expressjs / expressjs/cookie-parser
Support CipherKey type for secret
- Dominant language
- JavaScript
- Stars
- 2k
- Forks
- 234
- PR merge metrics
- No merged PRs in 30d
Description
Currently, only string or string array types can be used as secret values.
https://github.com/expressjs/cookie-parser/blob/429cfd4bcfa66f6578af890d83d5c88be1144245/index.js#L33
But [cookie-signature](https://github.com/tj/node-cookie-signature/blob/3bb06287758c8067c9fda55c8d4adea3422bd8ed/index.js#L11) allows not only `string`, but also `ArrayBufferView`(`TypedArray`, `DataView`), and `crypto.KeyObject`.
The secret is for an HMAC key, so technically we can allow `string`, `ArrayBuffer`, `Buffer`, `TypedArray`, `DataView`, `KeyObject`, and `CryptoKey`, which is described in the [nodejs docs](https://nodejs.org/api/crypto.html#cryptocreatehmacalgorithm-key-options). And these types are represented as `crypto.CipherKey` type.
This is also related to security concerns. See [Using strings as inputs to cryptographic APIs](https://nodejs.org/api/crypto.html#using-strings-as-inputs-to-cryptographic-apis)
Contributor guide
Assessment
This issue has not been assessed yet.