iron-session 8.0.3 → 9.0.0-beta.0

package/dist/index.js

@@ -1,271 +1,375 @@
-import { serialize, parse } from 'cookie';
-import { seal, defaults, unseal } from 'iron-webcrypto';
-import * as crypto from 'uncrypto';
-
-// src/core.ts
-var timestampSkewSec = 60;
-var fourteenDaysInSeconds = 14 * 24 * 3600;
-var currentMajorVersion = 2;
-var versionDelimiter = "~";
-var defaultOptions = {
-  ttl: fourteenDaysInSeconds,
-  cookieOptions: { httpOnly: true, secure: true, sameSite: "lax", path: "/" }
+import { parseCookie, stringifySetCookie } from "cookie";
+import { defaults, seal, unseal } from "iron-webcrypto";
+//#region src/core.ts
+const timestampSkewSec = 60;
+const fourteenDaysInSeconds = 1209600;
+const currentMajorVersion = 2;
+const versionDelimiter = "~";
+const defaultOptions = {
+	ttl: fourteenDaysInSeconds,
+	cookieOptions: {
+		httpOnly: true,
+		secure: true,
+		sameSite: "lax",
+		path: "/"
+	},
+	chunk: false
 };
 function normalizeStringPasswordToMap(password) {
-  return typeof password === "string" ? { 1: password } : password;
+	return typeof password === "string" ? { 1: password } : password;
 }
-function parseSeal(seal) {
-  const [sealWithoutVersion, tokenVersionAsString] = seal.split(versionDelimiter);
-  const tokenVersion = tokenVersionAsString == null ? null : parseInt(tokenVersionAsString, 10);
-  return { sealWithoutVersion, tokenVersion };
+/**
+* Removes the trailing `~<version>` marker from a seal.
+*
+* The marker sits outside the seal's HMAC, so it is attacker-controlled and its
+* value must never select a code path. iron-session v8 used it to unwrap a
+* `persistent` key from v6-era cookies; v9 drops that format, so the marker is
+* now inert metadata that we strip and ignore.
+*/
+function stripVersion(seal) {
+	const delimiterIndex = seal.indexOf(versionDelimiter);
+	return delimiterIndex === -1 ? seal : seal.slice(0, delimiterIndex);
 }
 function computeCookieMaxAge(ttl) {
-  if (ttl === 0) {
-    return 2147483647;
-  }
-  return ttl - timestampSkewSec;
+	if (ttl === 0) return 2147483647;
+	return Math.max(1, ttl - timestampSkewSec);
+}
+async function sealData(data, { password, ttl = fourteenDaysInSeconds }) {
+	const passwordsMap = normalizeStringPasswordToMap(password);
+	const mostRecentPasswordId = Math.max(...Object.keys(passwordsMap).map(Number));
+	const secret = passwordsMap[mostRecentPasswordId];
+	if (secret === void 0) throw new Error("iron-session: Bad usage. The password map has no usable entry, it must be a non-empty object keyed by numbers, for example { 1: 'your-password' }.");
+	const passwordForSeal = {
+		id: mostRecentPasswordId.toString(),
+		secret
+	};
+	let seal$1;
+	try {
+		seal$1 = await seal(data !== null && typeof data === "object" ? { ...data } : data, passwordForSeal, {
+			...defaults,
+			ttl: ttl * 1e3
+		});
+	} catch (error) {
+		if (error instanceof Error && error.message === "Data is not JSON serializable") throw new Error("iron-session: The session data is not JSON serializable. Store plain JSON values only: a Date must be stored as a timestamp (Date.now()) or an ISO string, and Map/Set/BigInt/undefined/functions are not supported.", { cause: error });
+		throw error;
+	}
+	return `${seal$1}${versionDelimiter}${currentMajorVersion}`;
+}
+function classifyUnsealError(error) {
+	if (!(error instanceof Error)) return "invalid";
+	if (error.message.startsWith("Expired seal")) return "expired";
+	if (error.message.startsWith("Cannot find password")) return "unknown-password";
+	return "invalid";
+}
+async function unsealData(seal, { password, ttl = fourteenDaysInSeconds, onUnsealError }) {
+	const passwordsMap = normalizeStringPasswordToMap(password);
+	const sealWithoutVersion = stripVersion(seal);
+	try {
+		return await unseal(sealWithoutVersion, passwordsMap, {
+			...defaults,
+			ttl: ttl * 1e3
+		}) ?? {};
+	} catch (error) {
+		onUnsealError?.(classifyUnsealError(error), error);
+		return {};
+	}
+}
+function isWebRequest(req) {
+	return "headers" in req && typeof req.headers.get === "function";
+}
+function readCookieHeader(req, name) {
+	const header = isWebRequest(req) ? req.headers.get("cookie") : req.headers.cookie;
+	return parseCookie(header ?? "")[name];
+}
+function cookieHeaderNames(req) {
+	const header = isWebRequest(req) ? req.headers.get("cookie") : req.headers.cookie;
+	return Object.keys(parseCookie(header ?? ""));
 }
-function getCookie(req, cookieName) {
-  return parse(
-    ("headers" in req && typeof req.headers.get === "function" ? req.headers.get("cookie") : req.headers.cookie) ?? ""
-  )[cookieName] ?? "";
+/**
+* `cookie@2` rejects an explicit `maxAge: undefined` under
+* `exactOptionalPropertyTypes`, and an absent `Max-Age` is exactly what
+* `maxAge: undefined` is meant to produce, so the key is dropped instead of
+* forwarded.
+*/
+function serializeCookie(name, value, { maxAge, ...cookieOptions }) {
+	return stringifySetCookie({
+		...cookieOptions,
+		...maxAge === void 0 ? {} : { maxAge },
+		name,
+		value
+	});
 }
-function getServerActionCookie(cookieName, cookieHandler) {
-  const cookieObject = cookieHandler.get(cookieName);
-  const cookie = cookieObject?.value;
-  if (typeof cookie === "string") {
-    return cookie;
-  }
-  return "";
+/**
+* Node's `http` server, which is also Express, Connect and Next.js API routes.
+*
+* @example
+* const session = await getIronSession(nodeCookies(req, res), options);
+*/
+function nodeCookies(req, res) {
+	return {
+		read: (name) => readCookieHeader(req, name),
+		names: () => cookieHeaderNames(req),
+		assertWritable: () => {
+			if (res.headersSent) throw new Error("iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()");
+		},
+		write: (name, value, options) => {
+			const existing = res.getHeader("set-cookie") ?? [];
+			const previous = Array.isArray(existing) ? existing : [existing.toString()];
+			res.setHeader("set-cookie", [...previous, serializeCookie(name, value, options)]);
+		}
+	};
 }
-function setCookie(res, cookieValue) {
-  if ("headers" in res && typeof res.headers.append === "function") {
-    res.headers.append("set-cookie", cookieValue);
-    return;
-  }
-  let existingSetCookie = res.getHeader("set-cookie") ?? [];
-  if (!Array.isArray(existingSetCookie)) {
-    existingSetCookie = [existingSetCookie.toString()];
-  }
-  res.setHeader("set-cookie", [
-    ...existingSetCookie,
-    cookieValue
-  ]);
+/**
+* Web-standard `Request` plus anything with appendable headers: a `Response`,
+* a bare `Headers`, or Next's `NextResponse`.
+*
+* @example
+* const headers = new Headers();
+* const session = await getIronSession(webCookies(request, headers), options);
+* return new Response(body, { headers });
+*/
+function webCookies(request, response) {
+	const headers = response instanceof Headers ? response : response.headers;
+	return {
+		read: (name) => readCookieHeader(request, name),
+		names: () => cookieHeaderNames(request),
+		assertWritable: () => {
+			if (response instanceof Response && response.bodyUsed) throw new Error("iron-session: Cannot set session cookie: the response body has already been consumed, so the Set-Cookie header would be dropped. Call session.save() before returning or streaming the response.");
+		},
+		write: (name, value, options) => {
+			headers.append("set-cookie", serializeCookie(name, value, options));
+		}
+	};
 }
-function createSealData(_crypto) {
-  return async function sealData2(data, {
-    password,
-    ttl = fourteenDaysInSeconds
-  }) {
-    const passwordsMap = normalizeStringPasswordToMap(password);
-    const mostRecentPasswordId = Math.max(
-      ...Object.keys(passwordsMap).map(Number)
-    );
-    const passwordForSeal = {
-      id: mostRecentPasswordId.toString(),
-      secret: passwordsMap[mostRecentPasswordId]
-    };
-    const seal$1 = await seal(_crypto, data, passwordForSeal, {
-      ...defaults,
-      ttl: ttl * 1e3
-    });
-    return `${seal$1}${versionDelimiter}${currentMajorVersion}`;
-  };
+/**
+* Next.js `proxy.ts` (called `middleware.ts` before Next 16).
+*
+* Writing a raw `set-cookie` header here does not work the way you would
+* expect: Next only merges a cookie into the current render when it goes
+* through `response.cookies.set()`, so `session.save()` in middleware appeared
+* to succeed and then vanished. Writing to `request.cookies` as well makes the
+* new value visible to code that reads the session later in the same request,
+* which is what makes rotation work.
+*
+* @example
+* export async function proxy(request: NextRequest) {
+*   const response = NextResponse.next();
+*   const session = await getIronSession(nextProxyCookies(request, response), options);
+*   session.lastSeen = Date.now();
+*   await session.save();
+*   return response;
+* }
+*/
+function nextProxyCookies(request, response) {
+	return {
+		read: (name) => request.cookies.get(name)?.value,
+		names: () => request.cookies.getAll?.().map((cookie) => cookie.name) ?? [],
+		write: (name, value, options) => {
+			response.cookies.set(name, value, options);
+			request.cookies.set(name, value);
+		}
+	};
 }
-function createUnsealData(_crypto) {
-  return async function unsealData2(seal, {
-    password,
-    ttl = fourteenDaysInSeconds
-  }) {
-    const passwordsMap = normalizeStringPasswordToMap(password);
-    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);
-    try {
-      const data = await unseal(_crypto, sealWithoutVersion, passwordsMap, {
-        ...defaults,
-        ttl: ttl * 1e3
-      }) ?? {};
-      if (tokenVersion === 2) {
-        return data;
-      }
-      return { ...data.persistent };
-    } catch (error) {
-      if (error instanceof Error && /^(Expired seal|Bad hmac value|Cannot find password|Incorrect number of sealed components)/.test(
-        error.message
-      )) {
-        return {};
-      }
-      throw error;
-    }
-  };
+/** Wraps a `cookies()`-style store (Next's App Router) in a jar. */
+function cookieStoreJar(cookieStore) {
+	return {
+		read: (name) => cookieStore.get(name)?.value,
+		names: () => cookieStore.getAll?.().map((cookie) => cookie.name) ?? [],
+		write: (name, value, options) => {
+			cookieStore.set(name, value, options);
+		}
+	};
+}
+function isCookieJar(value) {
+	return typeof value === "object" && value !== null && typeof value.read === "function" && typeof value.write === "function";
+}
+function isCookieStore(value) {
+	return typeof value === "object" && value !== null && typeof value.get === "function" && typeof value.set === "function";
 }
 function getSessionConfig(sessionOptions) {
-  const options = {
-    ...defaultOptions,
-    ...sessionOptions,
-    cookieOptions: {
-      ...defaultOptions.cookieOptions,
-      ...sessionOptions.cookieOptions || {}
-    }
-  };
-  if (sessionOptions.cookieOptions && "maxAge" in sessionOptions.cookieOptions) {
-    if (sessionOptions.cookieOptions.maxAge === void 0) {
-      options.ttl = 0;
-    }
-  } else {
-    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);
-  }
-  return options;
+	if (!sessionOptions.cookieName) throw new Error("iron-session: Bad usage. Missing cookie name.");
+	if (!sessionOptions.password) throw new Error("iron-session: Bad usage. Missing password.");
+	const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);
+	if (Object.keys(passwordsMap).length === 0) throw new Error("iron-session: Bad usage. The password map is empty, it must be keyed by numbers, for example { 1: 'your-password' }.");
+	for (const [id, password] of Object.entries(passwordsMap)) {
+		if (!Number.isInteger(Number(id))) throw new Error(`iron-session: Bad usage. Password ids must be integers, got ${JSON.stringify(id)}. Use { 1: '...', 2: '...' }.`);
+		if (typeof password !== "string" || password.length < 32) throw new Error("iron-session: Bad usage. Password must be at least 32 characters long.");
+	}
+	const options = {
+		...defaultOptions,
+		...sessionOptions,
+		passwordsMap,
+		cookieOptions: {
+			...defaultOptions.cookieOptions,
+			...sessionOptions.cookieOptions
+		}
+	};
+	if (sessionOptions.cookieOptions && "maxAge" in sessionOptions.cookieOptions) {
+		if (sessionOptions.cookieOptions.maxAge === void 0) options.ttl = 0;
+	} else options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);
+	const { expires } = options.cookieOptions;
+	if (expires instanceof Date && expires.getTime() < Date.now()) throw new Error(`iron-session: Bad usage. cookieOptions.expires is in the past (${expires.toISOString()}), so the browser will discard the cookie and the session will never persist. This usually means the Date was created once at module scope. Use \`ttl\` instead.`);
+	return options;
+}
+/**
+* The single session implementation. Reads the cookie through the jar, and
+* defines save/destroy/updateConfig against that same jar.
+*/
+async function createSession(jar, sessionOptions) {
+	let config = getSessionConfig(sessionOptions);
+	let onUnsealError = sessionOptions.onUnsealError;
+	const sealFromCookies = readSeal(jar, config.cookieName);
+	const session = sealFromCookies ? await unsealData(sealFromCookies, {
+		password: config.passwordsMap,
+		ttl: config.ttl,
+		...onUnsealError ? { onUnsealError } : {}
+	}) : {};
+	let destroyed = false;
+	Object.defineProperties(session, {
+		updateConfig: { value: function updateConfig(newSessionOptions) {
+			config = getSessionConfig(newSessionOptions);
+			onUnsealError = newSessionOptions.onUnsealError;
+		} },
+		save: { value: async function save() {
+			if (destroyed) throw new Error("iron-session: Cannot save a destroyed session. session.destroy() signs the user out, and saving afterwards would restore the cookie you just cleared. Get a fresh session if you need to write one.");
+			jar.assertWritable?.();
+			const seal = await sealData(session, {
+				password: config.passwordsMap,
+				ttl: config.ttl
+			});
+			writeSeal(jar, config, seal);
+		} },
+		destroy: { value: function destroy() {
+			destroyed = true;
+			for (const key of Object.keys(session)) delete session[key];
+			jar.write(config.cookieName, "", {
+				...config.cookieOptions,
+				maxAge: 0
+			});
+			clearStaleCookies(jar, config.cookieName, config.cookieOptions, {
+				whole: true,
+				chunksUpTo: 0
+			});
+		} }
+	});
+	return session;
+}
+/** Browsers cap one cookie at 4096 bytes over the whole `Set-Cookie` value. */
+const MAX_COOKIE_BYTES = 4096;
+/**
+* Hard cap on chunks, not configurable on purpose.
+*
+* Four chunks is already ~16 KB of `Cookie` header on every single request, and
+* nginx's default `large_client_header_buffers` is 8 KB. Letting people raise
+* this just moves the failure from our error message to a 400 at their CDN.
+*/
+const MAX_CHUNKS = 4;
+const chunkName = (cookieName, index) => `${cookieName}.${index}`;
+function cookieBytes(name, value, cookieOptions) {
+	return new TextEncoder().encode(serializeCookie(name, value, cookieOptions)).length;
+}
+/**
+* Reads the seal, whether it was stored in one cookie or split across several.
+*
+* Both shapes are always accepted regardless of the `chunk` setting, so turning
+* chunking on or off does not invalidate cookies that are already out there.
+*
+* Chunk discovery probes `name.0`, `name.1`, ... and stops at the first gap,
+* bounded by {@link MAX_CHUNKS}. There is deliberately no cookie holding the
+* chunk count: that value would be attacker-controlled, and a `name.count` of
+* 99999999 is free CPU amplification before anyone is authenticated.
+*
+* The chunks are concatenated and handed to `unseal` whole. Nothing here
+* inspects, validates or trusts an individual chunk, and that is what makes
+* reassembly safe: the HMAC already covers the entire seal string, so a deleted
+* chunk, reordered chunks, or a chunk swapped in from a different session all
+* fail integrity and land in the unreadable-cookie path.
+*/
+function readSeal(jar, cookieName) {
+	const whole = jar.read(cookieName);
+	if (whole) return whole;
+	let seal = "";
+	for (let index = 0; index < MAX_CHUNKS; index += 1) {
+		const part = jar.read(chunkName(cookieName, index));
+		if (!part) break;
+		seal += part;
+	}
+	return seal;
+}
+/**
+* Expires cookies that are no longer part of the session.
+*
+* This is the bug chunking would otherwise ship with. A session that shrinks
+* from three chunks to one leaves `name.1` and `name.2` in the browser, the next
+* read concatenates the new chunk 0 with the two stale ones, the HMAC fails, and
+* the user is signed out on every request from then on while `save()` keeps
+* reporting success. There is no error anywhere in that loop.
+*
+* Only cookies actually present on the request are expired, so a normal
+* unchunked save does not emit four pointless `Set-Cookie` headers. The expiry
+* reuses the same `path` and `domain` as the write, otherwise the browser treats
+* it as a different cookie and the delete does nothing.
+*/
+function clearStaleCookies(jar, cookieName, cookieOptions, keep) {
+	const expire = (name) => {
+		if (jar.read(name)) jar.write(name, "", {
+			...cookieOptions,
+			maxAge: 0
+		});
+	};
+	if (!keep.whole) expire(cookieName);
+	for (let index = keep.chunksUpTo; index < MAX_CHUNKS; index += 1) expire(chunkName(cookieName, index));
 }
-var badUsageMessage = "iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookieStore, options).";
-function createGetIronSession(sealData2, unsealData2) {
-  return getIronSession2;
-  async function getIronSession2(reqOrCookieStore, resOrsessionOptions, sessionOptions) {
-    if (!reqOrCookieStore) {
-      throw new Error(badUsageMessage);
-    }
-    if (!resOrsessionOptions) {
-      throw new Error(badUsageMessage);
-    }
-    if (!sessionOptions) {
-      return getIronSessionFromCookieStore(
-        reqOrCookieStore,
-        resOrsessionOptions,
-        sealData2,
-        unsealData2
-      );
-    }
-    const req = reqOrCookieStore;
-    const res = resOrsessionOptions;
-    if (!sessionOptions) {
-      throw new Error(badUsageMessage);
-    }
-    if (!sessionOptions.cookieName) {
-      throw new Error("iron-session: Bad usage. Missing cookie name.");
-    }
-    if (!sessionOptions.password) {
-      throw new Error("iron-session: Bad usage. Missing password.");
-    }
-    const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);
-    if (Object.values(passwordsMap).some((password) => password.length < 32)) {
-      throw new Error(
-        "iron-session: Bad usage. Password must be at least 32 characters long."
-      );
-    }
-    let sessionConfig = getSessionConfig(sessionOptions);
-    const sealFromCookies = getCookie(req, sessionConfig.cookieName);
-    const session = sealFromCookies ? await unsealData2(sealFromCookies, {
-      password: passwordsMap,
-      ttl: sessionConfig.ttl
-    }) : {};
-    Object.defineProperties(session, {
-      updateConfig: {
-        value: function updateConfig(newSessionOptions) {
-          sessionConfig = getSessionConfig(newSessionOptions);
-        }
-      },
-      save: {
-        value: async function save() {
-          if ("headersSent" in res && res.headersSent) {
-            throw new Error(
-              "iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()"
-            );
-          }
-          const seal = await sealData2(session, {
-            password: passwordsMap,
-            ttl: sessionConfig.ttl
-          });
-          const cookieValue = serialize(
-            sessionConfig.cookieName,
-            seal,
-            sessionConfig.cookieOptions
-          );
-          if (cookieValue.length > 4096) {
-            throw new Error(
-              `iron-session: Cookie length is too big (${cookieValue.length} bytes), browsers will refuse it. Try to remove some data.`
-            );
-          }
-          setCookie(res, cookieValue);
-        }
-      },
-      destroy: {
-        value: function destroy() {
-          Object.keys(session).forEach((key) => {
-            delete session[key];
-          });
-          const cookieValue = serialize(sessionConfig.cookieName, "", {
-            ...sessionConfig.cookieOptions,
-            maxAge: 0
-          });
-          setCookie(res, cookieValue);
-        }
-      }
-    });
-    return session;
-  }
+/**
+* Writes the seal, splitting it across cookies when it does not fit and
+* chunking is enabled.
+*
+* The seal is split as an opaque string, after the version suffix is applied to
+* the whole thing. Rejoining is a plain concatenation with no separator.
+*/
+function writeSeal(jar, config, seal) {
+	const { cookieName, cookieOptions } = config;
+	const wholeBytes = cookieBytes(cookieName, seal, cookieOptions);
+	if (wholeBytes <= MAX_COOKIE_BYTES) {
+		jar.write(cookieName, seal, cookieOptions);
+		clearStaleCookies(jar, cookieName, cookieOptions, {
+			whole: true,
+			chunksUpTo: 0
+		});
+		return;
+	}
+	if (!config.chunk) {
+		const wasChunked = Boolean(jar.read(chunkName(cookieName, 0)));
+		throw new Error(wasChunked ? `iron-session: Cookie length is too big (${wholeBytes} bytes) and \`chunk\` is not enabled here, but this session is already stored across several cookies. You have more than one options object and only some of them set \`chunk: true\`. Use the same options everywhere you call getIronSession, including middleware.` : `iron-session: Cookie length is too big (${wholeBytes} bytes), browsers will refuse it. Remove some data from the session, or set \`chunk: true\` to split it across several cookies.`);
+	}
+	const perChunkOverhead = cookieBytes(chunkName(cookieName, 0), "", cookieOptions);
+	const budget = MAX_COOKIE_BYTES - perChunkOverhead;
+	if (budget <= 0) throw new Error(`iron-session: The cookie name and options alone take ${perChunkOverhead} bytes, which leaves no room for session data. Use a shorter cookie name.`);
+	const chunks = [];
+	for (let offset = 0; offset < seal.length; offset += budget) chunks.push(seal.slice(offset, offset + budget));
+	if (chunks.length > MAX_CHUNKS) throw new Error(`iron-session: The session needs ${chunks.length} cookies and the maximum is ${MAX_CHUNKS}. Even at ${MAX_CHUNKS} the whole Cookie header is sent on every request and proxies commonly cap it at 8 KB, so raising this would fail at your CDN instead. Store an id in the session and keep the data in your database.`);
+	chunks.forEach((value, index) => {
+		jar.write(chunkName(cookieName, index), value, cookieOptions);
+	});
+	clearStaleCookies(jar, cookieName, cookieOptions, {
+		whole: false,
+		chunksUpTo: chunks.length
+	});
 }
-async function getIronSessionFromCookieStore(cookieStore, sessionOptions, sealData2, unsealData2) {
-  if (!sessionOptions.cookieName) {
-    throw new Error("iron-session: Bad usage. Missing cookie name.");
-  }
-  if (!sessionOptions.password) {
-    throw new Error("iron-session: Bad usage. Missing password.");
-  }
-  const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);
-  if (Object.values(passwordsMap).some((password) => password.length < 32)) {
-    throw new Error(
-      "iron-session: Bad usage. Password must be at least 32 characters long."
-    );
-  }
-  let sessionConfig = getSessionConfig(sessionOptions);
-  const sealFromCookies = getServerActionCookie(
-    sessionConfig.cookieName,
-    cookieStore
-  );
-  const session = sealFromCookies ? await unsealData2(sealFromCookies, {
-    password: passwordsMap,
-    ttl: sessionConfig.ttl
-  }) : {};
-  Object.defineProperties(session, {
-    updateConfig: {
-      value: function updateConfig(newSessionOptions) {
-        sessionConfig = getSessionConfig(newSessionOptions);
-      }
-    },
-    save: {
-      value: async function save() {
-        const seal = await sealData2(session, {
-          password: passwordsMap,
-          ttl: sessionConfig.ttl
-        });
-        const cookieLength = sessionConfig.cookieName.length + seal.length + JSON.stringify(sessionConfig.cookieOptions).length;
-        if (cookieLength > 4096) {
-          throw new Error(
-            `iron-session: Cookie length is too big (${cookieLength} bytes), browsers will refuse it. Try to remove some data.`
-          );
-        }
-        cookieStore.set(
-          sessionConfig.cookieName,
-          seal,
-          sessionConfig.cookieOptions
-        );
-      }
-    },
-    destroy: {
-      value: function destroy() {
-        Object.keys(session).forEach((key) => {
-          delete session[key];
-        });
-        const cookieOptions = { ...sessionConfig.cookieOptions, maxAge: 0 };
-        cookieStore.set(sessionConfig.cookieName, "", cookieOptions);
-      }
-    }
-  });
-  return session;
+const badUsageMessage = "iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookieStore, options).";
+async function getIronSession(first, second, third) {
+	if (!first || !second) throw new Error(badUsageMessage);
+	if (!third) {
+		const options = second;
+		if (isCookieJar(first)) return createSession(first, options);
+		if (isCookieStore(first)) return createSession(cookieStoreJar(first), options);
+		throw new Error(badUsageMessage);
+	}
+	const req = first;
+	const res = second;
+	return createSession(isWebRequest(req) ? webCookies(req, res) : nodeCookies(req, res), third);
 }
-var sealData = createSealData(crypto);
-var unsealData = createUnsealData(crypto);
-var getIronSession = createGetIronSession(sealData, unsealData);
+//#endregion
+export { getIronSession, nextProxyCookies, nodeCookies, sealData, unsealData, webCookies };
 
-export { getIronSession, sealData, unsealData };
-//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map