cookie

Parses the Cookie request header into an RFC 6265-compliant cookie jar. The jar uses dual storage: incoming cookies are accessible as own properties; outgoing cookies are managed via set() and serialized by toHeader() into Set-Cookie headers.

Pipeline stage: Negotiation

Import

import {cookie} from '@centralping/ergo';

Options

Option	Type	Default	Description
`options`	`object`	—	Forwarded to the RFC 6265 parser (e.g., `{max: 50}` for cookie count limit)

Return Value

Returns a cookie jar stored on the domain accumulator at acc.cookies:

acc.cookies.session    // "abc123" (incoming cookie, own property)
acc.cookies.set(name, value, directives)  // queue outgoing cookie
acc.cookies.toHeader() // ["session=abc123; HttpOnly; Secure", ...]

Jar Methods

Method	Description
`set(name, value, directives)`	Queue an outgoing cookie with optional directives
`get(name)`	Get an outgoing cookie object
`clear(name)`	Clear an outgoing cookie
`toHeader()`	Serialize all outgoing cookies to `Set-Cookie` header values

Security

Cookie values are validated against RFC 6265 cookie-octet grammar
Cookie names must be valid HTTP tokens (RFC 9110 §5.6.2)
Domain values are validated against the subdomain grammar (RFC 1034/RFC 1123)
Path values are validated against the path-value production (any character except CTLs or semicolons)
SameSite values must be Strict, Lax, or None (case-insensitive, per the RFC 6265bis Internet-Draft)
Names that collide with jar methods are silently dropped
Null-prototype parsing prevents prototype pollution

Error Responses

None.

import {compose, cookie} from '@centralping/ergo';

const pipeline = compose(
  cookie(),
  (req, res, acc) => {
    const session = acc.cookies.session;
    acc.cookies.set('visited', 'true', {
      httpOnly: true,
      sameSite: 'Strict',
    });
    return {response: {body: {session}}};
  },
);

router.get('/dashboard', {
  cookie: {},
  execute: (req, res, acc) => ({
    response: {body: {session: acc.cookies.session}},
  }),
});

RFC References

API Reference

See the auto-generated cookie API docs.