expressjs / expressjs/cookie-parser

Support CipherKey type for secret

Open
#106 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
JavaScript
Stars
2k
Forks
234
PR merge metrics
No merged PRs in 30d

Description

Currently, only string or string array types can be used as secret values.

https://github.com/expressjs/cookie-parser/blob/429cfd4bcfa66f6578af890d83d5c88be1144245/index.js#L33

But [cookie-signature](https://github.com/tj/node-cookie-signature/blob/3bb06287758c8067c9fda55c8d4adea3422bd8ed/index.js#L11) allows not only `string`, but also `ArrayBufferView`(`TypedArray`, `DataView`), and `crypto.KeyObject`.

The secret is for an HMAC key, so technically we can allow `string`, `ArrayBuffer`, `Buffer`, `TypedArray`, `DataView`, `KeyObject`, and `CryptoKey`, which is described in the [nodejs docs](https://nodejs.org/api/crypto.html#cryptocreatehmacalgorithm-key-options). And these types are represented as `crypto.CipherKey` type.

This is also related to security concerns. See [Using strings as inputs to cryptographic APIs](https://nodejs.org/api/crypto.html#using-strings-as-inputs-to-cryptographic-apis)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.