Registry / http-networking / node-cookie

node-cookie

JSON →
library2.1.2jsnpmunverified

node-cookie is a utility library for Node.js environments, designed to simplify the parsing, signing, encryption, creation, and clearing of HTTP cookies. It directly interfaces with Node.js's built-in `http.IncomingMessage` and `http.ServerResponse` objects, making it agnostic to higher-level web frameworks. The current stable version is 2.1.2, which was last published over six years ago. Despite some recent activity on its GitHub repository (commits in 2022-2023), the package itself has not seen new releases, suggesting it is in an abandoned or very low-maintenance state. Its key differentiator is providing low-level, built-in cookie signing and encryption capabilities without requiring a full framework or complex middleware, directly leveraging Node.js crypto primitives.

http-networkingauth-securityserialization
github ↗package ↗
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

This package is primarily CommonJS-first. For ESM, a default import is likely needed, or direct property access after a default import. Named exports are not explicitly defined.

import nodeCookie from 'node-cookie'

`create` is a method of the default exported `nodeCookie` object, not a named export itself. Direct destructuring `import { create }` will not work with CommonJS `module.exports`.

import nodeCookie from 'node-cookie'; nodeCookie.create(res, 'key', 'value')

`parse` is a method of the default exported `nodeCookie` object. The package uses CommonJS `require` in its examples, indicating CJS as its primary module system.

const nodeCookie = require('node-cookie'); const cookies = nodeCookie.parse(req)

Similar to `create` and `parse`, `get` is accessed via the default `nodeCookie` object. Direct destructuring for `require` or `import` is not supported for these methods.

const nodeCookie = require('node-cookie'); const value = nodeCookie.get(req, 'key')

This quickstart demonstrates setting and retrieving signed and encrypted HTTP cookies using `node-cookie` with a basic Node.js HTTP server. It shows `create` for writing cookies with options for expiration, signing, and encryption, and `parse` and `get` for reading them, also handling decryption and unsigning.

const http = require('http'); const nodeCookie = require('node-cookie'); const SECRET = process.env.COOKIE_SECRET ?? 'supersecretkeyfornodejsapp'; http.createServer(function (req, res) { if (req.url === '/set-cookie') { // Create a signed and encrypted cookie nodeCookie.create(res, 'userSession', 'user123', { expires: new Date(Date.now() + 60 * 60 * 1000) }, SECRET, true); nodeCookie.create(res, 'lastVisit', new Date().toISOString(), SECRET, false); res.writeHead(200, { 'Content-Type': 'text/plain' }); res.end('Cookies set!'); } else if (req.url === '/get-cookie') { // Parse and retrieve cookies const parsedCookies = nodeCookie.parse(req, SECRET, true); const userSession = nodeCookie.get(req, 'userSession', SECRET, true); const lastVisit = nodeCookie.get(req, 'lastVisit', SECRET, false); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ parsedCookies, userSession: userSession || 'Not found or invalid', lastVisit: lastVisit || 'Not found or invalid' })); } else { res.writeHead(200, { 'Content-Type': 'text/html' }); res.end('<h1>Visit /set-cookie to set, or /get-cookie to retrieve.</h1>'); } }).listen(3000, () => { console.log('Server running on http://localhost:3000'); console.log('Try http://localhost:3000/set-cookie then http://localhost:3000/get-cookie'); });
Debug
Known footguns
breakingThe package is explicitly CommonJS and uses `require`. Attempting to `import` it in a pure ESM context might lead to issues or require specific Node.js interoperability configurations (e.g., `createRequire`). Node.js ESM loader will treat `require('node-cookie')` as a default export, but explicit named imports are not supported.
gotchaUsing a weak or hardcoded secret for signing and encryption (e.g., directly in source code) makes cookies vulnerable to tampering and decryption. The secret must be sufficiently long and complex, and should be managed securely (e.g., via environment variables).
gotchaCookies might not be set in the browser if `secure: true` is used when serving over HTTP, or if `domain` or `path` options are misconfigured. Browsers strictly enforce these attributes.
deprecatedThis package has not been updated in over six years (last published version 2.1.2). It may not receive security updates or be compatible with future Node.js versions or evolving web standards (e.g., `SameSite=None; Secure;` requirements).
Upgrade
Version history

Breaking-change detection hasn't run for this library yet.

Audit
Security & dependencies

CVE tracking and dependency tree are planned for a later release.

Agent activity
0 hits · last 30 days

No traffic data recorded yet.

Resources
githubhttps://github.com/poppinss/node-cookie ↗
packagehttps://www.npmjs.com/package/node-cookie ↗