@shopify/shopify-api 15.0.0 → 15.0.1

package/lib/auth/oauth/oauth.ts

@@ -96,6 +96,7 @@ export function begin(config: ConfigInterface): OAuthBegin {
       expires: new Date(Date.now() + 60000),
       sameSite: 'lax',
       secure: true,
+      httpOnly: true,
       path: callbackPath,
     });
 
@@ -225,6 +226,7 @@ export function callback(config: ConfigInterface): OAuthCallback {
         expires: session.expires,
         sameSite: 'lax',
         secure: true,
+        httpOnly: true,
         path: cookiePath,
       });
     }

package/lib/clients/common.ts

@@ -28,6 +28,7 @@ export function getUserAgent(config: ConfigInterface): string {
 const REDACTED_LOG_VALUE = '****';
 
 // These headers carry reusable credentials and must not reach the logs.
+// Keep in sync with SENSITIVE_HEADERS in @shopify/graphql-client.
 const SENSITIVE_LOG_HEADERS = new Set([
   'authorization',
   'cookie',

package/lib/version.ts

@@ -1 +1 @@
-export const SHOPIFY_API_LIBRARY_VERSION = '15.0.0';
+export const SHOPIFY_API_LIBRARY_VERSION = '15.0.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shopify/shopify-api",
-  "version": "15.0.0",
+  "version": "15.0.1",
   "description": "Shopify API Library for Node - accelerate development with support for authentication, graphql proxy, webhooks",
   "types": "./dist/ts/lib/index.d.ts",
   "module": "./dist/esm/lib/index.mjs",
@@ -71,9 +71,9 @@
     "Storefront API"
   ],
   "dependencies": {
-    "@shopify/admin-api-client": "^2.0.0",
-    "@shopify/graphql-client": "^2.0.0",
-    "@shopify/storefront-api-client": "^2.0.0",
+    "@shopify/admin-api-client": "^2.0.1",
+    "@shopify/graphql-client": "^2.0.1",
+    "@shopify/storefront-api-client": "^2.0.1",
     "compare-versions": "^6.1.1",
     "isbot": "^5.2.0",
     "jose": "^5.9.6",

package/runtime/http/cookies.ts

@@ -91,9 +91,13 @@ export class Cookies {
             name,
             value,
             ...Object.fromEntries(
-              opts.map((opt) =>
-                splitN(opt, '=', 2).map((value) => value.trim()),
-              ),
+              opts.map((opt) => {
+                const [key, value] = splitN(opt, '=', 2).map((value) =>
+                  value.trim(),
+                );
+                // Flag attributes like HttpOnly have no value
+                return [key, value ?? true];
+              }),
             ),
           },
         ];
@@ -111,8 +115,12 @@ export class Cookies {
     let result = '';
     result += `${data.name}=${data.value};`;
     result += Object.entries(data)
-      .filter(([key]) => !['name', 'value', 'expires'].includes(key))
-      .map(([key, value]) => `${key}=${value}`)
+      .filter(
+        ([key, value]) =>
+          !['name', 'value', 'expires'].includes(key) && value !== false,
+      )
+      // Boolean attributes are flags, so only write them when true
+      .map(([key, value]) => (value === true ? key : `${key}=${value}`))
       .join('; ');
     if (data.expires) {
       result += ';';
@@ -180,6 +188,7 @@ export class Cookies {
 
   set(name: string, value: string, opts: Partial<CookieData> = {}): void {
     this.outgoingCookieJar[name] = {
+      httpOnly: true,
       ...opts,
       name,
       value,