From 0723cd230514b623c4454120dae988fd5a68ec44 Mon Sep 17 00:00:00 2001 From: Yiyu He Date: Fri, 11 May 2018 14:16:02 +0800 Subject: [PATCH] docs(cookie): how to get frontend cookie (#2542) --- docs/source/en/core/cookie-and-session.md | 8 ++++++++ docs/source/zh-cn/core/cookie-and-session.md | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/docs/source/en/core/cookie-and-session.md b/docs/source/en/core/cookie-and-session.md index 9a498153c3..c81edf3685 100644 --- a/docs/source/en/core/cookie-and-session.md +++ b/docs/source/en/core/cookie-and-session.md @@ -90,6 +90,14 @@ the corresponding options also need to be used in `get` method. - If `signed` is true when `set` Cookie but false when `get` Cookie, egg.js doesn't verify Cookie value, so the value could have been modified by client. - If `encrypt` is true when `set` Cookie but false when `get` Cookie, what you get is encrypted text rather than the raw plain text. +If you want to get the cookie set by frontend or other system, you need to specify the parameter `signed` as `false`, avoid varify the cookie and not getting the vlaue. + +```js +ctx.cookies.get('frontend-cookie', { + signed: false, +}); +``` + ### Cookie Secret Key Since we need to sign and encrypt Cookie, a secret key is required. diff --git a/docs/source/zh-cn/core/cookie-and-session.md b/docs/source/zh-cn/core/cookie-and-session.md index 2357ddb8ac..a969446182 100644 --- a/docs/source/zh-cn/core/cookie-and-session.md +++ b/docs/source/zh-cn/core/cookie-and-session.md @@ -75,6 +75,14 @@ ctx.cookies.set(key, value, { - 如果设置的时候指定为 signed,获取时未指定,则不会在获取时对取到的值做验签,导致可能被客户端篡改。 - 如果设置的时候指定为 encrypt,获取时未指定,则无法获取到真实的值,而是加密过后的密文。 +如果要获取前端或者其他系统设置的 cookie,需要指定参数 `signed` 为 `false`,避免对它做验签导致获取不到 cookie 的值。 + +```js +ctx.cookies.get('frontend-cookie', { + signed: false, +}); +``` + ### Cookie 秘钥 由于我们在 Cookie 中需要用到加解密和验签,所以需要配置一个秘钥供加密使用。在 `config/config.default.js` 中