Cookie signatures lose attributes upon re-signing, causing persistent cookie to become invalid about cookies HOT 5 OPEN

hmm. this is a good point. i'm not sure there's much we can do other than giving a heads-up in the README. what do you think?

from cookies.

The only way to deal with it transparently is to encode the options in the .sig, and then add another signature of the options as well.

 if (signed) {
  cookie.value = cookie.toSig();
  cookie.name += ".sig"
  headers = pushCookie(headers, cookie)
}

   toSig: function() {
      var options = JSON.stringify({ path: this.path, expires: this.expires, domain: this.domain, secure: this.secure })
      return JSON.stringify({
          sig: sign(cookie.toString()),
          opts: options,
          optsSig: sign(options)
      })
  }

Then you would have to pull out the ‘opts’ from the .sig cookie and use them when re-creating the .sig with a new signing key to keep the settings consistent.

Maybe not so bad when it’s all said and done.

from cookies.

good point, @jspilman. i'm a little queasy about bloating the scope of the .sig cookie with this much state, to be honest. perhaps we'd be better of with opt-in defaults for a specific cookie implementations?

from cookies.

This bug has been causing us quite a lot of troubles. I think this should be fixed as soon as possible.

from cookies.

This problem has caused trouble in our production website. We use expressjs/cookie-session (which uses this module as a dependency) and set the cookie to expire in 1 year (we have a server-side system to expire sessions). We rotated the key but then the session.sig gets to expire at browser close instead of 1 year when uses comes back and session is re-signed. Then uses closes his browser and comes back and is logged out (which we don't want). We have taken several hours to find the cause of this issue and finally found this.

from cookies.