Allow secure cookies to be set for http localhost

lib/cookie.js

@@ -791,6 +791,28 @@ function getCookieContext(url) {
   return urlParse(url);
 }
 
+/**
+ * This is a method which determines if the top level domain associated with a cookie
+ * is special use domain.
+ * @param {string} domain - The cannonical domain which is associated with the cookie
+ * @returns {boolean}
+ */
+function isSpecialDomain(domain) {
+  if (!domain || typeof domain !== "string") {
+    return false;
+  }
+
+  const SPECIAL_TREATMENT_DOMAINS = ["localhost"],
+    domainParts = domain.split("."),
+    topLevelDomain = domainParts.pop();
+
+  if (SPECIAL_TREATMENT_DOMAINS.includes(topLevelDomain)) {
+    return true;
+  }
+
+  return false;
+}
+
 const cookieDefaults = {
   // the order in which the RFC has them:
   key: "",
@@ -1116,7 +1138,8 @@ class CookieJar {
   }
 
   setCookie(cookie, url, options, cb) {
-    validators.validate(validators.isNonEmptyString(url), cb, options);
+    validators.validate(validators.isUrlStringOrObject(url), cb, options);
+
     let err;
 
     if (validators.isFunction(url)) {
@@ -1314,7 +1337,8 @@ class CookieJar {
 
   // RFC6365 S5.4
   getCookies(url, options, cb) {
-    validators.validate(validators.isNonEmptyString(url), cb, url);
+    validators.validate(validators.isUrlStringOrObject(url), cb, url);
+
     const context = getCookieContext(url);
     if (validators.isFunction(options)) {
       cb = options;
@@ -1327,10 +1351,15 @@ class CookieJar {
     const path = context.pathname || "/";
 
     let secure = options.secure;
+
+    // Additional check for special domain as per RFC 6265 to treat localhost as secure channel
+    // https://www.rfc-editor.org/rfc/rfc6265#page-21
     if (
       secure == null &&
       context.protocol &&
-      (context.protocol == "https:" || context.protocol == "wss:")
+      (context.protocol == "https:" ||
+        context.protocol == "wss:" ||
+        isSpecialDomain(host))
     ) {
       secure = true;
     }

lib/pubsuffix-psl.js

@@ -61,7 +61,11 @@ function getPublicSuffix(domain, options = {}) {
     }
   }
 
-  if (!ignoreError && SPECIAL_USE_DOMAINS.includes(topLevelDomain)) {
+  if (
+    !ignoreError &&
+    !allowSpecialUseDomain &&
+    SPECIAL_USE_DOMAINS.includes(topLevelDomain)
+  ) {
     throw new Error(
       `Cookie has domain set to the public suffix "${topLevelDomain}" which is a special use domain. To allow this, configure your CookieJar with {allowSpecialUseDomain:true, rejectPublicSuffixes: false}.`
     );

lib/validators.js

@@ -59,6 +59,14 @@ function isInstanceStrict(data, prototype) {
   }
 }
 
+function isUrlStringOrObject(data) {
+  return (
+    isNonEmptyString(data) ||
+    isObject(data) || // TODO: Check for URL properties that are used.
+    isInstanceStrict(data, URL)
+  );
+}
+
 function isInteger(data) {
   return typeof data === "number" && data % 1 === 0;
 }
@@ -92,4 +100,5 @@ exports.isDate = isDate;
 exports.isEmptyString = isEmptyString;
 exports.isString = isString;
 exports.isObject = isObject;
+exports.isUrlStringOrObject = isUrlStringOrObject;
 exports.validate = validate;

lib/version.js

@@ -1,2 +1,2 @@
 // generated by genversion
-module.exports = '4.1.2'
+module.exports = '4.1.2-postman.1'

package.json

@@ -55,7 +55,7 @@
     }
   ],
   "license": "BSD-3-Clause",
-  "name": "tough-cookie",
+  "name": "@postman/tough-cookie",
   "description": "RFC6265 Cookies and Cookie Jar for node.js",
   "keywords": [
     "HTTP",
@@ -67,14 +67,14 @@
     "RFC6265",
     "RFC2965"
   ],
-  "version": "4.1.2",
-  "homepage": "https://github.com/salesforce/tough-cookie",
+  "version": "4.1.2-postman.2",
+  "homepage": "https://github.com/postmanlabs/tough-cookie",
   "repository": {
     "type": "git",
-    "url": "git://github.com/salesforce/tough-cookie.git"
+    "url": "git://github.com/postmanlabs/tough-cookie.git"
   },
   "bugs": {
-    "url": "https://github.com/salesforce/tough-cookie/issues"
+    "url": "https://github.com/postmanlabs/tough-cookie/issues"
   },
   "main": "./lib/cookie",
   "files": [