From ef7d304f3eefa01afb0dedf4bdee42de8aad9cbe Mon Sep 17 00:00:00 2001 From: Jon Church Date: Sat, 18 May 2024 13:19:54 -0400 Subject: [PATCH 1/9] add deprecation notice for res.clearCookie maxAge/expires --- lib/response.js | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lib/response.js b/lib/response.js index 29845a7d830..04b6a3fe424 100644 --- a/lib/response.js +++ b/lib/response.js @@ -34,6 +34,7 @@ var extname = path.extname; var mime = send.mime; var resolve = path.resolve; var vary = require('vary'); +var deprecate = require('depd')('express'); /** * Response prototype. @@ -822,6 +823,14 @@ res.get = function(field){ */ res.clearCookie = function clearCookie(name, options) { + if (options && (options.maxAge || options.expires)) { + if (options.maxAge) { + deprecate('res.clearCookie: Passing "options.maxAge" is deprecated. In the next major release of Express, this option will be ignored, and the method will solely delete cookies.'); + } + if (options.expires) { + deprecate('res.clearCookie: Passing "options.expires" is deprecated. In the next major release of Express, this option will be ignored, and the method will solely delete cookies.'); + } + } var opts = merge({ expires: new Date(1), path: '/' }, options); return this.cookie(name, '', opts); From ea74d457a25814481a5396e0e1589c8e90ec77bc Mon Sep 17 00:00:00 2001 From: Jon Church Date: Sat, 18 May 2024 13:21:52 -0400 Subject: [PATCH 2/9] update History.md for clearCookie deprecation change --- History.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/History.md b/History.md index 1aefd4b9686..c02b24ffba2 100644 --- a/History.md +++ b/History.md @@ -3,6 +3,8 @@ unreleased * deps: encodeurl@~2.0.0 - Removes encoding of `\`, `|`, and `^` to align better with URL spec + * Deprecate passing `options.maxAge` and `options.expires` to `res.clearCookie` + - Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie 4.19.2 / 2024-03-25 ========== From 51bbc7ceb245fcae82c8de560bc1548ce3d8c192 Mon Sep 17 00:00:00 2001 From: Jon Church Date: Sat, 18 May 2024 13:42:42 -0400 Subject: [PATCH 3/9] clarify user action in dep message --- lib/response.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/response.js b/lib/response.js index 04b6a3fe424..064f8308d40 100644 --- a/lib/response.js +++ b/lib/response.js @@ -825,10 +825,10 @@ res.get = function(field){ res.clearCookie = function clearCookie(name, options) { if (options && (options.maxAge || options.expires)) { if (options.maxAge) { - deprecate('res.clearCookie: Passing "options.maxAge" is deprecated. In the next major release of Express, this option will be ignored, and the method will solely delete cookies.'); + deprecate('res.clearCookie: Passing "options.maxAge" is deprecated and should be removed. Starting with the next major release of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.'); } if (options.expires) { - deprecate('res.clearCookie: Passing "options.expires" is deprecated. In the next major release of Express, this option will be ignored, and the method will solely delete cookies.'); + deprecate('res.clearCookie: Passing "options.expires" is deprecated and should be removed. Starting with the next major release of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.'); } } var opts = merge({ expires: new Date(1), path: '/' }, options); From f51bb7dc5d3443e6bc53db6ba6d7fd8814d59fb8 Mon Sep 17 00:00:00 2001 From: Jon Church Date: Sat, 25 May 2024 17:47:59 -0400 Subject: [PATCH 4/9] remove duplicated import --- lib/response.js | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/response.js b/lib/response.js index 064f8308d40..2dbbd21cd93 100644 --- a/lib/response.js +++ b/lib/response.js @@ -34,7 +34,6 @@ var extname = path.extname; var mime = send.mime; var resolve = path.resolve; var vary = require('vary'); -var deprecate = require('depd')('express'); /** * Response prototype. From 49a3e124bac93a278bb035e8302465e4851a23a0 Mon Sep 17 00:00:00 2001 From: Jon Church Date: Sat, 25 May 2024 18:06:15 -0400 Subject: [PATCH 5/9] reduce conditional checks on dep notice --- lib/response.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/response.js b/lib/response.js index 2dbbd21cd93..e28d181862b 100644 --- a/lib/response.js +++ b/lib/response.js @@ -822,7 +822,7 @@ res.get = function(field){ */ res.clearCookie = function clearCookie(name, options) { - if (options && (options.maxAge || options.expires)) { + if (options) { if (options.maxAge) { deprecate('res.clearCookie: Passing "options.maxAge" is deprecated and should be removed. Starting with the next major release of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.'); } From 6c76c0cdc0d128a42590ec0a1de35ef94fc22705 Mon Sep 17 00:00:00 2001 From: Jon Church Date: Sat, 25 May 2024 20:25:00 -0400 Subject: [PATCH 6/9] add tests to codify deprecated behavior --- test/res.clearCookie.js | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/test/res.clearCookie.js b/test/res.clearCookie.js index fc0cfb99a3d..c9c9dcf1acd 100644 --- a/test/res.clearCookie.js +++ b/test/res.clearCookie.js @@ -32,5 +32,35 @@ describe('res', function(){ .expect('Set-Cookie', 'sid=; Path=/admin; Expires=Thu, 01 Jan 1970 00:00:00 GMT') .expect(200, done) }) + + it('should set expires when passed', function(done) { + var expiresAt = new Date() + var app = express(); + + app.use(function(req, res){ + res.clearCookie('sid', { expires: expiresAt }).end(); + }); + + request(app) + .get('/') + .expect('Set-Cookie', 'sid=; Path=/; Expires=' + expiresAt.toUTCString() ) + .expect(200, done) + }) + + it('should set maxAge when passed', function(done) { + var maxAgeInMs = 10000 + var expiresAt = new Date() + var expectedExpires = new Date(expiresAt.getTime() + maxAgeInMs) + var app = express(); + + app.use(function(req, res){ + res.clearCookie('sid', { expires: expiresAt, maxAge: maxAgeInMs }).end(); + }); + + request(app) + .get('/') + .expect('Set-Cookie', 'sid=; Max-Age=10; Path=/; Expires=' + expectedExpires.toUTCString()) + .expect(200, done) + }) }) }) From 7c63b81e6c42b6c1022f82679b994c9b70d6d656 Mon Sep 17 00:00:00 2001 From: Jon Church Date: Sat, 25 May 2024 20:33:57 -0400 Subject: [PATCH 7/9] add a comment explaining the behavior in the max-age case --- test/res.clearCookie.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/res.clearCookie.js b/test/res.clearCookie.js index c9c9dcf1acd..3d8a6a5a81f 100644 --- a/test/res.clearCookie.js +++ b/test/res.clearCookie.js @@ -47,7 +47,7 @@ describe('res', function(){ .expect(200, done) }) - it('should set maxAge when passed', function(done) { + it('should set both maxAge and expires when passed', function(done) { var maxAgeInMs = 10000 var expiresAt = new Date() var expectedExpires = new Date(expiresAt.getTime() + maxAgeInMs) @@ -59,6 +59,8 @@ describe('res', function(){ request(app) .get('/') + // yes, this is the behavior. When we set a max-age, we also set expires to a date 10 sec ahead of expires + // even if we set max-age only, we will also set an expires 10 sec in the future .expect('Set-Cookie', 'sid=; Max-Age=10; Path=/; Expires=' + expectedExpires.toUTCString()) .expect(200, done) }) From db3c56d6f8b3fa4f023254e99d85bf58f8785adf Mon Sep 17 00:00:00 2001 From: Jon Church Date: Wed, 5 Jun 2024 09:37:50 -0400 Subject: [PATCH 8/9] update deprecation notice to explicitly mention v5.0.0 --- lib/response.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/response.js b/lib/response.js index e28d181862b..3b238290d88 100644 --- a/lib/response.js +++ b/lib/response.js @@ -824,10 +824,10 @@ res.get = function(field){ res.clearCookie = function clearCookie(name, options) { if (options) { if (options.maxAge) { - deprecate('res.clearCookie: Passing "options.maxAge" is deprecated and should be removed. Starting with the next major release of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.'); + deprecate('res.clearCookie: Passing "options.maxAge" is deprecated and should be removed. In v5.0.0 of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.'); } if (options.expires) { - deprecate('res.clearCookie: Passing "options.expires" is deprecated and should be removed. Starting with the next major release of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.'); + deprecate('res.clearCookie: Passing "options.expires" is deprecated and should be removed. In v5.0.0 of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.'); } } var opts = merge({ expires: new Date(1), path: '/' }, options); From d181e544ab74efec9426e1349fa3d3c63c36962b Mon Sep 17 00:00:00 2001 From: Jon Church Date: Fri, 7 Jun 2024 19:41:37 -0400 Subject: [PATCH 9/9] update dep notice Co-authored-by: Chris de Almeida --- lib/response.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/response.js b/lib/response.js index 3b238290d88..68d969ff05b 100644 --- a/lib/response.js +++ b/lib/response.js @@ -824,10 +824,10 @@ res.get = function(field){ res.clearCookie = function clearCookie(name, options) { if (options) { if (options.maxAge) { - deprecate('res.clearCookie: Passing "options.maxAge" is deprecated and should be removed. In v5.0.0 of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.'); + deprecate('res.clearCookie: Passing "options.maxAge" is deprecated. In v5.0.0 of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.'); } if (options.expires) { - deprecate('res.clearCookie: Passing "options.expires" is deprecated and should be removed. In v5.0.0 of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.'); + deprecate('res.clearCookie: Passing "options.expires" is deprecated. In v5.0.0 of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.'); } } var opts = merge({ expires: new Date(1), path: '/' }, options);