0

I'm setting a cookie in my node server code using the following:

let userid = db._id  //console.log shows the id as :  abc123456789d
res.cookie("uid", userid , { sameSite: "none", secure: true })

Is this the right way or am I doing anything wrong?

in my front application I use js to get the cookie using the following code :

let x =  document.cookie
  let cookie = getCookie("uid")
  console.log("cookies value:",cookie)

the console log shows the cookie value as this :

j%3A%abc123456789d%22

I tried to set the cookie with JSON.stringify() and the front is showing the cookie value as this:

%3A%abc123456789d%22

My question is why I don't get the value without the % value %22 and how to correct this output so I get the value of the id as id that I get from the db which should be

abc123456789d

Note that the id I mentioned here is just for demonstration purpose only and doesn't exist in real life. The id I get back from my db is 48 character with just letters and numbers (no special character, something like 666de2f0600eda239ae05d88)

It's my first time I try to get a cookie value using js so it seems that I'm missing something and after reading online, I can't figure out why this % %22 surround my id. Any idea why and how to fix it?

Marco
  • 1,051
  • 19
  • 41
  • 1
    unescape? anyway `and doesn't exist in real life` is obvous, since a `j` disappeared, and the unescaped value of what you presented would be `:«c123456789d"` including that quote ... so - yeah, `unescape` is what you need to use – Jaromanda X Jul 02 '21 at 00:01
  • 1
    oh, and if your cookie value has `%22` in it, it's because the value is being set with the `"` (that's what a %22 is) as part of the value - I'd check the code that sets the cookie for obvious errors – Jaromanda X Jul 02 '21 at 00:08
  • What's the code for `getCookie`? – msbit Jul 02 '21 at 01:05
  • msbit : it is %3A%abc123456789d%22 – Marco Jul 02 '21 at 01:21
  • csx.cc suggested decodeURIComponent() and I added split and now I get "abc123456789d" -- I just need to get rid of " " and I will have the value of the id. How to get rid of "" around the id value? Any suggestion? – Marco Jul 02 '21 at 01:22
  • No, I meant what's the code for the `getCookie` function. `j%3A%abc123456789d%22` is the value that this function returns. – msbit Jul 02 '21 at 01:52

2 Answers2

0

my guess is missing URI decode/encode

The decodeURIComponent() function decodes a Uniform Resource Identifier (URI) component previously created by encodeURIComponent or by a similar routine.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/decodeURIComponent

csx.cc
  • 56
  • 2
  • 5
  • Thank you. it gave me the output without the % %22 so I have the output as "abc123456789d" how to get rid of the " " around the value? Any suggestion? – Marco Jul 02 '21 at 01:24
0

I ended up with this :

 let x =  document.cookie
 let decodit = decodeURIComponent(x).split(":").toString()
  let sliceit = decodit.slice(7, 31)

Thanks csx.cc ...your answer led me in the right direction.

I'm using express and cookie parser. After reading about how they encode the cookie, I found an answer on stackoverflow.com and here is the answer (I upvoted the answer and anyone reading this should do the same. Link to the answer at the end)

Note on external libraries: If you decide to use the express, cookie-parser, or cookie, note they have defaults that are non-standard. Cookies parsed are always URI Decoded (percent-decoded). That means if you use a name or value that has any of the following characters: !#$%&'()*+/:<=>?@[]^`{|} they will be handled differently with those libraries. If you're setting cookies, they are encoded with %{HEX}. And if you're reading a cookie you have to decode them.

For example, while email=name@domain.com is a valid cookie, these libraries will encode it as email=name%40domain.com. Decoding can exhibit issues if you are using the % in your cookie. It'll get mangled. For example, your cookie that was: secretagentlevel=50%007and50%006 becomes secretagentlevel=507and506. That's an edge case, but something to note if switching libraries.

Also, on these libraries, cookies are set with a default path=/ which means they are sent on every url request to the host.

If you want to encode or decode these values yourself, you can use encodeURIComponent or decodeURIComponent, respectively.

Answer by ShortFuse: Get and Set a Single Cookie with Node.js HTTP Server

Marco
  • 1,051
  • 19
  • 41