@architect/functions - npm Package Compare versions

Comparing version 1.0.5 to 1.1.1

package.json

 {
   "name": "@architect/functions",
-  "version": "1.0.5",
+  "version": "1.1.1",
   "description": "architect run commands",
@@ -24,2 +24,3 @@ "main": "index",
     "cookie": "^0.3.1",
+    "cookie-signature": "^1.0.6",
     "run-parallel": "^1.1.6",
@@ -26,0 +27,0 @@ "run-waterfall": "^1.1.3",

src/http/html/_request.js

 var cookie = require('cookie')
 var _response = require('./_response')
 var session = require('../session').client(process.env.SESSION_TABLE_NAME || 'arc-sessions')
+var unsign = require('cookie-signature').unsign
+var secret = process.env.ARC_APP_SECRET || process.env.ARC_APP_NAME || 'fallback'
 
@@ -25,5 +27,7 @@ module.exports = function arc(...fns) {
     var sesh = jar.hasOwnProperty('_idx')
-    var exec = sesh? session.find : session.create
-    var params = sesh? jar._idx : {}
+    var valid = unsign(jar._idx || '', secret)
 
+    var exec = sesh && valid? session.find : session.create
+    var params = sesh && valid? valid : {}
+
     exec(params, function _find(err, payload) {
@@ -30,0 +34,0 @@ if (err) {

src/http/html/_response.js

 var session = require('../session').client(process.env.SESSION_TABLE_NAME || 'arc-sessions')
 var cookie = require('cookie')
+var sign = require('cookie-signature').sign
+var secret = process.env.ARC_APP_SECRET || process.env.ARC_APP_NAME || 'fallback'
 
@@ -34,3 +36,3 @@ module.exports = function response(request, callback, cmds) {
       var maxAge = Date.now() + 7.884e+11
-      cmds.cookie = cookie.serialize('_idx', request._idx, {
+      cmds.cookie = cookie.serialize('_idx', sign(request._idx, secret), {
         maxAge,
@@ -37,0 +39,0 @@ expires: new Date(maxAge),

src/http/json/_request.js

 var cookie = require('cookie')
 var _response = require('./_response')
 var session = require('../session').client(process.env.SESSION_TABLE_NAME || 'arc-sessions')
+var unsign = require('cookie-signature').unsign
+var secret = process.env.ARC_APP_SECRET || process.env.ARC_APP_NAME || 'fallback'
 
@@ -25,5 +27,7 @@ module.exports = function arc(...fns) {
     var sesh = jar.hasOwnProperty('_idx')
-    var exec = sesh? session.find : session.create
-    var params = sesh? jar._idx : {}
+    var valid = unsign(jar._idx || '', secret)
 
+    var exec = sesh && valid? session.find : session.create
+    var params = sesh && valid? valid : {}
+
     exec(params, function _find(err, payload) {
@@ -30,0 +34,0 @@ if (err) {

src/http/json/_response.js

 var session = require('../session').client(process.env.SESSION_TABLE_NAME || 'arc-sessions')
 var cookie = require('cookie')
+var sign = require('cookie-signature').sign
+var secret = process.env.ARC_APP_SECRET || process.env.ARC_APP_NAME || 'fallback'
 
@@ -34,3 +36,3 @@ module.exports = function response(request, callback, cmds) {
       var maxAge = Date.now() + 7.884e+11
-      cmds.cookie = cookie.serialize('_idx', request._idx, {
+      cmds.cookie = cookie.serialize('_idx', sign(request._idx, secret), {
         maxAge,
@@ -37,0 +39,0 @@ expires: new Date(maxAge),

test/03-http-test.js

@@ -5,2 +5,3 @@ var test = require('tape')
 var arc = require('../')
+var cookie = require('cookie')
 
@@ -148,3 +149,4 @@ test('env', t=> {
       console.log('response', response)
-      _idx = response.session._idx
+      _idx = cookie.parse(response.cookie)._idx
+      console.log(_idx)
     }
@@ -151,0 +153,0 @@ })

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

37856

increased by2.07%

Lines of code

844

increased by1.44%

Worsened metrics

Dependency count

8

increased by14.29%

Number of low supply chain risk alerts

19

increased by72.73%

Dependency changes

• + Addedcookie-signature@^1.0.6

• + Addedcookie-signature@1.2.2(transitive)