Watch out for setCookie and clearCookie opts, as clearCookie mutates opts instance
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 55/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 停滞
- 技术栈
- aws, javascript
调研方向
从 lib/response.js 的第 221-224 行开始，检查 clearCookie 如何处理传入的 options 对象。使用共享的 cookie 选项重现登录、注销和登录的流程，然后验证清除 cookie 不会影响后续的 setCookie 调用；如果实现有意保持不变，请记录该行为。
由索引模型根据 Issue 内容生成。
描述
Hi!
Lambda-api is a great package and has been really helpful in our one single backend lambda architecture 🚀
Today, I faced a really hard to debug issue and I though passing the information here if it helps anyone else. I was running our app with SAM CLI and everything worked like a charm, but when I deployed to AWS lambda, it worked in really weird way.
The problem was that I had somewhat the following structure:
const cookieOptions: CookieOptions = {
sameSite: 'Lax',
secure: true,
httpOnly: true,
}
// And pseudo authentication
api.post('/login', async (req,res) => {
// Do login stuff
res.setCookie('authcookie', sessionId, cookieOpts).json({ message: "Authenticated" })
})
api.post('/logout', async (req,res) => {
// Do logout stuff
res.clearCookie('authcookie', cookieOpts).json({ message: "Logged out" })
})
It worked locally like a charm. But when it was deployed to AWS Lambda, it worked like this:
- Login - OK you get a cookie
- Logout - OK cookie gets evicted
- Login - FAILS and no cookie is set
- After some time, it starts to work again, for once 😂
After some weird debugging I found out that the third call gets correct cookie, but with expiration set to -1, so the browser thinks that yes, unset the cookie.
Obvious reason for this is that response.clearCookie call mutates the given opts instance:
After the first response.clearCookie call my opts instance was mutated to contain expiration: -1 field and calls to response.setCookie after that naturally included the expiration.
The reason why it works after some time in AWS lambda is that runtime spins up a new sandbox and then it works again, for once 😄, because opts instance is not mutated and no one has logged out. Locally SAM CLI fires a whole new sandbox for each request and thus it worked locally with no issues.
You can easily work around this for example by wrapping opts in function:
const cookieOptions = (): CookieOptions => ({
sameSite: 'Lax',
secure: true,
httpOnly: true,
})
It surely took me some time to figure out what is going on 😄 I don't think this is mentioned in documentation. I think I can work out a PR for this if this is something that should be fixed - in code or with documentation.
- 主要语言
- JavaScript
- 星标
- 1.5k
- 派生
- 127
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
jeremydaly/lambda-api 的其他 Issue
-
难度 1/5 1 小时以内 新手友好度 88/100
jeremydaly/lambda-api#356 ·
-
难度 4/5 3-5 天 新手友好度 30/100
jeremydaly/lambda-api#270 ·
-
Logger Output可能重新可做 @naorpeled 于 912 天前认领，目前没有进行中的 PR。 未关闭
jeremydaly/lambda-api#259 · 1 条评论 · 已指派 1 人 ·
-
Is it possible to disable versioning?可能已有人在做 @naorpeled 于 106 天前认领。 未关闭
难度 3/5 1-2 天 新手友好度 52/100
jeremydaly/lambda-api#257 · 5 条评论 ·
-
难度 3/5 1-2 天 新手友好度 38/100
jeremydaly/lambda-api#251 · 1 条评论 ·
查看 jeremydaly/lambda-api 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
[BUG] npm pkg delete removes the first array item for a nonexistent property可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 83/100
维护者通常 2 天内回复
-
feedback simulation workshop
难度 2/5 1-3 小时 新手友好度 72/100
githubnext/gh-aw-workshop#4755 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 65/100
videojs/video.js#9537 · 1 条评论 ·
维护者通常 1 天内回复
-
fix
难度 1/5 1 小时以内 新手友好度 72/100
idean3885/claude-ops-agent#728 ·
维护者通常 1 天内回复