not. By default, the
+`Partitioned` attribute is not set.
+
+⚠️ **Warning:** [This is an attribute that has not yet been fully standardized](https://github.com/fastify/fastify-cookie/pull/261#issuecomment-1803234334), and may change in the future without reflecting the semver versioning. This also means many clients may ignore the attribute until they understand it.
+
+More information about can be found in [the proposal](https://github.com/privacycg/CHIPS).
+
+##### path
+
+Specifies the value for the [`Path` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.4). By default, the path
+is considered the ["default path"](https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.4).
+
+##### sameSite
+
+Specifies the `boolean` or `string` to be the value for the [`SameSite` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-09#section-5.4.7).
+
+  - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+  - `false` will not set the `SameSite` attribute.
+  - `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
+  - `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie.
+  - `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+
+More information about the different enforcement levels can be found in
+[the specification](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-09#section-5.4.7).
+
+**Note:** This is an attribute that has not yet been fully standardized, and may change in the future.
+This also means many clients may ignore this attribute until they understand it.
+
+##### secure
+
+Specifies the `boolean` value for the [`Secure` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.5). When truthy,
+the `Secure` attribute is set, otherwise it is not. By default, the `Secure` attribute is not set.
+
+**Note:** be careful when setting this to `true`, as compliant clients will not send the cookie back to
+the server in the future if the browser does not have an HTTPS connection.
 
 ## API
 

package/cookie.js

@@ -0,0 +1,227 @@
+/*!
+ * Adapted from https://github.com/jshttp/cookie
+ *
+ * (The MIT License)
+ *
+ * Copyright (c) 2012-2014 Roman Shtylman <shtylman@gmail.com>
+ * Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * 'Software'), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+'use strict'
+
+/**
+ * RegExp to match field-content in RFC 7230 sec 3.2
+ *
+ * field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
+ * field-vchar   = VCHAR / obs-text
+ * obs-text      = %x80-FF
+ */
+
+const fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/ // eslint-disable-line
+
+/**
+ * Parse a cookie header.
+ *
+ * Parse the given cookie header string into an object
+ * The object has the various cookies as keys(names) => values
+ *
+ * @param {string} str
+ * @param {object} [opt]
+ * @return {object}
+ * @public
+ */
+
+function parse (str, opt) {
+  if (typeof str !== 'string') {
+    throw new TypeError('argument str must be a string')
+  }
+
+  const dec = opt?.decode || decodeURIComponent
+  const result = {}
+
+  const strLen = str.length
+  let pos = 0
+  let terminatorPos = 0
+  while (true) {
+    if (terminatorPos === strLen) break
+    terminatorPos = str.indexOf(';', pos)
+    if (terminatorPos === -1) terminatorPos = strLen // This is the last pair
+
+    let eqIdx = str.indexOf('=', pos)
+    if (eqIdx === -1) break // No key-value pairs left
+    if (eqIdx > terminatorPos) {
+      // Malformed key-value pair
+      pos = terminatorPos + 1
+      continue
+    }
+
+    const key = str.substring(pos, eqIdx++).trim()
+    if (result[key] === undefined) {
+      const val = str.charCodeAt(eqIdx) === 0x22
+        ? str.substring(eqIdx + 1, terminatorPos - 1).trim()
+        : str.substring(eqIdx, terminatorPos).trim()
+
+      result[key] = !(dec === decodeURIComponent && val.indexOf('%') === -1)
+        ? tryDecode(val, dec)
+        : val
+    }
+
+    pos = terminatorPos + 1
+  }
+
+  return result
+}
+
+/**
+ * Serialize data into a cookie header.
+ *
+ * Serialize the a name value pair into a cookie string suitable for
+ * http headers. An optional options object specified cookie parameters.
+ *
+ * serialize('foo', 'bar', { httpOnly: true })
+ *   => "foo=bar; httpOnly"
+ *
+ * @param {string} name
+ * @param {string} val
+ * @param {object} [opt]
+ * @return {string}
+ * @public
+ */
+
+function serialize (name, val, opt) {
+  const enc = opt?.encode || encodeURIComponent
+  if (typeof enc !== 'function') {
+    throw new TypeError('option encode is invalid')
+  }
+
+  if (name && !fieldContentRegExp.test(name)) {
+    throw new TypeError('argument name is invalid')
+  }
+
+  const value = enc(val)
+  if (value && !fieldContentRegExp.test(value)) {
+    throw new TypeError('argument val is invalid')
+  }
+
+  let str = name + '=' + value
+
+  if (opt == null) return str
+
+  if (opt.maxAge != null) {
+    const maxAge = +opt.maxAge
+
+    if (!isFinite(maxAge)) {
+      throw new TypeError('option maxAge is invalid')
+    }
+
+    str += '; Max-Age=' + Math.trunc(maxAge)
+  }
+
+  if (opt.domain) {
+    if (!fieldContentRegExp.test(opt.domain)) {
+      throw new TypeError('option domain is invalid')
+    }
+
+    str += '; Domain=' + opt.domain
+  }
+
+  if (opt.path) {
+    if (!fieldContentRegExp.test(opt.path)) {
+      throw new TypeError('option path is invalid')
+    }
+
+    str += '; Path=' + opt.path
+  }
+
+  if (opt.expires) {
+    if (typeof opt.expires.toUTCString !== 'function') {
+      throw new TypeError('option expires is invalid')
+    }
+
+    str += '; Expires=' + opt.expires.toUTCString()
+  }
+
+  if (opt.httpOnly) {
+    str += '; HttpOnly'
+  }
+
+  if (opt.secure) {
+    str += '; Secure'
+  }
+
+  // Draft implementation to support Chrome from 2024-Q1 forward.
+  // See https://datatracker.ietf.org/doc/html/draft-cutler-httpbis-partitioned-cookies#section-2.1
+  if (opt.partitioned) {
+    str += '; Partitioned'
+  }
+
+  if (opt.sameSite) {
+    const sameSite = typeof opt.sameSite === 'string'
+      ? opt.sameSite.toLowerCase()
+      : opt.sameSite
+
+    switch (sameSite) {
+      case true:
+        str += '; SameSite=Strict'
+        break
+      case 'lax':
+        str += '; SameSite=Lax'
+        break
+      case 'strict':
+        str += '; SameSite=Strict'
+        break
+      case 'none':
+        str += '; SameSite=None'
+        break
+      default:
+        throw new TypeError('option sameSite is invalid')
+    }
+  }
+
+  return str
+}
+
+/**
+ * Try decoding a string using a decoding function.
+ *
+ * @param {string} str
+ * @param {function} decode
+ * @returns {string}
+ * @private
+ */
+function tryDecode (str, decode) {
+  try {
+    return decode(str)
+  } catch {
+    return str
+  }
+}
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = {
+  parse,
+  serialize
+}

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@fastify/cookie",
-  "version": "9.1.0",
+  "version": "9.3.0",
   "description": "Plugin for fastify to add support for cookies",
   "main": "plugin.js",
+  "type": "commonjs",
   "types": "types/plugin.d.ts",
   "scripts": {
     "coverage": "npm run test:unit -- --coverage-report=html",
@@ -43,15 +44,15 @@
     "@types/node": "^20.1.0",
     "benchmark": "^2.1.4",
     "fastify": "^4.0.0",
-    "sinon": "^16.0.0",
+    "sinon": "^17.0.0",
     "snazzy": "^9.0.0",
     "standard": "^17.0.0",
     "tap": "^16.0.0",
-    "tsd": "^0.29.0"
+    "tsd": "^0.30.0"
   },
   "dependencies": {
-    "cookie": "^0.5.0",
-    "fastify-plugin": "^4.0.0"
+    "fastify-plugin": "^4.0.0",
+    "cookie-signature": "^1.1.0"
   },
   "tsd": {
     "directory": "test"

package/plugin.js

@@ -1,7 +1,7 @@
 'use strict'
 
 const fp = require('fastify-plugin')
-const cookie = require('cookie')
+const cookie = require('./cookie')
 
 const { Signer, sign, unsign } = require('./signer')
 
@@ -70,32 +70,31 @@ function onReqHandlerWrapper (fastify, hook) {
 }
 
 function setCookies (reply) {
-  let setCookie = reply.getHeader('Set-Cookie')
-  const setCookieIsUndefined = setCookie === undefined
+  const setCookieHeaderValue = reply.getHeader('Set-Cookie')
+  let cookieValue
 
-  /* istanbul ignore else */
-  if (setCookieIsUndefined) {
+  if (setCookieHeaderValue === undefined) {
     if (reply[kReplySetCookies].size === 1) {
-      for (const c of reply[kReplySetCookies].values()) {
-        reply.header('Set-Cookie', cookie.serialize(c.name, c.value, c.opts))
-      }
-
+      // Fast path for single cookie
+      const c = reply[kReplySetCookies].values().next().value
+      reply.header('Set-Cookie', cookie.serialize(c.name, c.value, c.opts))
       reply[kReplySetCookies].clear()
-
       return
     }
 
-    setCookie = []
-  } else if (typeof setCookie === 'string') {
-    setCookie = [setCookie]
+    cookieValue = []
+  } else if (typeof setCookieHeaderValue === 'string') {
+    cookieValue = [setCookieHeaderValue]
+  } else {
+    cookieValue = setCookieHeaderValue
   }
 
   for (const c of reply[kReplySetCookies].values()) {
-    setCookie.push(cookie.serialize(c.name, c.value, c.opts))
+    cookieValue.push(cookie.serialize(c.name, c.value, c.opts))
   }
 
-  if (!setCookieIsUndefined) reply.removeHeader('Set-Cookie')
-  reply.header('Set-Cookie', setCookie)
+  reply.removeHeader('Set-Cookie')
+  reply.header('Set-Cookie', cookieValue)
   reply[kReplySetCookies].clear()
 }
 
@@ -126,7 +125,7 @@ function plugin (fastify, options, next) {
   fastify.decorate('serializeCookie', cookie.serialize)
   fastify.decorate('parseCookie', parseCookie)
 
-  if (typeof secret !== 'undefined') {
+  if (secret !== undefined) {
     fastify.decorate('signCookie', signCookie)
     fastify.decorate('unsignCookie', unsignCookie)
 
@@ -214,6 +213,9 @@ module.exports = fastifyCookie
 module.exports.default = fastifyCookie // supersedes fastifyCookie.default = fastifyCookie
 module.exports.fastifyCookie = fastifyCookie // supersedes fastifyCookie.fastifyCookie = fastifyCookie
 
+module.exports.serialize = cookie.serialize
+module.exports.parse = cookie.parse
+
 module.exports.signerFactory = Signer
 module.exports.Signer = Signer
 module.exports.sign = sign

package/signer.js

@@ -8,7 +8,7 @@
 
 const crypto = require('node:crypto')
 
-const base64PaddingRE = /=/g
+const base64PaddingRE = /=/gu
 
 function Signer (secrets, algorithm = 'sha256') {
   if (!(this instanceof Signer)) {

package/test/cookie-module.test.js

@@ -0,0 +1,205 @@
+'use strict'
+
+const tap = require('tap')
+const test = tap.test
+
+const cookie = require('..')
+
+test('parse: argument validation', (t) => {
+  t.plan(2)
+  t.throws(cookie.parse.bind(), /argument str must be a string/)
+  t.throws(cookie.parse.bind(null, 42), /argument str must be a string/)
+  t.end()
+})
+
+test('parse: basic', (t) => {
+  t.plan(2)
+  t.same(cookie.parse('foo=bar'), { foo: 'bar' })
+  t.same(cookie.parse('foo=123'), { foo: '123' })
+  t.end()
+})
+
+test('parse: ignore spaces', (t) => {
+  t.plan(1)
+  t.same(cookie.parse('FOO    = bar;   baz  =   raz'), { FOO: 'bar', baz: 'raz' })
+  t.end()
+})
+
+test('parse: escaping', (t) => {
+  t.plan(2)
+  t.same(cookie.parse('foo="bar=123456789&name=Magic+Mouse"'), { foo: 'bar=123456789&name=Magic+Mouse' })
+  t.same(cookie.parse('email=%20%22%2c%3b%2f'), { email: ' ",;/' })
+  t.end()
+})
+
+test('parse: ignore escaping error and return original value', (t) => {
+  t.plan(1)
+  t.same(cookie.parse('foo=%1;bar=bar'), { foo: '%1', bar: 'bar' })
+  t.end()
+})
+
+test('parse: ignore non values', (t) => {
+  t.plan(1)
+  t.same(cookie.parse('foo=%1;bar=bar;HttpOnly;Secure'),
+    { foo: '%1', bar: 'bar' })
+  t.end()
+})
+
+test('parse: unencoded', (t) => {
+  t.plan(2)
+  t.same(cookie.parse('foo="bar=123456789&name=Magic+Mouse"', {
+    decode: function (v) { return v }
+  }), { foo: 'bar=123456789&name=Magic+Mouse' })
+
+  t.same(cookie.parse('email=%20%22%2c%3b%2f', {
+    decode: function (v) { return v }
+  }), { email: '%20%22%2c%3b%2f' })
+  t.end()
+})
+
+test('parse: dates', (t) => {
+  t.plan(1)
+  t.same(cookie.parse('priority=true; expires=Wed, 29 Jan 2014 17:43:25 GMT; Path=/', {
+    decode: function (v) { return v }
+  }), { priority: 'true', Path: '/', expires: 'Wed, 29 Jan 2014 17:43:25 GMT' })
+  t.end()
+})
+
+test('parse: missing value', (t) => {
+  t.plan(1)
+  t.same(cookie.parse('foo; bar=1; fizz= ; buzz=2', {
+    decode: function (v) { return v }
+  }), { bar: '1', fizz: '', buzz: '2' })
+  t.end()
+})
+
+test('parse: assign only once', (t) => {
+  t.plan(3)
+  t.same(cookie.parse('foo=%1;bar=bar;foo=boo'), { foo: '%1', bar: 'bar' })
+  t.same(cookie.parse('foo=false;bar=bar;foo=true'), { foo: 'false', bar: 'bar' })
+  t.same(cookie.parse('foo=;bar=bar;foo=boo'), { foo: '', bar: 'bar' })
+  t.end()
+})
+
+test('serializer: basic', (t) => {
+  t.plan(6)
+  t.same(cookie.serialize('foo', 'bar'), 'foo=bar')
+  t.same(cookie.serialize('foo', 'bar baz'), 'foo=bar%20baz')
+  t.same(cookie.serialize('foo', ''), 'foo=')
+  t.throws(cookie.serialize.bind(cookie, 'foo\n', 'bar'), /argument name is invalid/)
+  t.throws(cookie.serialize.bind(cookie, 'foo\u280a', 'bar'), /argument name is invalid/)
+  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', { encode: 42 }), /option encode is invalid/)
+  t.end()
+})
+
+test('serializer: path', (t) => {
+  t.plan(2)
+  t.same(cookie.serialize('foo', 'bar', { path: '/' }), 'foo=bar; Path=/')
+  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
+    path: '/\n'
+  }), /option path is invalid/)
+  t.end()
+})
+
+test('serializer: secure', (t) => {
+  t.plan(2)
+  t.same(cookie.serialize('foo', 'bar', { secure: true }), 'foo=bar; Secure')
+  t.same(cookie.serialize('foo', 'bar', { secure: false }), 'foo=bar')
+  t.end()
+})
+
+test('serializer: domain', (t) => {
+  t.plan(2)
+  t.same(cookie.serialize('foo', 'bar', { domain: 'example.com' }), 'foo=bar; Domain=example.com')
+  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
+    domain: 'example.com\n'
+  }), /option domain is invalid/)
+  t.end()
+})
+
+test('serializer: httpOnly', (t) => {
+  t.plan(1)
+  t.same(cookie.serialize('foo', 'bar', { httpOnly: true }), 'foo=bar; HttpOnly')
+  t.end()
+})
+
+test('serializer: maxAge', (t) => {
+  t.plan(9)
+  t.throws(function () {
+    cookie.serialize('foo', 'bar', {
+      maxAge: 'buzz'
+    })
+  }, /option maxAge is invalid/)
+
+  t.throws(function () {
+    cookie.serialize('foo', 'bar', {
+      maxAge: Infinity
+    })
+  }, /option maxAge is invalid/)
+
+  t.same(cookie.serialize('foo', 'bar', { maxAge: 1000 }), 'foo=bar; Max-Age=1000')
+  t.same(cookie.serialize('foo', 'bar', { maxAge: '1000' }), 'foo=bar; Max-Age=1000')
+  t.same(cookie.serialize('foo', 'bar', { maxAge: 0 }), 'foo=bar; Max-Age=0')
+  t.same(cookie.serialize('foo', 'bar', { maxAge: '0' }), 'foo=bar; Max-Age=0')
+  t.same(cookie.serialize('foo', 'bar', { maxAge: null }), 'foo=bar')
+  t.same(cookie.serialize('foo', 'bar', { maxAge: undefined }), 'foo=bar')
+  t.same(cookie.serialize('foo', 'bar', { maxAge: 3.14 }), 'foo=bar; Max-Age=3')
+  t.end()
+})
+
+test('serializer: expires', (t) => {
+  t.plan(2)
+  t.same(cookie.serialize('foo', 'bar', {
+    expires: new Date(Date.UTC(2000, 11, 24, 10, 30, 59, 900))
+  }), 'foo=bar; Expires=Sun, 24 Dec 2000 10:30:59 GMT')
+
+  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
+    expires: Date.now()
+  }), /option expires is invalid/)
+  t.end()
+})
+
+test('sameSite', (t) => {
+  t.plan(9)
+  t.same(cookie.serialize('foo', 'bar', { sameSite: true }), 'foo=bar; SameSite=Strict')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: 'Strict' }), 'foo=bar; SameSite=Strict')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: 'strict' }), 'foo=bar; SameSite=Strict')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: 'Lax' }), 'foo=bar; SameSite=Lax')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: 'lax' }), 'foo=bar; SameSite=Lax')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: 'None' }), 'foo=bar; SameSite=None')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: 'none' }), 'foo=bar; SameSite=None')
+  t.same(cookie.serialize('foo', 'bar', { sameSite: false }), 'foo=bar')
+
+  t.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
+    sameSite: 'foo'
+  }), /option sameSite is invalid/)
+  t.end()
+})
+
+test('escaping', (t) => {
+  t.plan(1)
+  t.same(cookie.serialize('cat', '+ '), 'cat=%2B%20')
+  t.end()
+})
+
+test('parse->serialize', (t) => {
+  t.plan(2)
+  t.same(cookie.parse(cookie.serialize('cat', 'foo=123&name=baz five')),
+    { cat: 'foo=123&name=baz five' })
+
+  t.same(cookie.parse(cookie.serialize('cat', ' ";/')),
+    { cat: ' ";/' })
+  t.end()
+})
+
+test('unencoded', (t) => {
+  t.plan(2)
+  t.same(cookie.serialize('cat', '+ ', {
+    encode: function (value) { return value }
+  }), 'cat=+ ')
+
+  t.throws(cookie.serialize.bind(cookie, 'cat', '+ \n', {
+    encode: function (value) { return value }
+  }), /argument val is invalid/)
+  t.end()
+})

package/test/cookie.test.js

@@ -92,6 +92,79 @@ test('should set multiple cookies', (t) => {
   })
 })
 
+test('should set multiple cookies', (t) => {
+  t.plan(12)
+  const fastify = Fastify()
+  fastify.register(plugin)
+
+  fastify.get('/', (req, reply) => {
+    reply
+      .setCookie('foo', 'foo')
+      .cookie('bar', 'test', {
+        partitioned: true
+      })
+      .setCookie('wee', 'woo', {
+        partitioned: true,
+        secure: true
+      })
+      .send({ hello: 'world' })
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/'
+  }, (err, res) => {
+    t.error(err)
+    t.equal(res.statusCode, 200)
+    t.same(JSON.parse(res.body), { hello: 'world' })
+
+    const cookies = res.cookies
+    t.equal(cookies.length, 3)
+    t.equal(cookies[0].name, 'foo')
+    t.equal(cookies[0].value, 'foo')
+    t.equal(cookies[1].name, 'bar')
+    t.equal(cookies[1].value, 'test')
+    t.equal(cookies[2].name, 'wee')
+    t.equal(cookies[2].value, 'woo')
+
+    t.equal(res.headers['set-cookie'][1], 'bar=test; Partitioned')
+    t.equal(res.headers['set-cookie'][2], 'wee=woo; Secure; Partitioned')
+  })
+})
+
+test('should set multiple cookies (an array already exists)', (t) => {
+  t.plan(10)
+  const fastify = Fastify()
+  fastify.register(plugin)
+
+  fastify.get('/test1', (req, reply) => {
+    reply
+      .header('Set-Cookie', ['bar=bar'])
+      .setCookie('foo', 'foo', { path: '/' })
+      .setCookie('foo', 'foo', { path: '/path' })
+      .send({ hello: 'world' })
+  })
+
+  fastify.inject({
+    method: 'GET',
+    url: '/test1'
+  }, (err, res) => {
+    t.error(err)
+    t.equal(res.statusCode, 200)
+    t.same(JSON.parse(res.body), { hello: 'world' })
+
+    const cookies = res.cookies
+    t.equal(cookies.length, 3)
+    t.equal(cookies[0].name, 'bar')
+    t.equal(cookies[0].value, 'bar')
+    t.equal(cookies[0].path, undefined)
+
+    t.equal(cookies[1].name, 'foo')
+    t.equal(cookies[1].value, 'foo')
+    t.equal(cookies[2].path, '/path')
+  })
+})
+
 test('cookies get set correctly with millisecond dates', (t) => {
   t.plan(8)
   const fastify = Fastify()

package/types/plugin.d.ts

@@ -65,11 +65,7 @@ declare module "fastify" {
      * @param value Cookie value
      * @param options Serialize options
      */
-    setCookie(
-      name: string,
-      value: string,
-      options?: fastifyCookie.CookieSerializeOptions
-    ): this;
+    setCookie: setCookieWrapper;
 
     /**
      * @alias setCookie
@@ -125,9 +121,9 @@ declare namespace fastifyCookie {
     httpOnly?: boolean;
     /**  A `number` in seconds that specifies the `Expires` attribute by adding the specified seconds to the current date. If both `expires` and `maxAge` are set, then `expires` is used. */
     maxAge?: number;
+    partitioned?: boolean;
     /**  The `Path` attribute. Defaults to `/` (the root path).  */
     path?: string;
-    priority?: "low" | "medium" | "high";
     /** A `boolean` or one of the `SameSite` string attributes. E.g.: `lax`, `none` or `strict`.  */
     sameSite?: 'lax' | 'none' | 'strict' | boolean;
     /**  The `boolean` value of the `Secure` attribute. Set this option to false when communicating over an unencrypted (HTTP) connection. Value can be set to `auto`; in this case the `Secure` attribute will be set to false for HTTP request, in case of HTTPS it will be set to true.  Defaults to true. */
@@ -139,6 +135,10 @@ declare namespace fastifyCookie {
     signed?: boolean;
   }
 
+  export interface ParseOptions {
+    decode?: (encodedURIComponent: string) => string;
+  }
+
   type HookType = 'onRequest' | 'preParsing' | 'preValidation' | 'preHandler'  | 'preSerialization';
 
   export interface FastifyCookieOptions {
@@ -162,6 +162,8 @@ declare namespace fastifyCookie {
   export const unsign: Unsign;
 
   export interface FastifyCookie extends FastifyCookiePlugin {
+    parse: (cookieHeader: string, opts?: ParseOptions) => { [key: string]: string };
+    serialize: (name: string, value: string, opts?: SerializeOptions) => string;
     signerFactory: SignerFactory;
     Signer: Signer;
     sign: Sign;

package/types/plugin.test-d.ts

@@ -172,6 +172,7 @@ const parseOptions: fastifyCookieStar.CookieSerializeOptions = {
   sameSite: 'lax',
   secure: true,
   signed: true,
+  partitioned: false,
 };
 expectType<fastifyCookieStar.CookieSerializeOptions>(parseOptions);
 
@@ -231,3 +232,6 @@ appWithHook.register(cookie, { hook: 'preSerialization' });
 appWithHook.register(cookie, { hook: 'preValidation' });
 expectError(appWithHook.register(cookie, { hook: true }));
 expectError(appWithHook.register(cookie, { hook: 'false' }));
+
+expectType<(cookieHeader: string, opts?: fastifyCookieStar.ParseOptions) => { [key: string]: string }>(fastifyCookieDefault.parse);
+expectType<(name: string, value: string, opts?: fastifyCookieStar.SerializeOptions) => string>(fastifyCookieDefault.serialize);