Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(utils/cookie): allow setting cookie SameSite attribute in lowercase too #2668

Merged
merged 1 commit into from
May 14, 2024

Conversation

BlankParticle
Copy link
Contributor

@BlankParticle BlankParticle commented May 13, 2024

Added support for allowing lax, strict, and none values for the SameSite attribute in the setCookie function.

While the RFC suggests that the SameSite attribute should Strict, Lax, None as values, there is no indication that the SameSite attribute should be case-sensitive.

Libraries like lucia (Undelying olso) returns cookie objects with lowercase SameSite attribute values, which conficts with the SameSite attribute values in the setCookie function. This needs us to convert the SameSite attribute values from lucia to the correct case-sensitive values which is a huge pain.

Libraires like Next.js (underlying @edge-runtime/cookie) allow both cases and uses the lowercase value.

While I could have asked lucia to change the case of the SameSite attribute values, Its less likely to happen as changing the case of the SameSite attribute values would break existing codebases. So its better to allow both cases for the SameSite attribute values.

I have updated the setCookie function to allow lax, strict, and none values for the SameSite attribute. While keeping the return value in the original case-sensitive form to stay true to the RFC.

The author should do the following, if applicable

  • Add tests
  • Run tests
  • bun denoify to generate files for Deno
  • bun run format:fix && bun run lint:fix to format the code

@yusukebe
Copy link
Member

Hi @BlankParticle, Thanks for the PR!

I could see that it was inconvenient for you.

@Jxck What do you think of this PR? Should we allow the lower cases?

@Jxck
Copy link
Contributor

Jxck commented May 14, 2024

I'm agree with @BlankParticle
What we should refer to is RFC6265 or RFC6265bis and both mentions sending Upper camel case and receiving case-insensitive manner.

LGTM +1

@yusukebe yusukebe changed the title feat: allow setting cookie SameSite attribute in lowercase too feat(utils/cookie): allow setting cookie SameSite attribute in lowercase too May 14, 2024
@yusukebe
Copy link
Member

@Jxck Thanks!

@BlankParticle, I think we don't have to add a test for this case. Since it's a petty feature, I'll merge it into the main and release it as a patch. Thanks!

@yusukebe yusukebe merged commit e709821 into honojs:main May 14, 2024
10 checks passed
@BlankParticle BlankParticle deleted the feat/cookie-samesite-cases branch May 14, 2024 08:55
nicolewhite referenced this pull request in autoblocksai/cli May 20, 2024
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [hono](https://hono.dev/) ([source](https://togithub.com/honojs/hono))
| [`4.3.6` ->
`4.3.8`](https://renovatebot.com/diffs/npm/hono/4.3.6/4.3.8) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/hono/4.3.8?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/hono/4.3.8?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/hono/4.3.6/4.3.8?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/hono/4.3.6/4.3.8?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>honojs/hono (hono)</summary>

### [`v4.3.8`](https://togithub.com/honojs/hono/releases/tag/v4.3.8)

[Compare
Source](https://togithub.com/honojs/hono/compare/v4.3.7...v4.3.8)

#### What's Changed

- test(validator): compatibility with Node.js `v20.13.1` by
[@&#8203;yusukebe](https://togithub.com/yusukebe) in
[https://github.com/honojs/hono/pull/2682](https://togithub.com/honojs/hono/pull/2682)
- refactor(utils/jwt): remove some `any` by
[@&#8203;fzn0x](https://togithub.com/fzn0x) in
[https://github.com/honojs/hono/pull/2684](https://togithub.com/honojs/hono/pull/2684)
- refactor(timing): don't use `Partial` for the options by
[@&#8203;yusukebe](https://togithub.com/yusukebe) in
[https://github.com/honojs/hono/pull/2712](https://togithub.com/honojs/hono/pull/2712)
- refactor(secure-headers): don't use `Partial` for the options by
[@&#8203;yusukebe](https://togithub.com/yusukebe) in
[https://github.com/honojs/hono/pull/2713](https://togithub.com/honojs/hono/pull/2713)
- fix(context): Retain all cookies when passing `ResponseInit` to
`c.body` by [@&#8203;codeflows](https://togithub.com/codeflows) in
[https://github.com/honojs/hono/pull/2690](https://togithub.com/honojs/hono/pull/2690)
- fix(hono-jsx): make ref unrequried for forward ref by
[@&#8203;dygy](https://togithub.com/dygy) in
[https://github.com/honojs/hono/pull/2715](https://togithub.com/honojs/hono/pull/2715)

#### New Contributors

- [@&#8203;fzn0x](https://togithub.com/fzn0x) made their first
contribution in
[https://github.com/honojs/hono/pull/2684](https://togithub.com/honojs/hono/pull/2684)
- [@&#8203;codeflows](https://togithub.com/codeflows) made their first
contribution in
[https://github.com/honojs/hono/pull/2690](https://togithub.com/honojs/hono/pull/2690)
- [@&#8203;dygy](https://togithub.com/dygy) made their first
contribution in
[https://github.com/honojs/hono/pull/2715](https://togithub.com/honojs/hono/pull/2715)

**Full Changelog**:
honojs/hono@v4.3.7...v4.3.8

### [`v4.3.7`](https://togithub.com/honojs/hono/releases/tag/v4.3.7)

[Compare
Source](https://togithub.com/honojs/hono/compare/v4.3.6...v4.3.7)

#### What's Changed

- doc(ssg): Define the default value for Content-Type by
[@&#8203;watany-dev](https://togithub.com/watany-dev) in
[https://github.com/honojs/hono/pull/2666](https://togithub.com/honojs/hono/pull/2666)
- feat(aws-lambda): add alb event processor by
[@&#8203;yiss](https://togithub.com/yiss) in
[https://github.com/honojs/hono/pull/2657](https://togithub.com/honojs/hono/pull/2657)
- feat(utils/cookie): allow setting cookie SameSite attribute in
lowercase too by
[@&#8203;BlankParticle](https://togithub.com/BlankParticle) in
[https://github.com/honojs/hono/pull/2668](https://togithub.com/honojs/hono/pull/2668)
- fix(method-override): remove un-needed import of URLSearchParams in
method override middleware by [@&#8203;f5io](https://togithub.com/f5io)
in
[https://github.com/honojs/hono/pull/2679](https://togithub.com/honojs/hono/pull/2679)

#### New Contributors

- [@&#8203;yiss](https://togithub.com/yiss) made their first
contribution in
[https://github.com/honojs/hono/pull/2657](https://togithub.com/honojs/hono/pull/2657)
- [@&#8203;BlankParticle](https://togithub.com/BlankParticle) made their
first contribution in
[https://github.com/honojs/hono/pull/2668](https://togithub.com/honojs/hono/pull/2668)
- [@&#8203;f5io](https://togithub.com/f5io) made their first
contribution in
[https://github.com/honojs/hono/pull/2679](https://togithub.com/honojs/hono/pull/2679)

**Full Changelog**:
honojs/hono@v4.3.6...v4.3.7

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 4am on Monday" in timezone
America/Chicago, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/autoblocksai/cli).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zNjMuNSIsInVwZGF0ZWRJblZlciI6IjM3LjM2My41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants