Comments (7)
node scripts/install.js
is all you need to make the default keys.
as for submodules, they've given me enough grief already, and keygrip is not a hard dependency; it's optional only if you want to sign cookies.
from cookies.
I'd say in our modern world unsigned cookies are evil ;)
I read the deprecation note and didn't get what is the killer improvement over cookie-node? Couldn't you elaborate on this? TIA
from cookies.
vladimir,
good point. i've added a Features
section to the README. let me know if you have any other questions.
from cookies.
Plain text signed cookies, even though can't be tampered, seem a bit more disclosing than I'd expect. Just reading them at sniffer level already provides valuable info. Wrong?
So the hardened (in fact, vanilla) solution (using secure, httponly, and signed: true
via keygrip (and of course HTTPS transport)) would be nice to have as a simple drop-in one-file-module.
Still, great repo, thanks!
from cookies.
i think that if you're putting valuable information in a cookie, you're doing it wrong, and no library should encourage that. so i don't think it's wise to try and over engineer something in this case.
do you think the secure
and httpOnly
defaults should be flipped?
from cookies.
I do put user id in cookie, that's requirement for a project I do. But they don't want it be "visible" in plain. I know that's quirky but so things are. NVM
No, defaults are ok to me. The only inconvenience so far is that keygrip require()
s defaults even if they are not needed -- this leads to node scripts/install.js
must be run ...
from cookies.
that makes sense.
i've changed defaultKeys.js
into the plain JSON file defaultKeys.json
- if keys are provided, it is not used.
- if it exists keys aren't provided, it is loaded and used.
- else an error is thrown.
for some reason the GitHub interface isn't reflecting this latest push yet, but it should be there soon.
from cookies.
Related Issues (20)
- Getting cookies of a request without having to pass response argument HOT 2
- Set Domain in options is not working HOT 3
- request.connection is deprecated
- set cookie with ";" is broken and the "signed" property returns undefined HOT 2
- Release sameSite = none PR HOT 3
- Storing cookie value + signature in a unified cookie instead of cookie_name.sig HOT 1
- Using this with Http2stream HOT 3
- How to install? HOT 1
- Migrate to travis-ci.com HOT 1
- Support of Sha256 HOT 1
- TypeError: Cannot read property 'encrypted' of undefined HOT 1
- make setHeader compatible with fastify reply (patch included) HOT 2
- Cookie maxAge HOT 1
- Using "signed: ture" will set two cookies? HOT 3
- missing cookie option "Priority" HOT 1
- How to allow multiple domains for CookieOptions.domain
- Get a cookie in 2023 HOT 1
- How to set SameSite attribute for .sig? HOT 1
- Cookies Having Independent Partitioned State (CHIPS, also know as Partitioned cookies) HOT 2
- Cookie overwrite not working
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cookies.