Release 0.8

.travis.yml

@@ -14,6 +14,7 @@ node_js:
   - "9.11"
   - "10.16"
   - "11.15"
+  - "12.11"
 sudo: false
 cache:
   directories:
@@ -68,8 +69,8 @@ before_install:
     fi
   - |
     # restify framework
-    # - remove on Node.js < 0.10
-    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
+    # - remove on Node.js < 8
+    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 8 ]]; then
       npm rm --silent --save-dev restify
     fi
   - |

HISTORY.md

@@ -1,3 +1,15 @@
+unreleased
+==========
+
+  * Fix check for default `secure` option behavior
+  * Fix `maxAge` option preventing cookie deletion
+  * Support `"none"` in `sameSite` option
+  * deps: depd@~2.0.0
+    - Replace internal `eval` usage with `Function` constructor
+    - Use instance methods on `process` to check for listeners
+  * deps: keygrip@~1.1.0
+    - Use `tsscmp` module for timing-safe signature verification
+
 0.7.3 / 2018-11-04
 ==================
 

index.js

@@ -26,7 +26,7 @@ var fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/;
  * RegExp to match Same-Site cookie attribute value.
  */
 
-var sameSiteRegExp = /^(?:lax|strict)$/i
+var SAME_SITE_REGEXP = /^(?:lax|none|strict)$/i
 
 function Cookies(request, response, options) {
   if (!(this instanceof Cookies)) return new Cookies(request, response, options)
@@ -94,8 +94,9 @@ Cookies.prototype.set = function(name, value, opts) {
     throw new Error('Cannot send secure cookie over unencrypted connection')
   }
 
-  cookie.secure = secure
-  if (opts && "secure" in opts) cookie.secure = opts.secure
+  cookie.secure = opts && opts.secure !== undefined
+    ? opts.secure
+    : secure
 
   if (opts && "secureProxy" in opts) {
     deprecate('"secureProxy" option; use "secure" option, provide "secure" to constructor if needed')
@@ -125,15 +126,18 @@ function Cookie(name, value, attrs) {
     throw new TypeError('argument value is invalid');
   }
 
-  value || (this.expires = new Date(0))
-
   this.name = name
   this.value = value || ""
 
   for (var name in attrs) {
     this[name] = attrs[name]
   }
 
+  if (!this.value) {
+    this.expires = new Date(0)
+    this.maxAge = null
+  }
+
   if (this.path && !fieldContentRegExp.test(this.path)) {
     throw new TypeError('option path is invalid');
   }
@@ -142,7 +146,7 @@ function Cookie(name, value, attrs) {
     throw new TypeError('option domain is invalid');
   }
 
-  if (this.sameSite && this.sameSite !== true && !sameSiteRegExp.test(this.sameSite)) {
+  if (this.sameSite && this.sameSite !== true && !SAME_SITE_REGEXP.test(this.sameSite)) {
     throw new TypeError('option sameSite is invalid')
   }
 }

package.json

@@ -9,15 +9,15 @@
   "license": "MIT",
   "repository": "pillarjs/cookies",
   "dependencies": {
-    "depd": "~1.1.2",
-    "keygrip": "~1.0.3"
+    "depd": "~2.0.0",
+    "keygrip": "~1.1.0"
   },
   "devDependencies": {
     "eslint": "4.19.1",
-    "express": "4.16.4",
-    "mocha": "6.1.4",
-    "nyc": "14.0.0",
-    "restify": "6.4.0",
+    "express": "4.17.1",
+    "mocha": "6.2.1",
+    "nyc": "14.1.1",
+    "restify": "8.4.0",
     "supertest": "4.0.2"
   },
   "files": [

test/cookie.js

@@ -95,6 +95,13 @@ describe('new Cookie(name, value, [options])', function () {
         })
       })
 
+      describe('when set to "none"', function () {
+        it('should set "samesite=none" attribute in header', function () {
+          var cookie = new cookies.Cookie('foo', 'bar', { sameSite: 'none' })
+          assert.equal(cookie.toHeader(), 'foo=bar; path=/; samesite=none; httponly')
+        })
+      })
+
       describe('when set to "strict"', function () {
         it('should set "samesite=strict" attribute in header', function () {
           var cookie = new cookies.Cookie('foo', 'bar', { sameSite: 'strict' })

test/test.js

@@ -278,6 +278,16 @@ describe('new Cookies(req, res, [options])', function () {
           .expect(shouldSetCookieWithoutAttribute('foo', 'maxAge'))
           .end(done)
       })
+
+      it('should not affect cookie deletion', function (done) {
+        request(createServer(setCookieHandler('foo', null, { maxAge: 86400000 })))
+          .get('/')
+          .expect(200)
+          .expect(shouldSetCookieCount(1))
+          .expect(shouldSetCookieToValue('foo', ''))
+          .expect(shouldSetCookieWithAttributeAndValue('foo', 'expires', 'Thu, 01 Jan 1970 00:00:00 GMT'))
+          .end(done)
+      })
     })
 
     describe('"overwrite" option', function () {
@@ -401,6 +411,45 @@ describe('new Cookies(req, res, [options])', function () {
           })
         })
       })
+
+      describe('when undefined', function () {
+        it('should set secure attribute on encrypted connection', function (done) {
+          var server = createSecureServer(setCookieHandler('foo', 'bar', { secure: undefined }))
+
+          request(server)
+            .get('/')
+            .ca(server.cert)
+            .expect(200)
+            .expect(shouldSetCookieWithAttribute('foo', 'Secure'))
+            .end(done)
+        })
+
+        describe('with "secure: undefined" constructor option', function () {
+          it('should not set secure attribute on unencrypted connection', function (done) {
+            var opts = { secure: undefined }
+
+            request(createServer(opts, setCookieHandler('foo', 'bar', { secure: undefined })))
+              .get('/')
+              .expect(200)
+              .expect(shouldSetCookieWithoutAttribute('foo', 'Secure'))
+              .end(done)
+          })
+        })
+
+        describe('with req.protocol === "https"', function () {
+          it('should set secure attribute on unencrypted connection', function (done) {
+            request(createServer(function (req, res, cookies) {
+              req.protocol = 'https'
+              cookies.set('foo', 'bar', { secure: undefined })
+              res.end()
+            }))
+              .get('/')
+              .expect(200)
+              .expect(shouldSetCookieWithAttribute('foo', 'Secure'))
+              .end(done)
+          })
+        })
+      })
     })
 
     describe('"secureProxy" option', function () {