Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

enhance checkOptions to reject invalid signer objects #241

Merged
merged 1 commit into from
Apr 18, 2024

Conversation

autopulated
Copy link
Contributor

I passed a Buffer instead of a string as a secret, and this resulted in an error message that "cookieSigner.sign is not a function" an at request time, rather than at plugin registration.

Someone else had a similar issue in the past fastify/help#852

This PR makes checkOptions more comprehensive (explicitly checking for .sign and .unsign methods on signer objects passed as options.secret), and adds associated tests, so that this error is caught sooner and with a helpful message :)

Checklist

… catches accidentally passing a Buffer instead of a string.
@gurgunday
Copy link
Member

CI failed, can you take a look?

@autopulated
Copy link
Contributor Author

autopulated commented Apr 10, 2024

@gurgunday It seems that the cookie "maxAge set by maxAge" test has a race condition, since the clock can run forwards 1ms between line 582 and line 583, changing the max age of the cookie from 1000 to 999.

@gurgunday
Copy link
Member

Yeah I remember now

Copy link
Member

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@mcollina mcollina merged commit 5f9f8d8 into fastify:master Apr 18, 2024
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants