res.cookie adds a default path so we should too when measuring (#275)

auth0 · Aug 25, 2021 · 9bcc677 · 9bcc677
1 parent 05f422f
commit 9bcc677
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 0 deletions.
diff --git a/lib/appSession.js b/lib/appSession.js
@@ -51,6 +51,7 @@ module.exports = (config) => {
 
   const { transient: emptyTransient, ...emptyCookieOptions } = cookieConfig;
   emptyCookieOptions.expires = emptyTransient ? 0 : new Date();
+  emptyCookieOptions.path = emptyCookieOptions.path || '/';
 
   const emptyCookie = cookie.serialize(
     `${sessionName}.0`,

diff --git a/test/appSession.tests.js b/test/appSession.tests.js
@@ -123,6 +123,33 @@ describe('appSession', () => {
   });
 
   it('should limit total cookie size to 4096 Bytes', async () => {
+    server = await createServer(appSession(getConfig(defaultConfig)));
+    const jar = request.jar();
+
+    await request.post('session', {
+      baseUrl,
+      jar,
+      json: {
+        sub: '__test_sub__',
+        random: crypto.randomBytes(8000).toString('base64'),
+      },
+    });
+
+    const cookies = jar
+      .getCookies(baseUrl)
+      .reduce(
+        (obj, value) => Object.assign(obj, { [value.key]: value + '' }),
+        {}
+      );
+
+    assert.exists(cookies);
+    assert.equal(cookies['appSession.0'].length, 4096);
+    assert.equal(cookies['appSession.1'].length, 4096);
+    assert.equal(cookies['appSession.2'].length, 4096);
+    assert.isTrue(cookies['appSession.3'].length <= 4096);
+  });
+
+  it('should limit total cookie size to 4096 Bytes with custom path', async () => {
     const path =
       '/some-really-really-really-really-really-really-really-really-really-really-really-really-really-long-path';
     server = await createServer(