Skip to content

Commit 82fc12a

Browse files
jonchurchctcpip
andauthored
Ignore expires and maxAge in res.clearCookie() (#5792)
* add test for removing user provided expires * rework impl and tests to ignore maxAge, do not set it this is to take into account the built-in relative expires when passing a maxAge to res.cookie I realized that using maxAge to invalidate cookies inherrently hit this relativee expires behavior, and the goal of this PR is not to rework that relative expires behavior w/ maxAge, but to prevent users from overwriting these values by accident when clearing cookies * update history.md * explicitly delete maxAge instead of setting as undefined * drop the spread, use object.assign * wording, review comment on history.md Co-authored-by: Chris de Almeida <[email protected]> * ♻️ use spread, update supported ecmascript version --------- Co-authored-by: Chris de Almeida <[email protected]>
1 parent 160b91c commit 82fc12a

File tree

4 files changed

+33
-2
lines changed

4 files changed

+33
-2
lines changed

.eslintrc.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
root: true
22
env:
3-
es6: true
3+
es2022: true
44
node: true
55
rules:
66
eol-last: error

History.md

+2
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ unreleased
44
* `res.status()` accepts only integers, and input must be greater than 99 and less than 1000
55
* will throw a `RangeError: Invalid status code: ${code}. Status code must be greater than 99 and less than 1000.` for inputs outside this range
66
* will throw a `TypeError: Invalid status code: ${code}. Status code must be an integer.` for non integer inputs
7+
* change:
8+
- `res.clearCookie` will ignore user provided `maxAge` and `expires` options
79

810
5.0.0-beta.3 / 2024-03-25
911
=========================

lib/response.js

+4-1
Original file line numberDiff line numberDiff line change
@@ -707,7 +707,10 @@ res.get = function(field){
707707
*/
708708

709709
res.clearCookie = function clearCookie(name, options) {
710-
var opts = merge({ expires: new Date(1), path: '/' }, options);
710+
// Force cookie expiration by setting expires to the past
711+
const opts = { path: '/', ...options, expires: new Date(1)};
712+
// ensure maxAge is not passed
713+
delete opts.maxAge
711714

712715
return this.cookie(name, '', opts);
713716
};

test/res.clearCookie.js

+26
Original file line numberDiff line numberDiff line change
@@ -32,5 +32,31 @@ describe('res', function(){
3232
.expect('Set-Cookie', 'sid=; Path=/admin; Expires=Thu, 01 Jan 1970 00:00:00 GMT')
3333
.expect(200, done)
3434
})
35+
36+
it('should ignore maxAge', function(done){
37+
var app = express();
38+
39+
app.use(function(req, res){
40+
res.clearCookie('sid', { path: '/admin', maxAge: 1000 }).end();
41+
});
42+
43+
request(app)
44+
.get('/')
45+
.expect('Set-Cookie', 'sid=; Path=/admin; Expires=Thu, 01 Jan 1970 00:00:00 GMT')
46+
.expect(200, done)
47+
})
48+
49+
it('should ignore user supplied expires param', function(done){
50+
var app = express();
51+
52+
app.use(function(req, res){
53+
res.clearCookie('sid', { path: '/admin', expires: new Date() }).end();
54+
});
55+
56+
request(app)
57+
.get('/')
58+
.expect('Set-Cookie', 'sid=; Path=/admin; Expires=Thu, 01 Jan 1970 00:00:00 GMT')
59+
.expect(200, done)
60+
})
3561
})
3662
})

0 commit comments

Comments
 (0)