cookie-signature - npm Package Compare versions

Comparing version 1.0.6 to 1.1.0

index.js

@@ -40,13 +40,8 @@ /**
   var str = val.slice(0, val.lastIndexOf('.'))
-    , mac = exports.sign(str, secret);
-  
-  return sha1(mac) == sha1(val) ? str : false;
+    , mac = exports.sign(str, secret)
+    , macBuffer = Buffer.from(mac)
+    , valBuffer = Buffer.alloc(macBuffer.length);
+
+  valBuffer.write(val);
+  return crypto.timingSafeEqual(macBuffer, valBuffer) ? str : false;
 };
-
-/**
- * Private
- */
-
-function sha1(str){
-  return crypto.createHash('sha1').update(str).digest('hex');
-}

package.json

 {
   "name": "cookie-signature",
-  "version": "1.0.6",
+  "version": "1.1.0",
   "description": "Sign and unsign cookies",
@@ -8,4 +8,10 @@ "keywords": ["cookie", "sign", "unsign"],
   "license": "MIT",
-  "repository": { "type": "git", "url": "https://github.com/visionmedia/node-cookie-signature.git"},
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/visionmedia/node-cookie-signature.git"
+  },
   "dependencies": {},
+  "engines": {
+    "node": ">=6.6.0"
+  },
   "devDependencies": {
@@ -12,0 +18,0 @@ "mocha": "*",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

3983

increased by1.19%

Worsened metrics

Number of package files

4

decreased by-20%

Lines of code

40

decreased by-6.98%

No dependency changes