this.keys but no opts means cookies don't get signed #53

Activity

1. dougwilson

   added

   bug

   on Dec 9, 2014
2. dougwilson

   self-assigned this

   on Dec 9, 2014
3. dougwilson commented on Dec 9, 2014

   

   dougwilson

   on Dec 9, 2014

   Contributor

   More actions

   That seems to make sense, though I'm not sure how easy this will be to fix without including it in the major version bump, because I wonder how many people have the keys set but no options given. I'll have to think about it some. Also input from @jonathanong
4. jonathanong commented on Dec 9, 2014

   

   jonathanong

   on Dec 9, 2014

   Member

   More actions

   Ha was gonna remove that in the next major
5. dougwilson commented on Dec 9, 2014

   

   dougwilson

   on Dec 9, 2014

   Contributor

   More actions

   Cool, that was my suspicion. It seems weird that the existence of keys caused cookies to automatically sign. So I would almost say that the current behavior is intended: you only get signed cookies if you sent {signed: true} to .set. Does that sound right @jonathanong ?
6. dougwilson

   removed

   bug

   on Dec 9, 2014
7. jonathanong commented on Dec 9, 2014

   

   jonathanong

   on Dec 9, 2014

   Member

   More actions

   Current behavior is intended :( I wanted the next version to have .sign() and .encrypt() as separate methods
8. dougwilson

   added this to the 0.8 milestone on Sep 10, 2018
9. dougwilson

   removed this from the 0.8 milestone on Oct 10, 2019
10. JYbill commented on May 22, 2025

    

    JYbill

    on May 22, 2025

    Last edited by JYbill

    More actions

    i have same question

    // in my koa project
    app.keys = ["secret1...", "secret2..."] // example
    
    // set cookies
    ctx.cookies.set("name", "jybill", { httpOnly: true }); // notice: i dont have set signed option!!!
    
    // in fact, i will get
    set-cookie: name=jybill, httponly;
    set-cookie: name.sig=...

    Perhaps it is more reasonable to set "signed"

    • from source code
      

      cookies/index.js

      Line 86 in ddc3b71

      , signed = opts && opts.signed !== undefined ? opts.signed : !!this.keys

    // maybe
    signed = opts && opts.signed
11. bjohansebas

    unassigned

    dougwilson

    on Jul 25, 2026