@sveltejs/kit 1.0.0-next.482 → 1.0.0-next.483

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sveltejs/kit",
-  "version": "1.0.0-next.482",
+  "version": "1.0.0-next.483",
   "repository": {
     "type": "git",
     "url": "https://github.com/sveltejs/kit",

package/src/runtime/server/cookie.js

@@ -1,49 +1,76 @@
-import * as cookie from 'cookie';
+import { parse } from 'cookie';
+
+/** @type {import('cookie').CookieSerializeOptions} */
+const DEFAULT_SERIALIZE_OPTIONS = {
+	httpOnly: true,
+	secure: true,
+	sameSite: 'lax'
+};
 
 /**
  * @param {Request} request
  * @param {URL} url
  */
 export function get_cookies(request, url) {
-	const initial_cookies = cookie.parse(request.headers.get('cookie') ?? '');
-
-	/** @type {Array<{ name: string, value: string, options: import('cookie').CookieSerializeOptions }>} */
-	const new_cookies = [];
+	/** @type {Map<string, {name: string; value: string; options: import('cookie').CookieSerializeOptions;}>} */
+	const new_cookies = new Map();
 
 	/** @type {import('types').Cookies} */
 	const cookies = {
-		get(name, opts) {
-			const decode = opts?.decode || decodeURIComponent;
+		// The JSDoc param annotations appearing below for get, set and delete
+		// are necessary to expose the `cookie` library types to
+		// typescript users. `@type {import('types').Cookies}` above is not
+		// sufficient to do so.
 
-			let i = new_cookies.length;
-			while (i--) {
-				const cookie = new_cookies[i];
-
-				if (
-					cookie.name === name &&
-					domain_matches(url.hostname, cookie.options.domain) &&
-					path_matches(url.pathname, cookie.options.path)
-				) {
-					return cookie.value;
-				}
+		/**
+		 * @param {string} name
+		 * @param {import('cookie').CookieParseOptions} opts
+		 */
+		get(name, opts) {
+			const c = new_cookies.get(name);
+			if (
+				c &&
+				domain_matches(url.hostname, c.options.domain) &&
+				path_matches(url.pathname, c.options.path)
+			) {
+				return c.value;
 			}
 
-			return name in initial_cookies ? decode(initial_cookies[name]) : undefined;
+			const decode = opts?.decode || decodeURIComponent;
+			const req_cookies = parse(request.headers.get('cookie') ?? '', { decode });
+			return req_cookies[name]; // the decoded string or undefined
 		},
-		set(name, value, options = {}) {
-			new_cookies.push({
+
+		/**
+		 * @param {string} name
+		 * @param {string} value
+		 * @param {import('cookie').CookieSerializeOptions} opts
+		 */
+		set(name, value, opts = {}) {
+			new_cookies.set(name, {
 				name,
 				value,
 				options: {
-					httpOnly: true,
-					secure: true,
-					...options
+					...DEFAULT_SERIALIZE_OPTIONS,
+					...opts
 				}
 			});
 		},
-		delete(name) {
-			new_cookies.push({ name, value: '', options: { expires: new Date(0) } });
-			delete initial_cookies[name];
+
+		/**
+		 * @param {string} name
+		 * @param {import('cookie').CookieSerializeOptions} opts
+		 */
+		delete(name, opts = {}) {
+			new_cookies.set(name, {
+				name,
+				value: '',
+				options: {
+					...DEFAULT_SERIALIZE_OPTIONS,
+					...opts,
+					maxAge: 0
+				}
+			});
 		}
 	};
 

package/src/runtime/server/index.js

@@ -246,7 +246,7 @@ export async function respond(request, options, state) {
 					}
 				}
 
-				for (const new_cookie of new_cookies) {
+				for (const new_cookie of Array.from(new_cookies.values())) {
 					response.headers.append(
 						'set-cookie',
 						cookie.serialize(new_cookie.name, new_cookie.value, new_cookie.options)

package/types/index.d.ts

@@ -128,21 +128,21 @@ export interface Cookies {
 	/**
 	 * Gets a cookie that was previously set with `cookies.set`, or from the request headers.
 	 */
-	get(name: string, opts?: import('cookie').CookieParseOptions): string | undefined;
+	get(name: string, opts?: import('cookie').CookieParseOptions): string | void;
 
 	/**
-	 * Sets a cookie. This will add a `set-cookie` header to the response, but also make
-	 * the cookie available via `cookies.get` during the current request.
+	 * Sets a cookie. This will add a `set-cookie` header to the response, but also make the cookie available via `cookies.get` during the current request.
 	 *
-	 * The `httpOnly` and `secure` options are `true` by default, and must be explicitly
-	 * disabled if you want cookies to be readable by client-side JavaScript and/or transmitted over HTTP
+	 * The `httpOnly` and `secure` options are `true` by default, and must be explicitly disabled if you want cookies to be readable by client-side JavaScript and/or transmitted over HTTP. The `sameSite` option defaults to `lax`.
+	 *
+	 * By default, the `path` of a cookie is the 'directory' of the current pathname. In most cases you should explicitly set `path: '/'` to make the cookie available throughout your app.
 	 */
 	set(name: string, value: string, opts?: import('cookie').CookieSerializeOptions): void;
 
 	/**
 	 * Deletes a cookie by setting its value to an empty string and setting the expiry date in the past.
 	 */
-	delete(name: string): void;
+	delete(name: string, opts?: import('cookie').CookieSerializeOptions): void;
 }
 
 export interface KitConfig {