From 31cf46529c6c5af3c1c45ec5971ebcc7e42a34f0 Mon Sep 17 00:00:00 2001 From: BaileyFirman Date: Thu, 21 Nov 2024 16:29:59 +1300 Subject: [PATCH 01/19] Refresh server.crt with existing key extending expiry to Nov 21 03:28:10 2024 GMT --- test/fixtures/server.crt | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt index c019198a..3f68e2f2 100644 --- a/test/fixtures/server.crt +++ b/test/fixtures/server.crt @@ -1,14 +1,15 @@ -----BEGIN CERTIFICATE----- -MIICMzCCAZwCCQCJTms0qcIZgDANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQGEwJV -UzEQMA4GA1UECBMHSW5kaWFuYTEdMBsGA1UEChMUbm9kZS1leHByZXNzLXNlc3Np -b24xHjAcBgNVBAMTFWV4cHJlc3Mtc2Vzc2lvbi5sb2NhbDAeFw0xNDExMjMwNTQ3 -MzlaFw0yNDExMjAwNTQ3MzlaMF4xCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdJbmRp -YW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mtc2Vzc2lvbjEeMBwGA1UEAxMVZXhw -cmVzcy1zZXNzaW9uLmxvY2FsMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDY -G398zqN6Yv/FAx77eoLLje4VNCYDXUciWBzceaZ5u/rtP/XshTQWDKFfUbb/kmni -DazsCasSoNsUCrcqQPJF1jF3F9XjsZxcggDab8MAbAMhnhJax2l3yPJsWnB/8mrY -cdsdQNPXJxQW9MMZgUxz73gIY5/rEeayU9owgcnVcQIDAQABMA0GCSqGSIb3DQEB -BQUAA4GBADi0XXsZlQAKxOyD4qvdJNWJXlfqhr1q53dZmfF7nikDaMDiMspczTS/ -pxNbq2UaMc7g+6qmXPaPQoN3laQQtMdyVfSh6EIJHbzXXzdcCT4fDBYX7iwvh0Gg -DUpjmxmCzFCaob9+hZzwbJi5MFQ4Qq12LW1aYHMs8wgLboHml1WL +MIICWzCCAcSgAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV +BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mt +c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI0MTEy +MTAzMjgxMFoXDTM0MTExOTAzMjgxMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT +B0luZGlhbmExHTAbBgNVBAoTFG5vZGUtZXhwcmVzcy1zZXNzaW9uMR4wHAYDVQQD +ExVleHByZXNzLXNlc3Npb24ubG9jYWwwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ +AoGBANgbf3zOo3pi/8UDHvt6gsuN7hU0JgNdRyJYHNx5pnm7+u0/9eyFNBYMoV9R +tv+SaeINrOwJqxKg2xQKtypA8kXWMXcX1eOxnFyCANpvwwBsAyGeElrHaXfI8mxa +cH/yathx2x1A09cnFBb0wxmBTHPveAhjn+sR5rJT2jCBydVxAgMBAAGjITAfMB0G +A1UdDgQWBBTqXycJwRboThk0uB3Cd3+oSLz1fjANBgkqhkiG9w0BAQsFAAOBgQCT +/E1rZGxemZZ5F8qX9SoTsc04ELEwT3PwA0cgU5fGmWmajPfjw339y53EQAb/H/sM +hugSreKMLVSAHRhMNGXb+dR0MzJiR4GbKRvYyHul4zjWen9uQrDHdgsqD4RnUcq8 +7HB+i49oFLN59qoI9MOoOKBfAKGKlXd+IL9+jyR/jA== -----END CERTIFICATE----- From 84ded7d03c8371baa2359db0e5c147ee1c00fb1e Mon Sep 17 00:00:00 2001 From: ctcpip Date: Wed, 22 Jan 2025 09:10:19 -0600 Subject: [PATCH 02/19] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F=20use=202048=20bit?= =?UTF-8?q?=20key?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cd test/fixtures openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048 openssl x509 -in server.crt -signkey new_server.key -days 3650 -out new_server.crt openssl x509 -in new_server.crt -text -noout mv new_server.crt server.crt mv new_server.key server.key --- test/fixtures/server.crt | 28 ++++++++++++++++---------- test/fixtures/server.key | 43 ++++++++++++++++++++++++++-------------- 2 files changed, 45 insertions(+), 26 deletions(-) diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt index 3f68e2f2..3bee94f1 100644 --- a/test/fixtures/server.crt +++ b/test/fixtures/server.crt @@ -1,15 +1,21 @@ -----BEGIN CERTIFICATE----- -MIICWzCCAcSgAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV +MIIDYDCCAkigAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mt -c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI0MTEy -MTAzMjgxMFoXDTM0MTExOTAzMjgxMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT +c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI1MDEy +MjE1MTMyMFoXDTM1MDEyMDE1MTMyMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT B0luZGlhbmExHTAbBgNVBAoTFG5vZGUtZXhwcmVzcy1zZXNzaW9uMR4wHAYDVQQD -ExVleHByZXNzLXNlc3Npb24ubG9jYWwwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ -AoGBANgbf3zOo3pi/8UDHvt6gsuN7hU0JgNdRyJYHNx5pnm7+u0/9eyFNBYMoV9R -tv+SaeINrOwJqxKg2xQKtypA8kXWMXcX1eOxnFyCANpvwwBsAyGeElrHaXfI8mxa -cH/yathx2x1A09cnFBb0wxmBTHPveAhjn+sR5rJT2jCBydVxAgMBAAGjITAfMB0G -A1UdDgQWBBTqXycJwRboThk0uB3Cd3+oSLz1fjANBgkqhkiG9w0BAQsFAAOBgQCT -/E1rZGxemZZ5F8qX9SoTsc04ELEwT3PwA0cgU5fGmWmajPfjw339y53EQAb/H/sM -hugSreKMLVSAHRhMNGXb+dR0MzJiR4GbKRvYyHul4zjWen9uQrDHdgsqD4RnUcq8 -7HB+i49oFLN59qoI9MOoOKBfAKGKlXd+IL9+jyR/jA== +ExVleHByZXNzLXNlc3Npb24ubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw +ggEKAoIBAQCy4w/9Wa85PGpdkzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF +8XIQMi5m7sGaYT3xUUItuksQF3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS +3HiJFLWvBRDndVpmvdyg7BZicqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c +0s0buXJmX9usc8g7CRiLfuqArAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ +3QcHpzVCZ1uYIKa8MY878PhaiVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM +/CtLXNCpHU23WhiIErBb3dvGxZZroCTtAgMBAAGjITAfMB0GA1UdDgQWBBSJqiKJ +f66iraVLqI3oZsgVeFA14jANBgkqhkiG9w0BAQsFAAOCAQEAP2VZidUCQptk4BiU +Fi390fR5wrgnqhBRmoE+iL5ok05ToLsg2DyvCefPyZgNp//NIRp6QUIHmPVXWHXx +fVDPLUC1CuOXy+o6TDWWjbtFW/PG5uPA6uhW4XpaBR5EGlptOBrGIRKIqneUwsMk +5fpDo7pbU4GSMToDDnhJxijrHIQFTs+PJLAGjCBQn/FRcDR1AJlxW/AyO0bIBSLE +fnZP+feQG6koDK8rgyT4t4z+hynAuf7y1ToFckNfTkdLdbXG5ceGu21qJCY/8uje +Nf01ik1p8gL5dZcW3qucTP5p45t3bnUDOjPFmrs87Ooeix9UjZG2hwW258FN86r6 +3PDrTw== -----END CERTIFICATE----- diff --git a/test/fixtures/server.key b/test/fixtures/server.key index dabf2b83..51b6a7b1 100644 --- a/test/fixtures/server.key +++ b/test/fixtures/server.key @@ -1,15 +1,28 @@ ------BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQDYG398zqN6Yv/FAx77eoLLje4VNCYDXUciWBzceaZ5u/rtP/Xs -hTQWDKFfUbb/kmniDazsCasSoNsUCrcqQPJF1jF3F9XjsZxcggDab8MAbAMhnhJa -x2l3yPJsWnB/8mrYcdsdQNPXJxQW9MMZgUxz73gIY5/rEeayU9owgcnVcQIDAQAB -AoGBALB8HGw/kPA1Ay3Qc6/qCADWYvW8BcM/nQUmMkO3sUW/R5gTYPIMglHzdKIU -aL9kwcXTZ0HIT4ZCCUffzF/cdD0lqCZjwGl0aM4xUZcPbaM/KmZOUcP92ymsN+rF -uuJXks6hxrmJ5hh5D6FXdlQjTCdG3u9w0+KD4n1BkBkEaqflAkEA9q4TBt1bLOvV -bbwz7bunI6bwS5eD7sVn1qUqrm6hcirhF1xCv75pO/uqAyccbguxjp8y2LNuN+cO -IgSwr+Jq1wJBAOBFuKSMAcg2WmJ4IAT7143yhoHKMgA8Nl4sfLFwFl2/hw+fdEBe -gndRfKHT4IV/YLcnS7d/H6mEMSAusWx5QPcCQQDTYaF+TWrW2JRAf3jEK/xyiZf6 -PrDYh6KOhWRIqxZ/fYz69p1gL6t/sg0ivH4ZMr4JKBRrK360OrOapQg+/7drAkB6 -3pfPRok/aE/SfN+F+3fX49Q/TUhhipt6ssLJ74/BYsobDBADqAOwXSt7+XmbifKx -xUydRn9RPwQvDoXT2QZ3AkAdnwR9PMEHAsaibrPyzBztKjPL2rWBRk1QAmcdrTpt -XL99XfmkERWtiBA/Lz2K332qYOa/zo5c/SADx9fm7+HP ------END RSA PRIVATE KEY----- +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCy4w/9Wa85PGpd +kzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF8XIQMi5m7sGaYT3xUUItuksQ +F3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS3HiJFLWvBRDndVpmvdyg7BZi +cqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c0s0buXJmX9usc8g7CRiLfuqA +rAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ3QcHpzVCZ1uYIKa8MY878Pha +iVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM/CtLXNCpHU23WhiIErBb3dvG +xZZroCTtAgMBAAECggEAA8BHqE4eYsKdz18EP6xfwMymn0FDghrKnvowiN/jSKIV +L/1rpCUrNTHSLL1EpFNq22AhIqOL0fYnV0vKpOHVlZmUVDEAwUSyS0U8LMF7wtPg +0WIbrkxOV4R4gZVd1vDyAQyArAlcrEIvGPri3gFwQh1JWsAI2cxhCObZAn1IzhRW +sMecAmtNzzYWeXentSfkfWr0niKDbSAAuYzgVIEWbIfE+kgqBckrWnyM9IgSdy1g +0b3NRRD/gvykszX7j9fzXGj8RAcCTbN1miaFcHRg3moa1Pu50KjokINsr5xxYqTk +ltPYU35gMYzNPvu5clvj067j6ikCFMiE4XOXf58qwQKBgQDpQJ2l6b1LrvGAV4Q6 +qieTYPTnGhnm/rSn7jK+AUIF+UmK3mtASuc14keelXeiI42MzvO1P6LLwkFIzVx0 +2X/BrTDZUvU5P5nsgBkoyiC71bkbCzoiSxIQtRurenmkD7EqM+4zBYMvCvrPFmOr +twuWk+4XLA+nl5Vl+FUgjehCQQKBgQDEVShtn68Pkq22GXR5kzgFu+GaXuVPJKu8 +z45K4mbG+WrnwuMmnIRbMfN9oGF5JXWAe5AtFqlQEcUQLElllRkdUe76WX15M2Jm +UeqFFARWjToNs7NXmxjsQZFOe0TyfAsdaX++lUhEpeCcv2MnEoNQS9n8yTwhuJM4 +8Zr9KUWfrQKBgQCFkNK1ZxtWc18nNvYpAbaX1jVnALNEayXX47Z6xw2fjhhmxOZ1 +cm7jlCeez8gpuGId94PmjgIS27G2lqIS51kY9qu6Rp7VoW3q14+Qo+4KoV/V9J/d +c09s8checUumfrXcjNAht05fadIlM5Tvh2nDWAJGkpyEQ3DxazqT4a7WAQKBgFok +Zz191Zim1c8H/Oxc5ZnsW3bPHyWpRpiYC1LihCHTHnxuhHCT6EketBb37gj7Y+mr +0dSB1RcIMZxtWP2k6TUHC1wyfmOJbiJgdfbH6/35NbBY03zjnxvKNvb7rfpPbaMB +bz+Htvid2HTfgpzL6TKSwPFJS6yH3ECG3YxiyK65AoGAHIYaLIP53pszdd1ruCO6 +0rI6/He6hKwG8SmtbXKCKYSAeNwZJkUI+B0xD8ZTq5h3geJD7CEoVPPsv9xauliG +fspe/KyTX5DqTBx9xNVYj9C2MSozQNs8ObCsUOMKzRaJtHl64US1VzweWA7Whkwf +1r8MiT2ty4eCk7V3qW1W88A= +-----END PRIVATE KEY----- From ffda85bb0bb7b6de14699ea35f33ad2d07930f85 Mon Sep 17 00:00:00 2001 From: Wes Todd Date: Wed, 22 Jan 2025 17:06:47 -0600 Subject: [PATCH 03/19] feat: gencert script to regenerate the test ssl certs --- package.json | 3 ++- test/support/gencert.sh | 12 ++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) create mode 100755 test/support/gencert.sh diff --git a/package.json b/package.json index e3322438..87b31098 100644 --- a/package.json +++ b/package.json @@ -42,6 +42,7 @@ "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/", "test-ci": "nyc --reporter=lcov --reporter=text npm test", "test-cov": "nyc npm test", - "version": "node scripts/version-history.js && git add HISTORY.md" + "version": "node scripts/version-history.js && git add HISTORY.md", + "gencert": "./test/support/gencert.sh" } } diff --git a/test/support/gencert.sh b/test/support/gencert.sh new file mode 100755 index 00000000..114bf70f --- /dev/null +++ b/test/support/gencert.sh @@ -0,0 +1,12 @@ +#! /bin/sh +set -ex + +openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048 + +openssl x509 -in ./test/fixtures/server.crt -signkey new_server.key -days 3650 -out new_server.crt + +openssl x509 -in new_server.crt -text -noout + +mv new_server.crt ./test/fixtures/server.crt + +mv new_server.key ./test/fixtures/server.key From 17e770d2f0081308326642b821429b1371d276f2 Mon Sep 17 00:00:00 2001 From: ctcpip Date: Thu, 23 Jan 2025 11:01:24 -0600 Subject: [PATCH 04/19] =?UTF-8?q?=E2=9C=85=20always=20generate=20fresh=20c?= =?UTF-8?q?ert?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitignore | 2 ++ package.json | 5 ++--- test/fixtures/.gitkeep | 0 test/fixtures/server.crt | 21 --------------------- test/fixtures/server.key | 28 ---------------------------- test/support/gencert.sh | 11 ++--------- 6 files changed, 6 insertions(+), 61 deletions(-) create mode 100644 test/fixtures/.gitkeep delete mode 100644 test/fixtures/server.crt delete mode 100644 test/fixtures/server.key diff --git a/.gitignore b/.gitignore index 207febba..1b6fef23 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,5 @@ coverage node_modules npm-debug.log package-lock.json +/test/fixtures/server.crt +/test/fixtures/server.key diff --git a/package.json b/package.json index 87b31098..79cb1b4c 100644 --- a/package.json +++ b/package.json @@ -39,10 +39,9 @@ }, "scripts": { "lint": "eslint . && node ./scripts/lint-readme.js", - "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/", + "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/", "test-ci": "nyc --reporter=lcov --reporter=text npm test", "test-cov": "nyc npm test", - "version": "node scripts/version-history.js && git add HISTORY.md", - "gencert": "./test/support/gencert.sh" + "version": "node scripts/version-history.js && git add HISTORY.md" } } diff --git a/test/fixtures/.gitkeep b/test/fixtures/.gitkeep new file mode 100644 index 00000000..e69de29b diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt deleted file mode 100644 index 3bee94f1..00000000 --- a/test/fixtures/server.crt +++ /dev/null @@ -1,21 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDYDCCAkigAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV -BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mt -c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI1MDEy -MjE1MTMyMFoXDTM1MDEyMDE1MTMyMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT -B0luZGlhbmExHTAbBgNVBAoTFG5vZGUtZXhwcmVzcy1zZXNzaW9uMR4wHAYDVQQD -ExVleHByZXNzLXNlc3Npb24ubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw -ggEKAoIBAQCy4w/9Wa85PGpdkzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF -8XIQMi5m7sGaYT3xUUItuksQF3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS -3HiJFLWvBRDndVpmvdyg7BZicqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c -0s0buXJmX9usc8g7CRiLfuqArAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ -3QcHpzVCZ1uYIKa8MY878PhaiVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM -/CtLXNCpHU23WhiIErBb3dvGxZZroCTtAgMBAAGjITAfMB0GA1UdDgQWBBSJqiKJ -f66iraVLqI3oZsgVeFA14jANBgkqhkiG9w0BAQsFAAOCAQEAP2VZidUCQptk4BiU -Fi390fR5wrgnqhBRmoE+iL5ok05ToLsg2DyvCefPyZgNp//NIRp6QUIHmPVXWHXx -fVDPLUC1CuOXy+o6TDWWjbtFW/PG5uPA6uhW4XpaBR5EGlptOBrGIRKIqneUwsMk -5fpDo7pbU4GSMToDDnhJxijrHIQFTs+PJLAGjCBQn/FRcDR1AJlxW/AyO0bIBSLE -fnZP+feQG6koDK8rgyT4t4z+hynAuf7y1ToFckNfTkdLdbXG5ceGu21qJCY/8uje -Nf01ik1p8gL5dZcW3qucTP5p45t3bnUDOjPFmrs87Ooeix9UjZG2hwW258FN86r6 -3PDrTw== ------END CERTIFICATE----- diff --git a/test/fixtures/server.key b/test/fixtures/server.key deleted file mode 100644 index 51b6a7b1..00000000 --- a/test/fixtures/server.key +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCy4w/9Wa85PGpd -kzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF8XIQMi5m7sGaYT3xUUItuksQ -F3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS3HiJFLWvBRDndVpmvdyg7BZi -cqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c0s0buXJmX9usc8g7CRiLfuqA -rAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ3QcHpzVCZ1uYIKa8MY878Pha -iVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM/CtLXNCpHU23WhiIErBb3dvG -xZZroCTtAgMBAAECggEAA8BHqE4eYsKdz18EP6xfwMymn0FDghrKnvowiN/jSKIV -L/1rpCUrNTHSLL1EpFNq22AhIqOL0fYnV0vKpOHVlZmUVDEAwUSyS0U8LMF7wtPg -0WIbrkxOV4R4gZVd1vDyAQyArAlcrEIvGPri3gFwQh1JWsAI2cxhCObZAn1IzhRW -sMecAmtNzzYWeXentSfkfWr0niKDbSAAuYzgVIEWbIfE+kgqBckrWnyM9IgSdy1g -0b3NRRD/gvykszX7j9fzXGj8RAcCTbN1miaFcHRg3moa1Pu50KjokINsr5xxYqTk -ltPYU35gMYzNPvu5clvj067j6ikCFMiE4XOXf58qwQKBgQDpQJ2l6b1LrvGAV4Q6 -qieTYPTnGhnm/rSn7jK+AUIF+UmK3mtASuc14keelXeiI42MzvO1P6LLwkFIzVx0 -2X/BrTDZUvU5P5nsgBkoyiC71bkbCzoiSxIQtRurenmkD7EqM+4zBYMvCvrPFmOr -twuWk+4XLA+nl5Vl+FUgjehCQQKBgQDEVShtn68Pkq22GXR5kzgFu+GaXuVPJKu8 -z45K4mbG+WrnwuMmnIRbMfN9oGF5JXWAe5AtFqlQEcUQLElllRkdUe76WX15M2Jm -UeqFFARWjToNs7NXmxjsQZFOe0TyfAsdaX++lUhEpeCcv2MnEoNQS9n8yTwhuJM4 -8Zr9KUWfrQKBgQCFkNK1ZxtWc18nNvYpAbaX1jVnALNEayXX47Z6xw2fjhhmxOZ1 -cm7jlCeez8gpuGId94PmjgIS27G2lqIS51kY9qu6Rp7VoW3q14+Qo+4KoV/V9J/d -c09s8checUumfrXcjNAht05fadIlM5Tvh2nDWAJGkpyEQ3DxazqT4a7WAQKBgFok -Zz191Zim1c8H/Oxc5ZnsW3bPHyWpRpiYC1LihCHTHnxuhHCT6EketBb37gj7Y+mr -0dSB1RcIMZxtWP2k6TUHC1wyfmOJbiJgdfbH6/35NbBY03zjnxvKNvb7rfpPbaMB -bz+Htvid2HTfgpzL6TKSwPFJS6yH3ECG3YxiyK65AoGAHIYaLIP53pszdd1ruCO6 -0rI6/He6hKwG8SmtbXKCKYSAeNwZJkUI+B0xD8ZTq5h3geJD7CEoVPPsv9xauliG -fspe/KyTX5DqTBx9xNVYj9C2MSozQNs8ObCsUOMKzRaJtHl64US1VzweWA7Whkwf -1r8MiT2ty4eCk7V3qW1W88A= ------END PRIVATE KEY----- diff --git a/test/support/gencert.sh b/test/support/gencert.sh index 114bf70f..cfdda070 100755 --- a/test/support/gencert.sh +++ b/test/support/gencert.sh @@ -1,12 +1,5 @@ #! /bin/sh set -ex -openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048 - -openssl x509 -in ./test/fixtures/server.crt -signkey new_server.key -days 3650 -out new_server.crt - -openssl x509 -in new_server.crt -text -noout - -mv new_server.crt ./test/fixtures/server.crt - -mv new_server.key ./test/fixtures/server.key +openssl req -x509 -nodes -newkey rsa:2048 -keyout ./test/fixtures/server.key -out ./test/fixtures/server.crt -days 3650 \ +-subj "/C=US/ST=Illinois/L=Chicago/O=node-express-session/CN=express-session.local" From 3e848255952a74b8f5223343aea08b5e23ec5dc8 Mon Sep 17 00:00:00 2001 From: ctcpip Date: Thu, 23 Jan 2025 11:04:34 -0600 Subject: [PATCH 05/19] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20bump=20actions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 38dc4da7..ff3bce76 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -185,7 +185,7 @@ jobs: run: | if npm -ps ls nyc | grep -q nyc; then npm run test-ci - cp coverage/lcov.info "coverage/${{ matrix.name }}.lcov" + cp coverage/lcov.info "coverage/${{ matrix.node-version }}.lcov" else npm test fi @@ -198,17 +198,17 @@ jobs: if: steps.list_env.outputs.nyc != '' run: | if [[ -d ./coverage ]]; then - mv ./coverage "./${{ matrix.name }}" + mv ./coverage "./${{ matrix.node-version }}" mkdir ./coverage - mv "./${{ matrix.name }}" "./coverage/${{ matrix.name }}" + mv "./${{ matrix.node-version }}" "./coverage/${{ matrix.node-version }}" fi - name: Upload code coverage - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 if: steps.list_env.outputs.nyc != '' with: - name: coverage - path: ./coverage + name: coverage-${{ matrix.node-version }} + path: "./coverage/${{ matrix.node-version }}" retention-days: 1 coverage: @@ -222,9 +222,8 @@ jobs: run: sudo apt-get -y install lcov - name: Collect coverage reports - uses: actions/download-artifact@v3 + uses: actions/download-artifact@v4 with: - name: coverage path: ./coverage - name: Merge coverage reports From d3ab22cfeebafb0bd1b53ebcc6b18163dedecc4c Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sun, 16 Mar 2025 13:49:38 -0500 Subject: [PATCH 06/19] chore: drop nodejs < 18 (#1020) Co-authored-by: Phillip Barta --- .github/workflows/ci.yml | 311 +++++++++++---------------------------- .npmrc | 1 + package.json | 4 +- 3 files changed, 93 insertions(+), 223 deletions(-) create mode 100644 .npmrc diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ff3bce76..0dfdd660 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,236 +1,105 @@ name: ci on: -- pull_request -- push + push: + branches: + - 'v2' + paths-ignore: + - '*.md' + pull_request: + branches: + - 'v2' + paths-ignore: + - '*.md' + +permissions: + contents: read + +# Cancel in progress workflows +# in the scenario where we already had a run going for that PR/branch/tag but then triggered a new run +concurrency: + group: "${{ github.workflow }} ✨ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}" + cancel-in-progress: true jobs: + lint: + name: Lint + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: 'lts/*' + + - name: Install dependencies + run: npm install --ignore-scripts --include=dev + + - name: Run lint + run: npm run lint + test: runs-on: ubuntu-latest strategy: + fail-fast: false matrix: - name: - - Node.js 0.8 - - Node.js 0.10 - - Node.js 0.12 - - io.js 1.x - - io.js 2.x - - io.js 3.x - - Node.js 4.x - - Node.js 5.x - - Node.js 6.x - - Node.js 7.x - - Node.js 8.x - - Node.js 9.x - - Node.js 10.x - - Node.js 11.x - - Node.js 12.x - - Node.js 13.x - - Node.js 14.x - - Node.js 15.x - - Node.js 16.x - - Node.js 17.x - - Node.js 18.x - - Node.js 19.x - - Node.js 20.x - - Node.js 21.x - - include: - - name: Node.js 0.8 - node-version: "0.8" - npm-i: mocha@2.5.3 supertest@1.1.0 - npm-rm: nyc - - - name: Node.js 0.10 - node-version: "0.10" - npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0 - - - name: Node.js 0.12 - node-version: "0.12" - npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0 - - - name: io.js 1.x - node-version: "1.8" - npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0 - - - name: io.js 2.x - node-version: "2.5" - npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0 - - - name: io.js 3.x - node-version: "3.3" - npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0 - - - name: Node.js 4.x - node-version: "4.9" - npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2 - - - name: Node.js 5.x - node-version: "5.12" - npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2 - - - name: Node.js 6.x - node-version: "6.17" - npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6 - - - name: Node.js 7.x - node-version: "7.10" - npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6 - - - name: Node.js 8.x - node-version: "8.17" - npm-i: mocha@7.2.0 nyc@14.1.1 - - - name: Node.js 9.x - node-version: "9.11" - npm-i: mocha@7.2.0 nyc@14.1.1 - - - name: Node.js 10.x - node-version: "10.24" - npm-i: mocha@8.4.0 - - - name: Node.js 11.x - node-version: "11.15" - npm-i: mocha@8.4.0 - - - name: Node.js 12.x - node-version: "12.22" - npm-i: mocha@9.2.2 - - - name: Node.js 13.x - node-version: "13.14" - npm-i: mocha@9.2.2 - - - name: Node.js 14.x - node-version: "14.21" - - - name: Node.js 15.x - node-version: "15.14" - - - name: Node.js 16.x - node-version: "16.20" - - - name: Node.js 17.x - node-version: "17.9" - - - name: Node.js 18.x - node-version: "18.19" - - - name: Node.js 19.x - node-version: "19.9" - - - name: Node.js 20.x - node-version: "20.11" - - - name: Node.js 21.x - node-version: "21.6" - + node-version: [18, 19, 20, 21, 22, 23] + # Node.js release schedule: https://nodejs.org/en/about/releases/ + name: Test - Node.js ${{ matrix.node-version }} steps: - - uses: actions/checkout@v4 - - - name: Install Node.js ${{ matrix.node-version }} - shell: bash -eo pipefail -l {0} - run: | - nvm install --default ${{ matrix.node-version }} - if [[ "${{ matrix.node-version }}" == 0.* && "$(cut -d. -f2 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then - nvm install --alias=npm 0.10 - nvm use ${{ matrix.node-version }} - sed -i '1s;^.*$;'"$(printf '#!%q' "$(nvm which npm)")"';' "$(readlink -f "$(which npm)")" - npm config set strict-ssl false - fi - dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH" - - - name: Configure npm - run: | - if [[ "$(npm config get package-lock)" == "true" ]]; then - npm config set package-lock false - else - npm config set shrinkwrap false - fi - - - name: Remove npm module(s) ${{ matrix.npm-rm }} - run: npm rm --silent --save-dev ${{ matrix.npm-rm }} - if: matrix.npm-rm != '' - - - name: Install npm module(s) ${{ matrix.npm-i }} - run: npm install --save-dev ${{ matrix.npm-i }} - if: matrix.npm-i != '' - - - name: Setup Node.js version-specific dependencies - shell: bash - run: | - # eslint for linting - # - remove on Node.js < 12 - if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 12 ]]; then - node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \ - grep -E '^eslint(-|$)' | \ - sort -r | \ - xargs -n1 npm rm --silent --save-dev - fi - - - name: Install Node.js dependencies - run: npm install - - - name: List environment - id: list_env - shell: bash - run: | - echo "node@$(node -v)" - echo "npm@$(npm -v)" - npm -s ls ||: - (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print $2 "=" $3 }' >> "$GITHUB_OUTPUT" - - - name: Run tests - shell: bash - run: | - if npm -ps ls nyc | grep -q nyc; then - npm run test-ci - cp coverage/lcov.info "coverage/${{ matrix.node-version }}.lcov" - else - npm test - fi - - - name: Lint code - if: steps.list_env.outputs.eslint != '' - run: npm run lint - - - name: Collect code coverage - if: steps.list_env.outputs.nyc != '' - run: | - if [[ -d ./coverage ]]; then - mv ./coverage "./${{ matrix.node-version }}" - mkdir ./coverage - mv "./${{ matrix.node-version }}" "./coverage/${{ matrix.node-version }}" - fi - - - name: Upload code coverage - uses: actions/upload-artifact@v4 - if: steps.list_env.outputs.nyc != '' - with: - name: coverage-${{ matrix.node-version }} - path: "./coverage/${{ matrix.node-version }}" - retention-days: 1 + - uses: actions/checkout@v4 + with: + persist-credentials: false - coverage: - needs: test - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 + - name: Setup Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v4 + with: + node-version: ${{ matrix.node-version }} + + - name: Configure npm loglevel + run: | + npm config set loglevel error + shell: bash + + - name: Install dependencies + run: npm install - - name: Install lcov - shell: bash - run: sudo apt-get -y install lcov - - name: Collect coverage reports - uses: actions/download-artifact@v4 - with: - path: ./coverage + - name: Run tests + shell: bash + run: npm run test-ci - - name: Merge coverage reports - shell: bash - run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info + - name: Upload code coverage + uses: actions/upload-artifact@v4 + with: + name: coverage-node-${{ matrix.node-version }} + path: ./coverage/lcov.info + retention-days: 1 - - name: Upload coverage report - uses: coverallsapp/github-action@master - with: - github-token: ${{ secrets.GITHUB_TOKEN }} + coverage: + needs: test + runs-on: ubuntu-latest + permissions: + contents: read + checks: write + steps: + - uses: actions/checkout@v4 + + - name: Install lcov + shell: bash + run: sudo apt-get -y install lcov + + - name: Collect coverage reports + uses: actions/download-artifact@v4 + with: + path: ./coverage + pattern: coverage-node-* + + - name: Merge coverage reports + shell: bash + run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./lcov.info + + - name: Upload coverage report + uses: coverallsapp/github-action@v2 + with: + file: ./lcov.info \ No newline at end of file diff --git a/.npmrc b/.npmrc new file mode 100644 index 00000000..9cf94950 --- /dev/null +++ b/.npmrc @@ -0,0 +1 @@ +package-lock=false \ No newline at end of file diff --git a/package.json b/package.json index 79cb1b4c..1499a0a0 100644 --- a/package.json +++ b/package.json @@ -35,11 +35,11 @@ "index.js" ], "engines": { - "node": ">= 0.8.0" + "node": ">=18" }, "scripts": { "lint": "eslint . && node ./scripts/lint-readme.js", - "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/", + "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --no-exit --reporter spec test/", "test-ci": "nyc --reporter=lcov --reporter=text npm test", "test-cov": "nyc npm test", "version": "node scripts/version-history.js && git add HISTORY.md" From 95f1edddcc96bc982cf93aa0ea357b2566ae87a6 Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sun, 16 Mar 2025 13:53:43 -0500 Subject: [PATCH 07/19] refactor: remove safe-buffer dependency (#1023) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Ulises Gascón --- index.js | 1 - package.json | 1 - 2 files changed, 2 deletions(-) diff --git a/index.js b/index.js index d41b2378..3e2d5805 100644 --- a/index.js +++ b/index.js @@ -13,7 +13,6 @@ * @private */ -var Buffer = require('safe-buffer').Buffer var cookie = require('cookie'); var crypto = require('crypto') var debug = require('debug')('express-session'); diff --git a/package.json b/package.json index 1499a0a0..0a8b9421 100644 --- a/package.json +++ b/package.json @@ -16,7 +16,6 @@ "depd": "~2.0.0", "on-headers": "~1.0.2", "parseurl": "~1.3.3", - "safe-buffer": "5.2.1", "uid-safe": "~2.1.5" }, "devDependencies": { From ee6a194b18f392f6a9e96144f4a41cd563be3747 Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Mon, 17 Mar 2025 14:04:04 -0500 Subject: [PATCH 08/19] refactor: replace custom defer function with setImmediate (#1021) --- index.js | 18 ++++-------------- session/memory.js | 22 ++++++---------------- test/support/smart-store.js | 11 +++-------- 3 files changed, 13 insertions(+), 38 deletions(-) diff --git a/index.js b/index.js index 3e2d5805..ebd4afb9 100644 --- a/index.js +++ b/index.js @@ -55,16 +55,6 @@ var warning = 'Warning: connect.session() MemoryStore is not\n' + 'designed for a production environment, as it will leak\n' + 'memory, and will not scale past a single process.'; -/** - * Node.js 0.8+ async implementation. - * @private - */ - -/* istanbul ignore next */ -var defer = typeof setImmediate === 'function' - ? setImmediate - : function(fn){ process.nextTick(fn.bind.apply(fn, arguments)) } - /** * Setup session store with the given `options`. * @@ -246,7 +236,7 @@ function session(options) { try { setcookie(res, name, req.sessionID, secrets[0], req.session.cookie.data) } catch (err) { - defer(next, err) + setImmediate(next, err) } }); @@ -316,7 +306,7 @@ function session(options) { debug('destroying'); store.destroy(req.sessionID, function ondestroy(err) { if (err) { - defer(next, err); + setImmediate(next, err); } debug('destroyed'); @@ -341,7 +331,7 @@ function session(options) { if (shouldSave(req)) { req.session.save(function onsave(err) { if (err) { - defer(next, err); + setImmediate(next, err); } writeend(); @@ -353,7 +343,7 @@ function session(options) { debug('touching'); store.touch(req.sessionID, req.session, function ontouch(err) { if (err) { - defer(next, err); + setImmediate(next, err); } debug('touched'); diff --git a/session/memory.js b/session/memory.js index 11ed686c..2008939a 100644 --- a/session/memory.js +++ b/session/memory.js @@ -16,16 +16,6 @@ var Store = require('./store') var util = require('util') -/** - * Shim setImmediate for node.js < 0.10 - * @private - */ - -/* istanbul ignore next */ -var defer = typeof setImmediate === 'function' - ? setImmediate - : function(fn){ process.nextTick(fn.bind.apply(fn, arguments)) } - /** * Module exports. */ @@ -68,7 +58,7 @@ MemoryStore.prototype.all = function all(callback) { } } - callback && defer(callback, null, sessions) + callback && setImmediate(callback, null, sessions) } /** @@ -80,7 +70,7 @@ MemoryStore.prototype.all = function all(callback) { MemoryStore.prototype.clear = function clear(callback) { this.sessions = Object.create(null) - callback && defer(callback) + callback && setImmediate(callback) } /** @@ -92,7 +82,7 @@ MemoryStore.prototype.clear = function clear(callback) { MemoryStore.prototype.destroy = function destroy(sessionId, callback) { delete this.sessions[sessionId] - callback && defer(callback) + callback && setImmediate(callback) } /** @@ -104,7 +94,7 @@ MemoryStore.prototype.destroy = function destroy(sessionId, callback) { */ MemoryStore.prototype.get = function get(sessionId, callback) { - defer(callback, null, getSession.call(this, sessionId)) + setImmediate(callback, null, getSession.call(this, sessionId)) } /** @@ -118,7 +108,7 @@ MemoryStore.prototype.get = function get(sessionId, callback) { MemoryStore.prototype.set = function set(sessionId, session, callback) { this.sessions[sessionId] = JSON.stringify(session) - callback && defer(callback) + callback && setImmediate(callback) } /** @@ -153,7 +143,7 @@ MemoryStore.prototype.touch = function touch(sessionId, session, callback) { this.sessions[sessionId] = JSON.stringify(currentSession) } - callback && defer(callback) + callback && setImmediate(callback) } /** diff --git a/test/support/smart-store.js b/test/support/smart-store.js index 8b224fdd..5e1bfb2f 100644 --- a/test/support/smart-store.js +++ b/test/support/smart-store.js @@ -3,11 +3,6 @@ var session = require('../../') var util = require('util') -/* istanbul ignore next */ -var defer = typeof setImmediate === 'function' - ? setImmediate - : function(fn){ process.nextTick(fn.bind.apply(fn, arguments)) } - module.exports = SmartStore function SmartStore () { @@ -19,7 +14,7 @@ util.inherits(SmartStore, session.Store) SmartStore.prototype.destroy = function destroy (sid, callback) { delete this.sessions[sid] - defer(callback, null) + setImmediate(callback, null) } SmartStore.prototype.get = function get (sid, callback) { @@ -45,10 +40,10 @@ SmartStore.prototype.get = function get (sid, callback) { } } - defer(callback, null, sess) + setImmediate(callback, null, sess) } SmartStore.prototype.set = function set (sid, sess, callback) { this.sessions[sid] = JSON.stringify(sess) - defer(callback, null) + setImmediate(callback, null) } From 8e1876287c099925ed878647ea5de7ffdc840c9b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaakko=20Kantoj=C3=A4rvi?= <2327687+raphendyr@users.noreply.github.com> Date: Tue, 18 Mar 2025 18:23:52 +0200 Subject: [PATCH 09/19] lint: upgrade linting environment to ECMAScript 2022 (#1030) --- .eslintrc.yml | 4 ++++ README.md | 5 ++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/.eslintrc.yml b/.eslintrc.yml index b6b9f62f..b0414210 100644 --- a/.eslintrc.yml +++ b/.eslintrc.yml @@ -6,10 +6,14 @@ plugins: overrides: - files: '**/*.md' processor: 'markdown/markdown' +env: + es2022: true + node: true rules: eol-last: error eqeqeq: ["error", "always", { "null": "ignore" }] indent: ["error", 2, { "MemberExpression": "off", "SwitchCase": 1 }] no-mixed-spaces-and-tabs: error no-trailing-spaces: error + no-unused-vars: [error, { vars: all, args: none, ignoreRestSiblings: true }] one-var: ["error", { "initialized": "never" }] diff --git a/README.md b/README.md index 65a37e63..e07f86a4 100644 --- a/README.md +++ b/README.md @@ -18,7 +18,10 @@ $ npm install express-session ## API ```js -var session = require('express-session') +const session = require('express-session') + +const app = express() +app.use(session(/* options */)) ``` ### session(options) From d0acdcfb88b08a1956d5350d3b40756e387b561a Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sat, 26 Apr 2025 21:53:44 -0500 Subject: [PATCH 10/19] feat: removing http internals (#1022) --- index.js | 4 ++-- test/session.js | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/index.js b/index.js index ebd4afb9..d71026a8 100644 --- a/index.js +++ b/index.js @@ -269,8 +269,8 @@ function session(options) { return ret; } - if (!res._header) { - res._implicitHeader() + if (!res.headersSent) { + res.writeHead(res.statusCode); } if (chunk == null) { diff --git a/test/session.js b/test/session.js index 7bf3e51f..d2d477e1 100644 --- a/test/session.js +++ b/test/session.js @@ -2430,7 +2430,7 @@ function createRequestListener(opts, fn) { var server = this _session(req, res, function (err) { - if (err && !res._header) { + if (err && !res.headersSent) { res.statusCode = err.status || 500 res.end(err.message) return From 76bc233d8136e7ebb086c0fc0f7cae403e7e715b Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sat, 26 Apr 2025 22:01:40 -0500 Subject: [PATCH 11/19] feat: remove read signedCookies and cookies (#1026) --- index.js | 31 ----------------------------- test/session.js | 53 ++++--------------------------------------------- 2 files changed, 4 insertions(+), 80 deletions(-) diff --git a/index.js b/index.js index d71026a8..5adfae1b 100644 --- a/index.js +++ b/index.js @@ -548,37 +548,6 @@ function getcookie(req, name, secrets) { } } - // back-compat read from cookieParser() signedCookies data - if (!val && req.signedCookies) { - val = req.signedCookies[name]; - - if (val) { - deprecate('cookie should be available in req.headers.cookie'); - } - } - - // back-compat read from cookieParser() cookies data - if (!val && req.cookies) { - raw = req.cookies[name]; - - if (raw) { - if (raw.substr(0, 2) === 's:') { - val = unsigncookie(raw.slice(2), secrets); - - if (val) { - deprecate('cookie should be available in req.headers.cookie'); - } - - if (val === false) { - debug('cookie signature invalid'); - val = undefined; - } - } else { - debug('cookie unsigned') - } - } - } - return val; } diff --git a/test/session.js b/test/session.js index d2d477e1..aec89206 100644 --- a/test/session.js +++ b/test/session.js @@ -2310,10 +2310,10 @@ describe('session()', function(){ }) describe('cookieParser()', function () { - it('should read from req.cookies', function(done){ + it('shouldn\'t read from req.cookies', function(done){ var app = express() .use(cookieParser()) - .use(function(req, res, next){ req.headers.cookie = 'foo=bar'; next() }) + .use(function(req, res, next){ delete req.headers.cookie; next() }) .use(createSession()) .use(function(req, res, next){ req.session.count = req.session.count || 0 @@ -2328,56 +2328,11 @@ describe('session()', function(){ request(app) .get('/') .set('Cookie', cookie(res)) - .expect(200, '2', done) - }) - }) - - it('should reject unsigned from req.cookies', function(done){ - var app = express() - .use(cookieParser()) - .use(function(req, res, next){ req.headers.cookie = 'foo=bar'; next() }) - .use(createSession({ key: 'sessid' })) - .use(function(req, res, next){ - req.session.count = req.session.count || 0 - req.session.count++ - res.end(req.session.count.toString()) - }) - - request(app) - .get('/') - .expect(200, '1', function (err, res) { - if (err) return done(err) - request(app) - .get('/') - .set('Cookie', 'sessid=' + sid(res)) .expect(200, '1', done) }) }) - it('should reject invalid signature from req.cookies', function(done){ - var app = express() - .use(cookieParser()) - .use(function(req, res, next){ req.headers.cookie = 'foo=bar'; next() }) - .use(createSession({ key: 'sessid' })) - .use(function(req, res, next){ - req.session.count = req.session.count || 0 - req.session.count++ - res.end(req.session.count.toString()) - }) - - request(app) - .get('/') - .expect(200, '1', function (err, res) { - if (err) return done(err) - var val = cookie(res).replace(/...\./, '.') - request(app) - .get('/') - .set('Cookie', val) - .expect(200, '1', done) - }) - }) - - it('should read from req.signedCookies', function(done){ + it('shouldn\'t read from req.signedCookies', function(done){ var app = express() .use(cookieParser('keyboard cat')) .use(function(req, res, next){ delete req.headers.cookie; next() }) @@ -2395,7 +2350,7 @@ describe('session()', function(){ request(app) .get('/') .set('Cookie', cookie(res)) - .expect(200, '2', done) + .expect(200, '1', done) }) }) }) From f5b5ebbb7a8c911495789f2fa3d25b0d96d27117 Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sat, 26 Apr 2025 22:02:48 -0500 Subject: [PATCH 12/19] feat: enforce secret requirement for session creation (#1025) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat: enforce secret requirement for session creation * feat: remove compatibility with cookie parser * test: move test to describe * fix: improve secret option validation in session function * Update test/session.js --------- Co-authored-by: Ulises Gascón --- index.js | 22 ++++++---------------- test/session.js | 22 ++++++---------------- 2 files changed, 12 insertions(+), 32 deletions(-) diff --git a/index.js b/index.js index 5adfae1b..d710d7cd 100644 --- a/index.js +++ b/index.js @@ -101,7 +101,7 @@ function session(options) { var saveUninitializedSession = opts.saveUninitialized // get the cookie signing secret - var secret = opts.secret + var secrets = opts.secret if (typeof generateId !== 'function') { throw new TypeError('genid option must be a function'); @@ -124,16 +124,16 @@ function session(options) { // TODO: switch to "destroy" on next major var unsetDestroy = opts.unset === 'destroy' - if (Array.isArray(secret) && secret.length === 0) { + if (Array.isArray(secrets) && secrets.length === 0) { throw new TypeError('secret option array must contain one or more strings'); } - if (secret && !Array.isArray(secret)) { - secret = [secret]; + if (secrets && !Array.isArray(secrets)) { + secrets = [secrets]; } - if (!secret) { - deprecate('req.secret; provide secret option'); + if (!secrets) { + throw new Error('secret option required for sessions'); } // notify user that this store is not @@ -188,16 +188,6 @@ function session(options) { return } - // ensure a secret is available or bail - if (!secret && !req.secret) { - next(new Error('secret option required for sessions')); - return; - } - - // backwards compatibility for signed cookies - // req.secret is passed from the cookie parser middleware - var secrets = secret || [req.secret]; - var originalHash; var originalId; var savedHash; diff --git a/test/session.js b/test/session.js index aec89206..14edbab5 100644 --- a/test/session.js +++ b/test/session.js @@ -35,22 +35,6 @@ describe('session()', function(){ .expect(200, done) }) - it('should error without secret', function(done){ - request(createServer({ secret: undefined })) - .get('/') - .expect(500, /secret.*required/, done) - }) - - it('should get secret from req.secret', function(done){ - function setup (req) { - req.secret = 'keyboard cat' - } - - request(createServer(setup, { secret: undefined })) - .get('/') - .expect(200, '', done) - }) - it('should create a new session', function (done) { var store = new session.MemoryStore() var server = createServer({ store: store }, function (req, res) { @@ -1194,6 +1178,12 @@ describe('session()', function(){ }); describe('secret option', function () { + it('should reject without secret',function () { + for (const secret of [undefined, null, '', false]) { + assert.throws(session.bind(null, { secret }), /secret option required for sessions/) + } + }) + it('should reject empty arrays', function () { assert.throws(createServer.bind(null, { secret: [] }), /secret option array/); }) From 4427d9334fc3c1d47bc3f02b6168370c94a7e893 Mon Sep 17 00:00:00 2001 From: Timothy Younger Date: Sat, 26 Apr 2025 20:03:52 -0700 Subject: [PATCH 13/19] debug: adds debug statements related to `Set-Cookie` and `issecure` (#986) --- index.js | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/index.js b/index.js index d710d7cd..e7cc383f 100644 --- a/index.js +++ b/index.js @@ -207,6 +207,7 @@ function session(options) { } if (!shouldSetCookie(req)) { + debug('should not set cookie'); return; } @@ -219,6 +220,7 @@ function session(options) { if (!touched) { // touch session req.session.touch() + debug('touch session'); touched = true } @@ -579,17 +581,21 @@ function hash(sess) { function issecure(req, trustProxy) { // socket is https server if (req.connection && req.connection.encrypted) { + debug('connection encrypted'); return true; } // do not trust proxy if (trustProxy === false) { + debug('proxy untrusted'); return false; } // no explicit trust; try req.secure from express if (trustProxy !== true) { - return req.secure === true + var reqSecure = req.secure === true + debug('request %s', reqSecure ? 'secure' : 'insecure'); + return reqSecure } // read the proto from x-forwarded-proto header @@ -599,7 +605,9 @@ function issecure(req, trustProxy) { ? header.substr(0, index).toLowerCase().trim() : header.toLowerCase().trim() - return proto === 'https'; + var protoSecure = proto === 'https'; + debug('protocol %s', protoSecure ? 'secure' : 'insecure'); + return protoSecure; } /** From 47692c61282ec24e17a6cfdcc397600a6802709f Mon Sep 17 00:00:00 2001 From: francesco Date: Fri, 16 May 2025 03:50:22 +0200 Subject: [PATCH 14/19] perf: 2x faster hash stringify (#1034) --- index.js | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/index.js b/index.js index e7cc383f..d57bf8a2 100644 --- a/index.js +++ b/index.js @@ -553,14 +553,8 @@ function getcookie(req, name, secrets) { function hash(sess) { // serialize - var str = JSON.stringify(sess, function (key, val) { - // ignore sess.cookie property - if (this === sess && key === 'cookie') { - return - } - - return val - }) + const { cookie, ...sessWithoutCookie } = sess; + const str = JSON.stringify(sessWithoutCookie); // hash return crypto From 4af19597b0cc38b80ea61e036116599300249841 Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Wed, 2 Jul 2025 20:52:14 -0500 Subject: [PATCH 15/19] feat: update default value of resave option to false in session middleware (#1064) Signed-off-by: Sebastian Beltran --- README.md | 3 +-- index.js | 3 +-- test/session.js | 17 +++++++++-------- 3 files changed, 11 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index e07f86a4..1e30b86b 100644 --- a/README.md +++ b/README.md @@ -249,8 +249,7 @@ parallel requests to your server and changes made to the session in one request may get overwritten when the other request ends, even if it made no changes (this behavior also depends on what store you're using). -The default value is `true`, but using the default has been deprecated, -as the default will change in the future. Please research into this setting +The default value is `false`. Please research into this setting and choose what is appropriate to your use-case. Typically, you'll want `false`. diff --git a/index.js b/index.js index d57bf8a2..408d9cf7 100644 --- a/index.js +++ b/index.js @@ -108,8 +108,7 @@ function session(options) { } if (resaveSession === undefined) { - deprecate('undefined resave option; provide resave option'); - resaveSession = true; + resaveSession = false; } if (saveUninitializedSession === undefined) { diff --git a/test/session.js b/test/session.js index 14edbab5..085eaff3 100644 --- a/test/session.js +++ b/test/session.js @@ -936,7 +936,7 @@ describe('session()', function(){ }); describe('resave option', function(){ - it('should default to true', function(done){ + it('should default to false', function(done){ var store = new session.MemoryStore() var server = createServer({ store: store }, function (req, res) { req.session.user = 'bob' @@ -946,14 +946,15 @@ describe('session()', function(){ request(server) .get('/') .expect(shouldSetSessionInStore(store)) - .expect(200, function(err, res){ - if (err) return done(err); + .expect(200, function (err, res) { + if (err) return done(err) + request(server) - .get('/') - .set('Cookie', cookie(res)) - .expect(shouldSetSessionInStore(store)) - .expect(200, done); - }); + .get('/') + .set('Cookie', cookie(res)) + .expect(shouldNotSetSessionInStore(store)) + .expect(200, done) + }) }); describe('when true', function () { From f6d94b1bb4474f7f60be04d970a8e9ff0f183e8d Mon Sep 17 00:00:00 2001 From: Wojciech Maj Date: Mon, 29 Jun 2026 01:33:35 +0200 Subject: [PATCH 16/19] Bump debug from 2.6.9 to 4.4.3 (#1130) --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 0a8b9421..5d5ff39b 100644 --- a/package.json +++ b/package.json @@ -12,7 +12,7 @@ "dependencies": { "cookie": "0.7.2", "cookie-signature": "1.0.7", - "debug": "2.6.9", + "debug": "4.4.3", "depd": "~2.0.0", "on-headers": "~1.0.2", "parseurl": "~1.3.3", From dc91e85bb5cd433dbec672a10ed2fde331cb3b7a Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sun, 5 Jul 2026 22:06:05 -0500 Subject: [PATCH 17/19] feat: replace uid-safe with crypto.randomUUID() for session ID generation --- HISTORY.md | 8 ++++++++ index.js | 3 +-- package.json | 3 +-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index 57c68d3a..ed2d7ce4 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,3 +1,11 @@ +unreleased +========== + + * Replace `uid-safe` with `crypto.randomUUID()` for session ID generation + - Session IDs are now UUID v4 strings instead of 32-character base64url strings + - Use the `genid` option to provide a custom generator if you need to keep the previous format, + e.g. `genid: function () { return crypto.randomBytes(24).toString('base64url') }` + 1.18.1 / 2024-10-08 ========== diff --git a/index.js b/index.js index 408d9cf7..12ee4caf 100644 --- a/index.js +++ b/index.js @@ -20,7 +20,6 @@ var deprecate = require('depd')('express-session'); var onHeaders = require('on-headers') var parseUrl = require('parseurl'); var signature = require('cookie-signature') -var uid = require('uid-safe').sync var Cookie = require('./session/cookie') var MemoryStore = require('./session/memory') @@ -504,7 +503,7 @@ function session(options) { */ function generateSessionId(sess) { - return uid(24); + return crypto.randomUUID(); } /** diff --git a/package.json b/package.json index 5d5ff39b..1a776b00 100644 --- a/package.json +++ b/package.json @@ -15,8 +15,7 @@ "debug": "4.4.3", "depd": "~2.0.0", "on-headers": "~1.0.2", - "parseurl": "~1.3.3", - "uid-safe": "~2.1.5" + "parseurl": "~1.3.3" }, "devDependencies": { "after": "0.8.2", From 7d788f0501192535da28f5d6b7e4d677acff3975 Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sun, 5 Jul 2026 22:12:36 -0500 Subject: [PATCH 18/19] docs: improve --- HISTORY.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/HISTORY.md b/HISTORY.md index ed2d7ce4..61b68549 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,6 +1,8 @@ unreleased ========== +## ⚠️ BREAKING CHANGES + * Replace `uid-safe` with `crypto.randomUUID()` for session ID generation - Session IDs are now UUID v4 strings instead of 32-character base64url strings - Use the `genid` option to provide a custom generator if you need to keep the previous format, From ebfea9a6301e42545912ae8cedd1829166530e0a Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sun, 5 Jul 2026 22:17:01 -0500 Subject: [PATCH 19/19] feat: update session ID generation to use crypto.randomBytes for consistent format --- HISTORY.md | 8 ++------ index.js | 4 ++-- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/HISTORY.md b/HISTORY.md index 61b68549..238498ec 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,12 +1,8 @@ unreleased ========== -## ⚠️ BREAKING CHANGES - - * Replace `uid-safe` with `crypto.randomUUID()` for session ID generation - - Session IDs are now UUID v4 strings instead of 32-character base64url strings - - Use the `genid` option to provide a custom generator if you need to keep the previous format, - e.g. `genid: function () { return crypto.randomBytes(24).toString('base64url') }` + * Replace `uid-safe` dependency with built-in `crypto.randomBytes` for session ID generation + - Session IDs keep the same format as before (32-character base64url strings) 1.18.1 / 2024-10-08 ========== diff --git a/index.js b/index.js index 12ee4caf..09a86c2f 100644 --- a/index.js +++ b/index.js @@ -502,8 +502,8 @@ function session(options) { * @private */ -function generateSessionId(sess) { - return crypto.randomUUID(); +function generateSessionId() { + return crypto.randomBytes(24).toString('base64url'); } /**