cookie-signature dependency has timing vulnerability

[drewjenkins]

See https://snyk.io/vuln/npm:cookie-signature:20180111 for details.

To resolve, upgrade the cookie-parser dependency to 1.1.0 or above

[dougwilson]

We cannot upgrade because Node.js 6 is required to upgrade.

[dougwilson]

See discussion and my rejected PR in tj/node-cookie-signature#25

[dougwilson]

The author of cookie-signature asserts that Snyk is wrong and prior versions are not vulunerable. We are kinda stuck...

[dougwilson]

I created tj/node-cookie-signature#27 to determine more from that upstream dependency.

Security issues need to be reported per our policy in https://github.com/expressjs/express/blob/master/Security.md in the future.

[dougwilson]

FYI the author of cookie-signature is looking to contact Snyk to remove the incorrect report: tj/node-cookie-signature#27 (comment)

[dougwilson]

The Snyk report was incorrect and has been removed.