`cookie-parser` is an Express.js middleware designed to parse HTTP request cookies, making their values easily accessible through `req.cookies` and `req.signedCookies` properties. The current stable version is 1.4.7, indicating a mature and stable codebase with infrequent but consistent releases primarily focused on dependency updates to ensure compatibility and performance. A key differentiating feature is its robust support for both signed cookies, which helps mitigate tampering, and "JSON cookies," which automatically deserialize JSON-prefixed cookie values. This package provides an essential and convenient layer for web applications built with Express that need to interact with client-side cookies, offering a structured approach to cookie management and enhanced security through optional signing capabilities. It does not handle setting cookies, which is typically done via `res.cookie()` in Express.
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslnode 18–226 runs
build_error
glibcnode 18–226 runs
build_error
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
This package is a CommonJS module. Use `require` for Node.js applications.
const cookieParser = require('cookie-parser')
Static methods are accessed via the main `cookieParser` export in CommonJS.
const { signedCookie } = require('cookie-parser'); // or cookieParser.signedCookie
Static methods are available on the `cookieParser` function itself; destructuring `require` is also possible.
const { JSONCookie } = require('cookie-parser'); // or cookieParser.JSONCookie
Demonstrates initializing `cookie-parser` with a secret, accessing `req.cookies` and `req.signedCookies`, and setting various types of cookies.
const express = require('express');
const cookieParser = require('cookie-parser');
const app = express();
const PORT = 3000;
const SECRET_KEY = process.env.COOKIE_SECRET || 'my-secret-key-for-signing';
app.use(cookieParser(SECRET_KEY));
app.get('/', (req, res) => {
// Access raw and signed cookies from the request
console.log('Raw Cookies:', req.cookies);
console.log('Signed Cookies:', req.signedCookies);
// Example of setting a regular and a signed cookie
res.cookie('regular', 'hello world', { maxAge: 900000, httpOnly: true });
res.cookie('signed', 'secret message', { maxAge: 900000, httpOnly: true, signed: true });
res.cookie('json_data', 'j:{"user":"test"}', { maxAge: 900000, httpOnly: true });
res.send('Check your console for cookie logs and browser for new cookies!\n' +
'Send a request with cookies like: curl http://localhost:3000 --cookie "Cho=Kim;Greet=Hello;signed=s%3Asecret%20message.hS7...;json_data=j%3A%7B%22user%22%3A%22test%22%7D"');
});
app.listen(PORT, () => {
console.log(`Server running on http://localhost:${PORT}`);
console.log('Remember to restart the server if you change COOKIE_SECRET environment variable.');
});
Upgrade
Version history
Breaking-change detection hasn't run for this library yet.
Audit
Security & dependencies
CVE tracking and dependency tree are planned for a later release.