node package manager

node-cookie

Node Cookie

Easily parse and write signed & encrypted cookies on Node.js HTTP requests.

NPM Version Build Status Appveyor Coveralls

node-cookie makes it simpler to create encrypted and signed cookies for HTTP requests.

You can use it with any framework or library of your choice.

See also

  1. node-req
  2. node-res

Basic Setup

const http = require('http')
const nodeCookie = require('node-cookie')
 
http.createServer(function (req, res) {
 
  // this will update set-cookie header on res object. 
  nodeCookie.create(res, 'user', 'virk')
 
}).listen(3000)

Signing cookies with a secret

const http = require('http')
const nodeCookie = require('node-cookie')
 
http.createServer(function (req, res) {
 
  nodeCookie.create(res, 'user', 'virk', '16charlongsecret')
 
}).listen(3000)

Signing & encrypting cookies with a secret

const http = require('http')
const nodeCookie = require('node-cookie')
 
http.createServer(function (req, res) {
 
  nodeCookie.create(res, 'user', 'virk', '16charlongsecret', true)
 
}).listen(3000)

Methods

parse

Parses cookies from HTTP header Cookie into a javascript object. Also it will unsign and decrypt cookies encrypted and signed by this library using a secret.

Params

Param Type Required Description
req Object Yes  
secret String No  
decrypt Boolean No  

Returns Object

Example

nodeCookie.parse(req)
 
// or if cookies were signed when writing 
nodeCookie.parse(req, 'SECRET')
 
// also if cookies where encrypted 
nodeCookie.parse(req, 'SECRET', true)

get

Returns value for a single cookie by its key. It is recommended to make use of this function when you want to pull a single cookie. Since the parse method will eagerly unsign and decrypt all the cookies.

Params

Param Type Required Description
req Object Yes  
key String Yes  
secret String No  
decrypt Boolean No  
cookies Object No Use existing cookies object over re-parsing them from the header.

Returns Mixed

Example

nodeCookie.get(req, 'sessionId')
 
// or if session cookie was signed 
nodeCookie.get(req, 'sessionId', 'SECRET')
 
// also or if session cookie was encrypted 
nodeCookie.get(req, 'sessionId', 'SECRET', true)

create

Write cookie to the HTTP response object. It will append duplicate cookies to the Set-Cookie header, since browsers discard the duplicate cookies by themselves

Params

Param Type Required Description
res Object Yes  
key String Yes  
value * Yes  
options Object No  
secret String No  
encrypt Boolean No  

Returns Void

Example

nodeCookie.create(res, 'sessionId', 1)
 
// sign session id 
nodeCookie.create(res, 'sessionId', 1, {}, 'SECRET')
 
// sign and encrypt session id 
nodeCookie.create(res, 'sessionId', 1, {}, 'SECRET', true)

clear

Clears the cookie from browser by setting it's expiry in past. This is required since there is no other way to instruct the browser to delete a cookie.

Also this method will override the expires value on the options object.

Params

Param Type Required Description
res Object Yes  
key String Yes  
options Object No  

Returns Void

Example

nodeCookie.clear(res, 'sessionId')