egg-cookies - npm Package Compare versions

Comparing version 2.3.0 to 2.3.1

History.md

 
+2.3.1 / 2019-12-17
+==================
+
+**fixes**
+  * [[`d4f443a`](http://github.com/eggjs/egg-cookies/commit/d4f443a5bf3bfd0ba7bc726b1e8b74a35ba265d6)] - fix: don't set samesite=none on incompatible clients (#23) (fengmk2 <<[e-mail]>>)
+
 2.3.0 / 2019-12-06
@@ -3,0 +9,0 @@ ==================

lib/cookies.js

@@ -5,2 +5,3 @@ 'use strict';
 const utility = require('utility');
+const isSameSiteNoneCompatible = require('should-send-same-site-none').isSameSiteNoneCompatible;
 const Keygrip = require('./keygrip');
@@ -113,2 +114,12 @@ const Cookie = require('./cookie');
 
+    // https://github.com/linsight/should-send-same-site-none
+    // fixed SameSite=None: Known Incompatible Clients
+    if (opts.sameSite && typeof opts.sameSite === 'string' && opts.sameSite.toLowerCase() === 'none') {
+      const userAgent = this.ctx.get('user-agent');
+      if (userAgent && !isSameSiteNoneCompatible(userAgent)) {
+        // Incompatible clients, don't send SameSite=None property
+        opts.sameSite = false;
+      }
+    }
+
     const cookie = new Cookie(name, value, opts);
@@ -115,0 +126,0 @@

lib/keygrip.js

@@ -68,3 +68,3 @@ 'use strict';
     for (let i = 0; i < keys.length; i++) {
-      if (constantTimeCompare(new Buffer(digest), new Buffer(this.sign(data, keys[i])))) {
+      if (constantTimeCompare(Buffer.from(digest), Buffer.from(this.sign(data, keys[i])))) {
         debug('data %s match key %s', data, keys[i]);
@@ -71,0 +71,0 @@ return i;

package.json

 {
   "name": "egg-cookies",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "cookies module for egg",
@@ -13,2 +13,3 @@ "files": [
     "scmp": "^2.0.0",
+    "should-send-same-site-none": "^2.0.2",
     "utility": "^1.14.0"
@@ -15,0 +16,0 @@ },

No alert changes

Improved metrics

Total package byte prevSize

21792

increased by4%

Lines of code

356

increased by2.89%

Worsened metrics

Dependency count

4

increased by33.33%

Dependency changes

• + Addedshould-send-same-site-none@^2.0.2

• + Addedshould-send-same-site-none@2.0.5(transitive)