Parsed multiple cookies wrongly

[lnshi]

In Node.js express server:

const cookieBaseOpts = {
  path: '/',
  secure: true,
  httpOnly: true,
};

const cookieOpts = Object.assign({}, cookieBaseOpts, {
  expires: new Date(decodedRT.exp * 1000)
});

res.cookie('accessToken', tokens.accessToken, cookieOpts);
res.cookie('refreshToken', tokens.refreshToken, cookieOpts);

This will result the response set-cookie header like this:

accessToken=eyJhbGciOiJIUzI1NiIsInRI6IkpXVCJ9.eyJ1aWQiJTMXhNWVA1Y0ZaIiwiY2lkIjoiQnlmS3c1OXRaIiwiZGlkIjoiQjF3TXR3cTV0VyIsInNjcCI6W10sImV4cCI6MTUwNDUxOTU2MiwiaXNzIjoiVi1jdWJlLCBJbmMuIiwic3ViIjoiQVQiLCJqdGkiOiJya19mdEQNVlXIn0.f12SwbI9LEgB7feqdMYgvivhw4bJtkqVx6ivdvGj8; Path=/; Expires=Wed, 04 Oct 2017 09:06:02 GMT; HttpOnly; Secure,refreshToken=eyJhbGciOiJIUzI1NiIsInR5cCIkpXVCJ9.eyJleHAiOjE1MDcxMDc5NjIsImlzcyI6IlYtY3ViZSwgSW5jLiIsInN1YiI6IlJUIiwianRpIjoicmtfZnREOTVZVyJ9.GHKjlE8t0x2rDpuCPOFGEvMFXZxV0JVsoI1sGN7o3U; Path=/; Expires=Wed, 04 Oct 2017 09:06:02 GMT; HttpOnly; Secure

Which if call the parse method, will get wrong parsed object:

{
  accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkVCJ9.eyJ1aWQiOiJTMXhNWVA1Y0ZaIiwiY2lkIjiwiZGlkIjoiQjF3TXR3cTV0VyIsInNjcCI6W10sImV4cCI6MTUwNDUxOTU2MiwiaXNzIjoiVi1jdWJlLCBJbmMuIiwic3ViIjoiQVQiLCJqdGkiOiJya19mdEQ5NVlXIn0.f12OSwbI9LEgeqdMYOgvivhwbJtkqVx6ivdvGj8',
  Path: '/',
  Expires: 'Wed, 04 Oct 2017 09:06:02 GMT',
  'Secure,refreshToken': 'eyJhbGciOiJIUzI1NiIsInR5cCIpXVCJ9.eyJleHAiOjE1MDcxMDc5NjIsIIlYtY3ViZSwgSW5jLiIsInN1YiI6IlJUIiwianRpIjoicmtfZnREOTVZVyJ9.GHKjlEA8t0x2rDpuCPFGEvMFXZxV0JVsoI1sGN7o3U'
}

See the key: Secure,refreshToken

[dougwilson]

Hi @lnshi the main issue here is that the parse function doesn't accept the value from a set-cookie header, only from a cookie header.