Merge pull request #479 from vtex/fix/session-cookie/3.x

[3.x] Fix / Janus / Extract session cookie in a safe manner

Author: valentino-amadeus

CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [3.77.3] - 2021-10-22
+### Fixed
+- Extract session cookie in a safe manner
+
+## [3.77.2] - 2021-08-26
+### Fixed
+- Extract session cookie in a safe manner
+
 ## [3.77.1] - 2021-02-05
 - Increase HTTP agents connection pools freeSockets and lifetime
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtex/api",
-  "version": "3.77.2",
+  "version": "3.77.3",
   "description": "VTEX I/O API client",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",

src/clients/Segment.ts

@@ -1,8 +1,8 @@
-import parseCookie from 'cookie'
 import { prop } from 'ramda'
 
 import { PRODUCT_HEADER } from '../constants'
 import { inflightUrlWithQuery, JanusClient } from '../HttpClient'
+import { extractSessionCookie } from './Session'
 
 export interface SegmentData {
   campaigns?: any
@@ -19,7 +19,6 @@ export interface SegmentData {
   [key: string]: any
 }
 
-const SEGMENT_COOKIE = 'vtex_segment'
 const SEGMENT_MAX_AGE_S = 60 * 60 // 60 minutes - segment is actually immutable
 const ALLOWED_QUERY_PREFIXES = ['utm', 'cultureInfo', 'supportedLocales']
 
@@ -71,15 +70,11 @@ export class Segment extends JanusClient {
   public getOrCreateSegment = async (query?: Record<string, string>, token?: string) => {
     const {
       data: segmentData,
-      headers: {
-        'set-cookie': [setCookies],
-      },
+      headers,
     } = await this.rawSegment(token, query)
-    const parsedCookie = parseCookie.parse(setCookies)
-    const segmentToken = prop(SEGMENT_COOKIE, parsedCookie)
     return {
       segmentData,
-      segmentToken,
+      segmentToken: extractSessionCookie(headers) || token,
     }
   }
 

src/clients/Session.ts

@@ -51,7 +51,7 @@ export class Session extends JanusClient {
   }
 }
 
-function extractSessionCookie(headers: Record<string, string>) {
+export function extractSessionCookie(headers: Record<string, string>) {
   for (const setCookie of headers['set-cookie'] || []) {
     const parsedCookie = parseCookie.parse(setCookie)
     const sessionCookie = parsedCookie[SESSION_COOKIE]