Cookie helper import
The cookie helper functions are imported from 'hono/cookie'. Available functions: deleteCookie, getCookie, getSignedCookie, setCookie, setSignedCookie, generateCookie, generateSignedCookie.
helpers/cookie
15 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
setCookie basic usage
setCookie(c, 'cookie_name', 'cookie_value') sets a regular cookie. It takes the context object, cookie name as string, and cookie value as string.
getCookie basic usage
getCookie(c, 'cookie_name') retrieves a single cookie by name and returns its value as a string. getCookie(c) with no cookie name returns all cookies as an object.
deleteCookie basic usage
deleteCookie(c, 'cookie_name') deletes a cookie and returns the deleted value. It takes the context object and cookie name as parameters.
Signed cookies are asynchronous
setSignedCookie and getSignedCookie return Promises because they use the WebCrypto API to create and verify HMAC SHA-256 signatures. These functions must be awaited.
setSignedCookie basic usage
await setSignedCookie(c, 'cookie_name', 'cookie_value', secret) sets a signed cookie. The secret parameter is required and should be a large enough string to be secure.
getSignedCookie basic usage
await getSignedCookie(c, secret, 'cookie_name') retrieves a signed cookie by name. await getSignedCookie(c, secret) with no cookie name returns all signed cookies. The secret parameter is required.
getSignedCookie verification behavior
getSignedCookie returns false if a cookie has a signature that fails verification. It returns undefined if a cookie does not have a valid signature format or is not present. Both false and undefined are falsy, so `if (!value)` handles both cases.
generateCookie creates cookie strings
generateCookie('cookie_name', 'cookie_value') and generateCookie('cookie_name', 'cookie_value', options) create cookie strings without setting them in response headers. For example, generateCookie('delicious_cookie', 'macha') returns 'delicious_cookie=macha; Path=/'.
generateSignedCookie creates signed cookie strings
await generateSignedCookie('cookie_name', 'cookie_value', secret) and await generateSignedCookie('cookie_name', 'cookie_value', secret, options) create signed cookie strings without setting them in response headers. These are async functions that must be awaited.
setCookie and setSignedCookie options
setCookie and setSignedCookie accept an options object with the following properties: domain (string), expires (Date), httpOnly (boolean), maxAge (number), path (string), secure (boolean), sameSite ('Strict' | 'Lax' | 'None'), priority ('Low' | 'Medium' | 'High'), prefix ('secure' | 'host'), partitioned (boolean).
deleteCookie options
deleteCookie accepts an options object with the following properties: path (string), secure (boolean), domain (string).
getCookie prefix parameter
getCookie and getSignedCookie accept an optional prefix parameter to verify if the cookie name has a prefix. Use 'secure' for __Secure- prefix or 'host' for __Host- prefix. Example: getCookie(c, 'yummy_cookie', 'secure') and await getSignedCookie(c, secret, 'fortune_cookie', 'secure').
Set cookie prefix option
When setting a cookie with setCookie or setSignedCookie, specify the prefix option with value 'secure' or 'host' to apply __Secure- or __Host- prefixes to the cookie name. Example: setCookie(c, 'delicious_cookie', 'macha', { prefix: 'secure' }).
Cookie security best practices validation
The cookie helper enforces best practices and throws an Error when: (1) cookie name starts with __Secure- but secure option is not set, (2) cookie name starts with __Host- but secure option is not set, (3) cookie name starts with __Host- but path is not '/', (4) cookie name starts with __Host- but domain is set, (5) maxAge option is greater than 400 days, (6) expires option is 400 days later than current time.