Skip to content

Conversation

@dmurvihill
Copy link

@dmurvihill dmurvihill commented Aug 26, 2025

Add a convenient workflow for running assertions on cookie headers returned by the server. This code is largely copied from Gregory Langlais' package expect-cookies (MIT License).

Implements #855.

Example usage:

const request = require('supertest');
const cookies = request.cookies;

request(app)
  .get('/users')
  .expect('Content-Type', /json/)
  .expect('Content-Length', '15')
  .expect(200)
  // assert 'alpha' cookie is set with domain, path, and httpOnly options
  .expect(cookies.set({ name: 'alpha', options: ['domain', 'path', 'httponly'] }))
  // assert 'bravo' cookie is NOT set
  .expect(cookies.not('set', { name: 'bravo' }))
  .end(function(err, res) {
    if (err) {
      throw err;
    }
  });

Supports:

  • .set - Assert that cookie and options are set.
  • .reset - Assert that cookie is set and was already set (in request headers).
  • .new - Assert that cookie is set and was NOT already set (NOT in request headers).
  • .renew - Assert that cookie is set with a strictly greater expires or max-age than the given value.
  • .contain - Assert that cookie is set with value and contains options.
  • .not - Call any cookies assertion method with "assert true" modifier set to false.

Checklist

  • I have ensured my pull request is not behind the main or master branch of the original repository.
  • I have rebased all commits where necessary so that reviewing this pull request can be done without having to merge it first.
  • I have written a commit message that passes commitlint linting.
  • I have ensured that my code changes pass linting tests.
  • I have ensured that my code changes pass unit tests.
  • I have described my pull request and the reasons for code changes along with context if necessary.

@titanism
Copy link
Collaborator

Can you fix the merge conflict?

Add a convenient workflow for running assertions on cookie headers
returned by the server. This code is largely copied from Gregory
Langais' package `expect-cookie` (MIT License).

Example usage:
```js
const request = require('supertest');
const cookies = request.cookies;

request(app)
  .get('/users')
  .expect('Content-Type', /json/)
  .expect('Content-Length', '15')
  .expect(200)
  // assert 'alpha' cookie is set with domain, path, and httpOnly options
  .expect(cookies.set({ name: 'alpha', options: ['domain', 'path', 'httponly'] }))
  // assert 'bravo' cookie is NOT set
  .expect(cookies.not('set', { name: 'bravo' }))
  .end(function(err, res) {
    if (err) {
      throw err;
    }
  });
```

Supports:
- `.set` - Assert that cookie and options are set.
- `.reset` - Assert that cookie is set and was already set (in request
  headers).
- `.new` - Assert that cookie is set and was NOT
  already set (NOT in request headers).
- `.renew` - Assert that cookie is set with a strictly greater `expires`
  or `max-age` than the given value.
- `.contain` - Assert that cookie is set with value and contains
  options.
- `.not` - Call any cookies assertion method with "assert true" modifier
  set to `false`.

feat(cookies): add cookie assertions

Add a convenient workflow for running assertions on cookie headers
returned by the server. This code is largely copied from Gregory
Langais' package `expect-cookies` (MIT License).

Example usage:
```js
const request = require('supertest');
const cookies = request.cookies;

request(app)
  .get('/users')
  .expect('Content-Type', /json/)
  .expect('Content-Length', '15')
  .expect(200)
  // assert 'alpha' cookie is set with domain, path, and httpOnly options
  .expect(cookies.set({ name: 'alpha', options: ['domain', 'path', 'httponly'] }))
  // assert 'bravo' cookie is NOT set
  .expect(cookies.not('set', { name: 'bravo' }))
  .end(function(err, res) {
    if (err) {
      throw err;
    }
  });
```

Supports:
- `.set` - Assert that cookie and options are set.
- `.reset` - Assert that cookie is set and was already set (in request
  headers).
- `.new` - Assert that cookie is set and was NOT
  already set (NOT in request headers).
- `.renew` - Assert that cookie is set with a strictly greater `expires`
  or `max-age` than the given value.
- `.contain` - Assert that cookie is set with value and contains
  options.
- `.not` - Call any cookies assertion method with "assert true" modifier
  set to `false`.
@socket-security
Copy link

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedcookie-signature@​1.2.21001006881100
Addedsinon@​20.0.0991009887100

View full report

@dmurvihill
Copy link
Author

Fixed. Sorry, not sure how that happened.

@dmurvihill
Copy link
Author

Everything look ok now?

Copy link

@A1exKH A1exKH left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants