3 ms·
Cool submission! Per RFC 6265, which is the cookie spec you seem to use, the valid chars for cookie names is defined [1] by RFC 2616 (since obsoleted by the 72
by niftich 10y ago
Cool submission!
Per RFC 6265, which is the cookie spec you seem to use, the valid chars for cookie names is defined [1] by RFC 2616 (since obsoleted by the 723x series; but agreeing on this issue [2]).
The cookie name must be a 'token', which is incidentally the exact same rule as for HTTP header names. 'token' evaluates to one or more of the following ASCII visible characters:
"!" / "#" / "$" / "%" / "&" / "'" / "*"
/ "+" / "-" / "." / "^" / "_" / "`" / "|" / "~"
/ DIGIT (0-9) / ALPHA (A-Z, a-z)
Right now you allow any valid JSON object key to be set as a cookie name.
EDIT: To be more precise, your defaults are fine as they URLencode the key too, along with the value. But the defaults are overridable and affect both the cookie key and value simultaneously. Allowing the value encoding to be overridden would be useful, while allowing the name encoding to be overridden can cause the cookie to fall out of spec.
[1] https://tools.ietf.org/html/rfc2616#section-2.2 https://tools.ietf.org/html/rfc2616#section-2.2
[2] https://tools.ietf.org/html/rfc7230#section-3.2.6 https://tools.ietf.org/html/rfc7230#section-3.2.6
- franciscop 10y agoI URL-Encode it: var res = opt.encode(key) + '=' + encoded + ... Where `opt.encode()` is defined as: function (val) { return encodeURIComponent(val); } But from your comment I understand that this is not enough and I should dig deeper into this (though I find the RFC really dense/difficult to read).
- niftich 10y agoI did more research and have a further follow-up. According to MDN [1], encodeURIComponent escapes all characters except the following: alphabetic, decimal digits, - _ . ! ~ * ' ( ) which means that out of the allowed ASCII characters in a cookie name: "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" / DIGIT (0-9) / ALPHA (A-Z, a-z) the following matrix of behaviors results: Gets-Encoded? Is-Allowed? Current-Behavior ----------------------------------------------------- ! not-encoded allowed behavior-OK # encoded allowed unnecessarily-encoded $ encoded allowed unnecessarily-encoded % encoded allowed unnecessarily-encoded & encoded allowed unnecessarily-encoded ' not-encoded allowed behavior-OK * not-encoded allowed behavior-OK + encoded allowed unnecessarily-encoded - not-encoded allowed behavior-OK . not-encoded allowed behavior-OK ^ encoded allowed unnecessarily-encoded _ not-encoded allowed behavior-OK ` encoded allowed unnecessarily-encoded | encoded allowed unnecessarily-encoded ~ not-encoded allowed unnecessarily-encoded ( not-encoded not-allowed invalid-must-encode ) not-encoded not-allowed invalid-must-encode [1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURIComponent https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
- franciscop 10y agoFor the edit: I see, so I could add a `cookies.encodevalue()` and default it to `cookies.encode`. However, I think that'd just add too much noise to it so I will just add a warning. Thank you.