Server-side single maps - cookie should specify a path

[jaydgruber]

What

• when using server-side-single-map, using the overrides UI on multiple routes can cause overrides persist in cookies even after they have been deleted in the UI.

// server.js 

// ExpressJS middleware - used on each route that requests a document w/ import-map-overrides
const importMapOverridesMiddleware = (req, res, next) => {
  const overrides = importMapOverrides.getOverridesFromCookies(req);
  if (Object.keys(overrides).length === 0) {
    app.locals.importMap = app.locals.originalImportMap;
  } else {
    app.locals.importMap = new Map([...app.locals.originalImportMap, ...Object.entries(overrides)]);
  }
  next();
};

Scenario

• visit page http://localhost:8080
• using overrides UI, add a new override: "elephant": "https://ci.assets.avalara.com/one-web-domain/elephant/0.0.0%2b8a086bcf"
  • confirm localStorage gets a new entry as expected import-map-override:elephant
  • confirm new cookie created as expected: import-map-override:elephant:"https://ci.assets.avalara.com/one-web-domain/elephant/0.0.0%2b8a086bcf"
• visit page http://localhost:8080/elephant
• using overrides UI, "Reset all overrides"
  • confirm localStorage entry import-map-override:elephant has been deleted
  • cookie is not deleted as expected
• using overrides UI, add a new override (same value)
  • now I have two cookies w/ same name and value, one on path=/, one on path=/elephant
• navigate back to http://localhost:8080
• using overrides UI, "Reset all overrides"
  • now I have one cookie for path /elephant
  • visiting http://localhost:8080 gets me no overrides, visiting http://localhost:8080/elephant gets me an override.

Proposed solution

• set Path=/; both when adding and removing server cookies
  • https://github.com/joeldenning/import-map-overrides/blob/180393490649ef967a47043ad1ad2009811bdc03/src/api/js-api.js#L85
  • https://github.com/joeldenning/import-map-overrides/blob/180393490649ef967a47043ad1ad2009811bdc03/src/api/js-api.js#L140

[Matt0911]

I am also using server-side-single-map and am impacted by a sub-issue of this. Bullet 4, reset all overrides cookie is not deleted. If you reset an individual override, the cookie is deleted. However when disabling any individual override, the cookie is also not deleted. This causes inconsistencies between the UI state and the import map returned by the server.

Disabling should have the same end result as removing.