From 64f9cd17e13f94fd8a38aa80febdb86c4a36396b Mon Sep 17 00:00:00 2001 From: Yarchik Date: Thu, 9 Jul 2026 12:23:17 +0100 Subject: [PATCH] fix: reject unsafe-integer maxAge in stringifySetCookie Number.isInteger accepts values >= 1e21, which String() renders in exponential notation (e.g. 1e+21), producing an invalid Max-Age that violates the RFC 6265 grammar (max-age-value = 1*DIGIT). Use Number.isSafeInteger so the emitted value is always a plain integer. --- src/index.ts | 2 +- src/stringify-set-cookie.spec.ts | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/src/index.ts b/src/index.ts index 23fe8ea..fbd231d 100644 --- a/src/index.ts +++ b/src/index.ts @@ -301,7 +301,7 @@ export function stringifySetCookie( let str = cookie.name + "=" + value; if (cookie.maxAge !== undefined) { - if (!Number.isInteger(cookie.maxAge)) { + if (!Number.isSafeInteger(cookie.maxAge)) { throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`); } diff --git a/src/stringify-set-cookie.spec.ts b/src/stringify-set-cookie.spec.ts index f4e9cd4..e709e63 100644 --- a/src/stringify-set-cookie.spec.ts +++ b/src/stringify-set-cookie.spec.ts @@ -181,6 +181,7 @@ describe("cookie.stringifySetCookie", () => { ["non-number", "buzz"], ["Infinity", Infinity], ["non-integer", 3.14], + ["unsafe integer", 1e21], ])("should throw when maxAge is %s", (_label, maxAge) => { expect(() => stringifySetCookie({ name: "foo", value: "bar", maxAge } as any),