maybe fixes issue, testing pending (#948)

* maybe fixes issue, testing pending * able to reproduce error
supertokens · Oct 15, 2024 · 37dfa54 · 37dfa54
1 parent 0e21e6d
commit 37dfa54
Show file tree

Hide file tree

Showing 3 changed files with 76 additions and 2 deletions.
diff --git a/lib/build/recipe/session/cookieAndHeaders.js b/lib/build/recipe/session/cookieAndHeaders.js
@@ -256,7 +256,15 @@ function parseCookieStringFromRequestHeaderAllowingDuplicates(cookieString) {
         const [name, value] = cookiePair
             .trim()
             .split("=")
-            .map((part) => decodeURIComponent(part));
+            .map((part) => {
+                try {
+                    return decodeURIComponent(part);
+                } catch (e) {
+                    // this is there in case the cookie value is not encoded. This can happe
+                    // if the user has set their own cookie in a different format.
+                    return part;
+                }
+            });
         if (cookies.hasOwnProperty(name)) {
             cookies[name].push(value);
         } else {

diff --git a/lib/ts/recipe/session/cookieAndHeaders.ts b/lib/ts/recipe/session/cookieAndHeaders.ts
@@ -306,7 +306,15 @@ function parseCookieStringFromRequestHeaderAllowingDuplicates(cookieString: stri
         const [name, value] = cookiePair
             .trim()
             .split("=")
-            .map((part) => decodeURIComponent(part));
+            .map((part) => {
+                try {
+                    return decodeURIComponent(part);
+                } catch (e) {
+                    // this is there in case the cookie value is not encoded. This can happe
+                    // if the user has set their own cookie in a different format.
+                    return part;
+                }
+            });
 
         if (cookies.hasOwnProperty(name)) {
             cookies[name].push(value);

diff --git a/test/session.test.js b/test/session.test.js
@@ -245,6 +245,64 @@ describe(`session: ${printPath("[test/session.test.js]")}`, function () {
         assert(cookies.refreshTokenExpiry === new Date(0).toUTCString());
     });
 
+    it("test that custom cookie format does nto throw an error during cookie parsing", async function () {
+        const connectionURI = await startST();
+        SuperTokens.init({
+            supertokens: {
+                connectionURI,
+            },
+            appInfo: {
+                apiDomain: "api.supertokens.io",
+                appName: "SuperTokens",
+                websiteDomain: "supertokens.io",
+            },
+            recipeList: [Session.init({ getTokenTransferMethod: () => "cookie", antiCsrf: "VIA_TOKEN" })],
+        });
+        const app = express();
+        app.use(middleware());
+
+        app.post("/create", async (req, res) => {
+            await Session.createNewSession(req, res, "public", SuperTokens.convertToRecipeUserId("testuserid"), {}, {});
+            res.status(200).send("");
+        });
+
+        app.use(errorHandler());
+        let res = extractInfoFromResponse(
+            await new Promise((resolve) =>
+                request(app)
+                    .post("/create")
+                    .expect(200)
+                    .end((err, res) => {
+                        if (err) {
+                            resolve(undefined);
+                        } else {
+                            resolve(res);
+                        }
+                    })
+            )
+        );
+
+        let res2 = await new Promise((resolve) =>
+            request(app)
+                .post("/auth/session/refresh")
+                .set("Cookie", ["sAccessToken=" + res.accessToken + ";custom=" + JSON.stringify({ a: "b%b" })])
+                .set("anti-csrf", res.antiCsrf)
+                .end((err, res) => {
+                    if (err) {
+                        resolve(undefined);
+                    } else {
+                        resolve(res);
+                    }
+                })
+        );
+        let cookies = extractInfoFromResponse(res2);
+        assert(res2.status === 401);
+        assert(cookies.accessToken === "");
+        assert(cookies.accessTokenExpiry === new Date(0).toUTCString());
+        assert(cookies.refreshToken === "");
+        assert(cookies.refreshTokenExpiry === new Date(0).toUTCString());
+    });
+
     it("test that session tokens are cleared if refresh token api is called without the refresh token but with an expired access token", async function () {
         const connectionURI = await startST({ coreConfig: { access_token_validity: 1 } });
         SuperTokens.init({