File size: 6,005 Bytes
a5d718a | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 | // src/utils/cookie.ts
import { decodeURIComponent_, tryDecode } from "./url.js";
var algorithm = { name: "HMAC", hash: "SHA-256" };
var getCryptoKey = async (secret) => {
const secretBuf = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
return await crypto.subtle.importKey("raw", secretBuf, algorithm, false, ["sign", "verify"]);
};
var makeSignature = async (value, secret) => {
const key = await getCryptoKey(secret);
const signature = await crypto.subtle.sign(algorithm.name, key, new TextEncoder().encode(value));
return btoa(String.fromCharCode(...new Uint8Array(signature)));
};
var verifySignature = async (base64Signature, value, secret) => {
try {
const signatureBinStr = atob(base64Signature);
const signature = new Uint8Array(signatureBinStr.length);
for (let i = 0, len = signatureBinStr.length; i < len; i++) {
signature[i] = signatureBinStr.charCodeAt(i);
}
return await crypto.subtle.verify(algorithm, secret, signature, new TextEncoder().encode(value));
} catch {
return false;
}
};
var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
var validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
var trimCookieWhitespace = (value) => {
let start = 0;
let end = value.length;
while (start < end) {
const charCode = value.charCodeAt(start);
if (charCode !== 32 && charCode !== 9) {
break;
}
start++;
}
while (end > start) {
const charCode = value.charCodeAt(end - 1);
if (charCode !== 32 && charCode !== 9) {
break;
}
end--;
}
return start === 0 && end === value.length ? value : value.slice(start, end);
};
var parse = (cookie, name) => {
if (name && cookie.indexOf(name) === -1) {
return {};
}
const pairs = cookie.split(";");
const parsedCookie = /* @__PURE__ */ Object.create(null);
for (const pairStr of pairs) {
const valueStartPos = pairStr.indexOf("=");
if (valueStartPos === -1) {
continue;
}
const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
if (name && name !== cookieName || !validCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
continue;
}
let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));
if (cookieValue.startsWith('"') && cookieValue.endsWith('"')) {
cookieValue = cookieValue.slice(1, -1);
}
if (validCookieValueRegEx.test(cookieValue)) {
parsedCookie[cookieName] = cookieValue.indexOf("%") !== -1 ? tryDecode(cookieValue, decodeURIComponent_) : cookieValue;
if (name) {
break;
}
}
}
return parsedCookie;
};
var parseSigned = async (cookie, secret, name) => {
const parsedCookie = /* @__PURE__ */ Object.create(null);
const secretKey = await getCryptoKey(secret);
for (const [key, value] of Object.entries(parse(cookie, name))) {
const signatureStartPos = value.lastIndexOf(".");
if (signatureStartPos < 1) {
continue;
}
const signedValue = value.substring(0, signatureStartPos);
const signature = value.substring(signatureStartPos + 1);
if (signature.length !== 44 || !signature.endsWith("=")) {
continue;
}
const isVerified = await verifySignature(signature, signedValue, secretKey);
parsedCookie[key] = isVerified ? signedValue : false;
}
return parsedCookie;
};
var _serialize = (name, value, opt = {}) => {
if (!validCookieNameRegEx.test(name)) {
throw new Error("Invalid cookie name");
}
let cookie = `${name}=${value}`;
if (name.startsWith("__Secure-") && !opt.secure) {
throw new Error("__Secure- Cookie must have Secure attributes");
}
if (name.startsWith("__Host-")) {
if (!opt.secure) {
throw new Error("__Host- Cookie must have Secure attributes");
}
if (opt.path !== "/") {
throw new Error('__Host- Cookie must have Path attributes with "/"');
}
if (opt.domain) {
throw new Error("__Host- Cookie must not have Domain attributes");
}
}
for (const key of ["domain", "path", "sameSite", "priority"]) {
if (opt[key] && /[;\r\n]/.test(opt[key])) {
throw new Error(`${key} must not contain ";", "\\r", or "\\n"`);
}
}
if (opt && typeof opt.maxAge === "number" && opt.maxAge >= 0) {
if (opt.maxAge > 3456e4) {
throw new Error(
"Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration."
);
}
cookie += `; Max-Age=${opt.maxAge | 0}`;
}
if (opt.domain && opt.prefix !== "host") {
cookie += `; Domain=${opt.domain}`;
}
if (opt.path) {
cookie += `; Path=${opt.path}`;
}
if (opt.expires) {
if (opt.expires.getTime() - Date.now() > 3456e7) {
throw new Error(
"Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future."
);
}
cookie += `; Expires=${opt.expires.toUTCString()}`;
}
if (opt.httpOnly) {
cookie += "; HttpOnly";
}
if (opt.secure) {
cookie += "; Secure";
}
if (opt.sameSite) {
cookie += `; SameSite=${opt.sameSite.charAt(0).toUpperCase() + opt.sameSite.slice(1)}`;
}
if (opt.priority) {
cookie += `; Priority=${opt.priority.charAt(0).toUpperCase() + opt.priority.slice(1)}`;
}
if (opt.partitioned) {
if (!opt.secure) {
throw new Error("Partitioned Cookie must have Secure attributes");
}
cookie += "; Partitioned";
}
return cookie;
};
var serialize = (name, value, opt) => {
value = encodeURIComponent(value);
return _serialize(name, value, opt);
};
var serializeSigned = async (name, value, secret, opt = {}) => {
const signature = await makeSignature(value, secret);
value = `${value}.${signature}`;
value = encodeURIComponent(value);
return _serialize(name, value, opt);
};
export {
parse,
parseSigned,
serialize,
serializeSigned
};
|