@hellocoop/express 1.2.4 → 1.3.0

package/dist/lib/auth.d.ts

@@ -1,6 +1,6 @@
 import { Auth } from '@hellocoop/types';
 import { Request, Response } from 'express';
-export declare const saveAuthCookie: (res: Response, auth: Auth) => Promise<boolean>;
+export declare const saveAuthCookie: (res: Response, auth: Auth, sameSite?: boolean) => Promise<boolean>;
 export declare const clearAuthCookie: (res: Response) => Promise<void>;
 export declare const getAuthfromCookies: (req: Request, res: Response) => Promise<Auth>;
 export declare const NotLoggedIn: Auth;

package/dist/lib/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAQ3C,eAAO,MAAM,cAAc,QAAgB,QAAQ,QAAQ,IAAI,KAAI,QAAQ,OAAO,CAiBjF,CAAA;AAED,eAAO,MAAM,eAAe,QAAgB,QAAQ,kBAKnD,CAAA;AAGD,eAAO,MAAM,kBAAkB,QAChB,OAAO,OAAO,QAAQ,KAC3B,QAAQ,IAAI,CAoBrB,CAAA;AAED,eAAO,MAAM,WAAW,EAAE,IAA2B,CAAA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAwB3C,eAAO,MAAM,cAAc,QAAgB,QAAQ,QAAQ,IAAI,aAAY,OAAO,KAAY,QAAQ,OAAO,CAW5G,CAAA;AAED,eAAO,MAAM,eAAe,QAAgB,QAAQ,kBAKnD,CAAA;AAGD,eAAO,MAAM,kBAAkB,QAChB,OAAO,OAAO,QAAQ,KAC3B,QAAQ,IAAI,CA8BrB,CAAA;AAED,eAAO,MAAM,WAAW,EAAE,IAA2B,CAAA"}

package/dist/lib/auth.js

@@ -9,18 +9,24 @@ const config_1 = __importDefault(require("./config"));
 const cookie_1 = require("cookie");
 const oidc_1 = require("./oidc");
 const { cookies: { authName, oidcName } } = config_1.default;
-const saveAuthCookie = async (res, auth) => {
+const laxAuthName = 'lax-' + authName;
+const setEncryptedCookie = (res, sameSite, encCookie) => {
+    const cookieName = sameSite ? authName : laxAuthName;
+    const options = {
+        httpOnly: true,
+        secure: config_1.default.production,
+        path: '/' // let any server side route call getAuth
+    };
+    if (sameSite)
+        options.sameSite = 'strict';
+    res.appendHeader('Set-Cookie', (0, cookie_1.serialize)(cookieName, encCookie, options));
+};
+const saveAuthCookie = async (res, auth, sameSite = false) => {
     try {
         const encCookie = await (0, core_1.encryptObj)(auth, config_1.default.secret);
         if (!encCookie)
             return false;
-        res.appendHeader('Set-Cookie', (0, cookie_1.serialize)(authName, encCookie, {
-            httpOnly: true,
-            secure: config_1.default.production,
-            sameSite: 'strict',
-            path: '/' // let any server side route call getAuth
-            // no maxAge => session cooke
-        }));
+        setEncryptedCookie(res, sameSite, encCookie);
         return true;
     }
     catch (e) {
@@ -40,7 +46,16 @@ const getAuthfromCookies = async function (req, res) {
     const cookies = (0, cookie_1.parse)(req.headers.cookie || '');
     if (cookies[oidcName]) // clear OIDC cookie it still there
         (0, oidc_1.clearOidcCookie)(res);
-    const authCookie = cookies[authName];
+    const laxAuthCookie = cookies[laxAuthName];
+    if (laxAuthCookie) {
+        // rotate to a sameSite:strict cookie
+        setEncryptedCookie(res, true, laxAuthCookie);
+        res.appendHeader('Set-Cookie', (0, cookie_1.serialize)(laxAuthName, '', {
+            expires: new Date(0),
+            path: '/', // Specify the path
+        }));
+    }
+    const authCookie = cookies[authName] || laxAuthCookie;
     if (!authCookie)
         return exports.NotLoggedIn;
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellocoop/express",
-  "version": "1.2.4",
+  "version": "1.3.0",
   "description": "Express SDK for Hellō https://hello.dev",
   "repository": {
     "type": "git",