{"action":"created","issue":{"url":"https://api.github.com/repos/pillarjs/cookies/issues/22","repository_url":"https://api.github.com/repos/pillarjs/cookies","labels_url":"https://api.github.com/repos/pillarjs/cookies/issues/22/labels{/name}","comments_url":"https://api.github.com/repos/pillarjs/cookies/issues/22/comments","events_url":"https://api.github.com/repos/pillarjs/cookies/issues/22/events","html_url":"https://github.com/pillarjs/cookies/issues/22","id":9656565,"number":22,"title":"Cookie signatures lose attributes upon re-signing, causing persistent cookie to become invalid","user":{"login":"jspilman","id":2410087,"avatar_url":"https://avatars1.githubusercontent.com/u/2410087?v=3","gravatar_id":"","url":"https://api.github.com/users/jspilman","html_url":"https://github.com/jspilman","followers_url":"https://api.github.com/users/jspilman/followers","following_url":"https://api.github.com/users/jspilman/following{/other_user}","gists_url":"https://api.github.com/users/jspilman/gists{/gist_id}","starred_url":"https://api.github.com/users/jspilman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jspilman/subscriptions","organizations_url":"https://api.github.com/users/jspilman/orgs","repos_url":"https://api.github.com/users/jspilman/repos","events_url":"https://api.github.com/users/jspilman/events{/privacy}","received_events_url":"https://api.github.com/users/jspilman/received_events","type":"User","site_admin":false},"labels":[{"id":98755471,"url":"https://api.github.com/repos/pillarjs/cookies/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2013-01-03T21:21:35Z","updated_at":"2017-05-18T13:29:01Z","closed_at":null,"body":"When the `.sig` cookie is set the first time, you have all the 'opts' from the base cookie, and they propagate into the `.sig` cookie. But when re-signing due to expired key, the 'opts' simply aren't available, because all you have is the `name=value` that the client browser sends back.\n\nSpecifically… starting at Line 54 – we push the base cookie, then update the same object to become a signature, and push it.  This should make both cookies share all the same options:\n\n``` js\n   headers = pushCookie(headers, cookie)\n   if (opts && signed) {\n     cookie.value = this.keys.sign(cookie.toString())\n     cookie.name += \".sig\"\n     headers = pushCookie(headers, cookie)\n   }\n```\n\nBut up in the ‘get’ method, if we detect the signing key index was not zero on Line 34:\n\n``` js\n    index && this.set(sigName, this.keys.sign(data), { signed: false })\n```\n\nhere all we have is name and value. The cookie we’re looking at could have been configured months ago, all the domain/path/expires/etc. settings are long gone from the server.\n\nThe largest impact I think is for persistent signed cookies. If the persistent cookie is re-signed due to a new key, the signature will always expire the next time the user closes their browser. since no ‘expire’ is set. Then next time we do a ‘get’ on the base cookie, the signature will be gone completely, and it will come back as having a invalid signature.\n"},"comment":{"url":"https://api.github.com/repos/pillarjs/cookies/issues/comments/302403633","html_url":"https://github.com/pillarjs/cookies/issues/22#issuecomment-302403633","issue_url":"https://api.github.com/repos/pillarjs/cookies/issues/22","id":302403633,"user":{"login":"HugoDellinger","id":5629617,"avatar_url":"https://avatars3.githubusercontent.com/u/5629617?v=3","gravatar_id":"","url":"https://api.github.com/users/HugoDellinger","html_url":"https://github.com/HugoDellinger","followers_url":"https://api.github.com/users/HugoDellinger/followers","following_url":"https://api.github.com/users/HugoDellinger/following{/other_user}","gists_url":"https://api.github.com/users/HugoDellinger/gists{/gist_id}","starred_url":"https://api.github.com/users/HugoDellinger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HugoDellinger/subscriptions","organizations_url":"https://api.github.com/users/HugoDellinger/orgs","repos_url":"https://api.github.com/users/HugoDellinger/repos","events_url":"https://api.github.com/users/HugoDellinger/events{/privacy}","received_events_url":"https://api.github.com/users/HugoDellinger/received_events","type":"User","site_admin":false},"created_at":"2017-05-18T13:29:01Z","updated_at":"2017-05-18T13:29:01Z","body":"This bug has been causing us quite a lot of troubles. I think this should be fixed as soon as possible."}}
{"actor":{"display_login":"HugoDellinger"}}