index.js 3.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181
  1. /*!
  2. * cookie-parser
  3. * Copyright(c) 2014 TJ Holowaychuk
  4. * Copyright(c) 2015 Douglas Christopher Wilson
  5. * MIT Licensed
  6. */
  7. 'use strict';
  8. /**
  9. * Module dependencies.
  10. * @private
  11. */
  12. var cookie = require('cookie');
  13. var signature = require('cookie-signature');
  14. /**
  15. * Module exports.
  16. * @public
  17. */
  18. module.exports = cookieParser;
  19. module.exports.JSONCookie = JSONCookie;
  20. module.exports.JSONCookies = JSONCookies;
  21. module.exports.signedCookie = signedCookie;
  22. module.exports.signedCookies = signedCookies;
  23. /**
  24. * Parse Cookie header and populate `req.cookies`
  25. * with an object keyed by the cookie names.
  26. *
  27. * @param {string|array} [secret] A string (or array of strings) representing cookie signing secret(s).
  28. * @param {Object} [options]
  29. * @return {Function}
  30. * @public
  31. */
  32. function cookieParser(secret, options) {
  33. return function cookieParser(req, res, next) {
  34. if (req.cookies) {
  35. return next();
  36. }
  37. var cookies = req.headers.cookie;
  38. var secrets = !secret || Array.isArray(secret)
  39. ? (secret || [])
  40. : [secret];
  41. req.secret = secrets[0];
  42. req.cookies = Object.create(null);
  43. req.signedCookies = Object.create(null);
  44. // no cookies
  45. if (!cookies) {
  46. return next();
  47. }
  48. req.cookies = cookie.parse(cookies, options);
  49. // parse signed cookies
  50. if (secrets.length !== 0) {
  51. req.signedCookies = signedCookies(req.cookies, secrets);
  52. req.signedCookies = JSONCookies(req.signedCookies);
  53. }
  54. // parse JSON cookies
  55. req.cookies = JSONCookies(req.cookies);
  56. next();
  57. };
  58. }
  59. /**
  60. * Parse JSON cookie string.
  61. *
  62. * @param {String} str
  63. * @return {Object} Parsed object or undefined if not json cookie
  64. * @public
  65. */
  66. function JSONCookie(str) {
  67. if (typeof str !== 'string' || str.substr(0, 2) !== 'j:') {
  68. return undefined;
  69. }
  70. try {
  71. return JSON.parse(str.slice(2));
  72. } catch (err) {
  73. return undefined;
  74. }
  75. }
  76. /**
  77. * Parse JSON cookies.
  78. *
  79. * @param {Object} obj
  80. * @return {Object}
  81. * @public
  82. */
  83. function JSONCookies(obj) {
  84. var cookies = Object.keys(obj);
  85. var key;
  86. var val;
  87. for (var i = 0; i < cookies.length; i++) {
  88. key = cookies[i];
  89. val = JSONCookie(obj[key]);
  90. if (val) {
  91. obj[key] = val;
  92. }
  93. }
  94. return obj;
  95. }
  96. /**
  97. * Parse a signed cookie string, return the decoded value.
  98. *
  99. * @param {String} str signed cookie string
  100. * @param {string|array} secret
  101. * @return {String} decoded value
  102. * @public
  103. */
  104. function signedCookie(str, secret) {
  105. if (typeof str !== 'string') {
  106. return undefined;
  107. }
  108. if (str.substr(0, 2) !== 's:') {
  109. return str;
  110. }
  111. var secrets = !secret || Array.isArray(secret)
  112. ? (secret || [])
  113. : [secret];
  114. for (var i = 0; i < secrets.length; i++) {
  115. var val = signature.unsign(str.slice(2), secrets[i]);
  116. if (val !== false) {
  117. return val;
  118. }
  119. }
  120. return false;
  121. }
  122. /**
  123. * Parse signed cookies, returning an object containing the decoded key/value
  124. * pairs, while removing the signed key from obj.
  125. *
  126. * @param {Object} obj
  127. * @param {string|array} secret
  128. * @return {Object}
  129. * @public
  130. */
  131. function signedCookies(obj, secret) {
  132. var cookies = Object.keys(obj);
  133. var dec;
  134. var key;
  135. var ret = Object.create(null);
  136. var val;
  137. for (var i = 0; i < cookies.length; i++) {
  138. key = cookies[i];
  139. val = obj[key];
  140. dec = signedCookie(val, secret);
  141. if (val !== dec) {
  142. ret[key] = dec;
  143. delete obj[key];
  144. }
  145. }
  146. return ret;
  147. }