index.js
function _getCookieToken (cookies, req, cookieName, cookieDomain, publicUrl) {
  let token = cookies.get(cookieName)
  if (!token) return null
  const reqOrigin = req.headers['origin']
  const originDomain = reqOrigin && new URL(reqOrigin).host

  // check that the origin of the request is part of the accepted domain
  if (reqOrigin && cookieDomain && originDomain !== cookieDomain && !originDomain.endsWith('.' + cookieDomain)) {
    debug(`A cookie was sent from origin ${reqOrigin} while cookie domain is ${cookieDomain}, ignore it`)
    return null
  }
  // or simply that it is strictly equal to current target if domain is unspecified
  // in this case we are also protected by sameSite
  if (reqOrigin && !cookieDomain && reqOrigin !== new URL(publicUrl).origin) {
    debug(`A cookie was sent from origin ${reqOrigin} while public url is ${publicUrl}, ignore it`)
    return null
  }

  // Putting the signature in a second token is recommended but optional
  // and we accept full JWT in id_token cooke
  const signature = cookies.get(cookieName + '_sign')
  if (signature && (token.match(/\./g) || []).length === 1) {
    token += '.' + signature
  }
  return token
}
function _getCookieToken (cookies, req, cookieName, cookieDomain, publicUrl) {
  let token = cookies.get(cookieName)
  if (!token) return null
  const reqOrigin = req.headers['origin']
  const originDomain = reqOrigin && new URL(reqOrigin).host

  // check that the origin of the request is part of the accepted domain
  if (reqOrigin && cookieDomain && originDomain !== cookieDomain && !originDomain.endsWith('.' + cookieDomain)) {
    debug(`A cookie was sent from origin ${reqOrigin} while cookie domain is ${cookieDomain}, ignore it`)
    return null
  }
  // or simply that it is strictly equal to current target if domain is unspecified
  // in this case we are also protected by sameSite
  if (reqOrigin && !cookieDomain && reqOrigin !== new URL(publicUrl).origin) {
    debug(`A cookie was sent from origin ${reqOrigin} while public url is ${publicUrl}, ignore it`)
    return null
  }

  // Putting the signature in a second token is recommended but optional
  // and we accept full JWT in id_token cooke
  const signature = cookies.get(cookieName + '_sign')
  if (signature && (token.match(/\./g) || []).length === 1) {
    token += '.' + signature
  }
  return token
}
function _getCookieToken ( cookies , req , cookieName , cookieDomain , publicUrl ) { let token = cookies . get ( cookieName ) if ( ! token ) return null const reqOrigin = req . headers [ 'origin' ] const originDomain = reqOrigin && new URL ( reqOrigin ) . host // check that the origin of the request is part of the accepted domain if ( reqOrigin && cookieDomain && originDomain !== cookieDomain && ! originDomain . endsWith ( '.' + cookieDomain ) ) { debug ( ` ${ reqOrigin } ${ cookieDomain } ` ) return null } // or simply that it is strictly equal to current target if domain is unspecified // in this case we are also protected by sameSite if ( reqOrigin && ! cookieDomain && reqOrigin !== new URL ( publicUrl ) . origin ) { debug ( ` ${ reqOrigin } ${ publicUrl } ` ) return null } // Putting the signature in a second token is recommended but optional // and we accept full JWT in id_token cooke const signature = cookies . get ( cookieName + '_sign' ) if ( signature && ( token . match ( / \. / g ) || [ ] ) . length === 1 ) { token += '.' + signature } return token }
Fetch a session token from cookies if the same site policy is respected
Fetch a session token from cookies if the same site policy is respected