index.js 3.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182
  1. /*!
  2. * cookie-parser
  3. * Copyright(c) 2014 TJ Holowaychuk
  4. * Copyright(c) 2015 Douglas Christopher Wilson
  5. * MIT Licensed
  6. */
  7. 'use strict'
  8. /**
  9. * Module dependencies.
  10. * @private
  11. */
  12. var cookie = require('cookie')
  13. var signature = require('cookie-signature')
  14. /**
  15. * Module exports.
  16. * @public
  17. */
  18. module.exports = cookieParser
  19. module.exports.JSONCookie = JSONCookie
  20. module.exports.JSONCookies = JSONCookies
  21. module.exports.signedCookie = signedCookie
  22. module.exports.signedCookies = signedCookies
  23. /**
  24. * Parse Cookie header and populate `req.cookies`
  25. * with an object keyed by the cookie names.
  26. *
  27. * @param {string|array} [secret] A string (or array of strings) representing cookie signing secret(s).
  28. * @param {Object} [options]
  29. * @return {Function}
  30. * @public
  31. */
  32. function cookieParser (secret, options) {
  33. var secrets = !secret || Array.isArray(secret)
  34. ? (secret || [])
  35. : [secret]
  36. return function cookieParser (req, res, next) {
  37. if (req.cookies) {
  38. return next()
  39. }
  40. var cookies = req.headers.cookie
  41. req.secret = secrets[0]
  42. req.cookies = Object.create(null)
  43. req.signedCookies = Object.create(null)
  44. // no cookies
  45. if (!cookies) {
  46. return next()
  47. }
  48. req.cookies = cookie.parse(cookies, options)
  49. // parse signed cookies
  50. if (secrets.length !== 0) {
  51. req.signedCookies = signedCookies(req.cookies, secrets)
  52. req.signedCookies = JSONCookies(req.signedCookies)
  53. }
  54. // parse JSON cookies
  55. req.cookies = JSONCookies(req.cookies)
  56. next()
  57. }
  58. }
  59. /**
  60. * Parse JSON cookie string.
  61. *
  62. * @param {String} str
  63. * @return {Object} Parsed object or undefined if not json cookie
  64. * @public
  65. */
  66. function JSONCookie (str) {
  67. if (typeof str !== 'string' || str.substr(0, 2) !== 'j:') {
  68. return undefined
  69. }
  70. try {
  71. return JSON.parse(str.slice(2))
  72. } catch (err) {
  73. return undefined
  74. }
  75. }
  76. /**
  77. * Parse JSON cookies.
  78. *
  79. * @param {Object} obj
  80. * @return {Object}
  81. * @public
  82. */
  83. function JSONCookies (obj) {
  84. var cookies = Object.keys(obj)
  85. var key
  86. var val
  87. for (var i = 0; i < cookies.length; i++) {
  88. key = cookies[i]
  89. val = JSONCookie(obj[key])
  90. if (val) {
  91. obj[key] = val
  92. }
  93. }
  94. return obj
  95. }
  96. /**
  97. * Parse a signed cookie string, return the decoded value.
  98. *
  99. * @param {String} str signed cookie string
  100. * @param {string|array} secret
  101. * @return {String} decoded value
  102. * @public
  103. */
  104. function signedCookie (str, secret) {
  105. if (typeof str !== 'string') {
  106. return undefined
  107. }
  108. if (str.substr(0, 2) !== 's:') {
  109. return str
  110. }
  111. var secrets = !secret || Array.isArray(secret)
  112. ? (secret || [])
  113. : [secret]
  114. for (var i = 0; i < secrets.length; i++) {
  115. var val = signature.unsign(str.slice(2), secrets[i])
  116. if (val !== false) {
  117. return val
  118. }
  119. }
  120. return false
  121. }
  122. /**
  123. * Parse signed cookies, returning an object containing the decoded key/value
  124. * pairs, while removing the signed key from obj.
  125. *
  126. * @param {Object} obj
  127. * @param {string|array} secret
  128. * @return {Object}
  129. * @public
  130. */
  131. function signedCookies (obj, secret) {
  132. var cookies = Object.keys(obj)
  133. var dec
  134. var key
  135. var ret = Object.create(null)
  136. var val
  137. for (var i = 0; i < cookies.length; i++) {
  138. key = cookies[i]
  139. val = obj[key]
  140. dec = signedCookie(val, secret)
  141. if (val !== dec) {
  142. ret[key] = dec
  143. delete obj[key]
  144. }
  145. }
  146. return ret
  147. }