tough-cookie jar round trip: working versions (tested 2026-10-16)

{
  "name": "tough-cookie-jar",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "tough-cookie": "6.0.2"
  },
  "devDependencies": {
    "@types/node": "26.6.5",
    "tsx": "4.23.15"
  }
}

import { CookieJar, type Cookie } from "tough-cookie";

export function createJar(): CookieJar {
  return new CookieJar();
}

export async function setCookie(jar: CookieJar, rawUrl: string, cookie: string): Promise<Cookie> {
  return jar.setCookie(cookie, rawUrl, { http: false });
}

export function domainMatches(hostname: string, cookieDomain: string | null | undefined): boolean {
  if (!cookieDomain) {
    return false;
  }
  const host = hostname.toLowerCase().replace(/^\./, "");
  const domain = cookieDomain.toLowerCase().replace(/^\./, "");
  if (host === domain) {
    return true;
  }
  return host.endsWith(`.${domain}`);
}

export async function getCookiesForUrl(jar: CookieJar, rawUrl: string): Promise<Cookie[]> {
  const { hostname } = new URL(rawUrl);
  const cookies = await jar.getCookies(rawUrl);
  return cookies.filter((cookie) => domainMatches(hostname, cookie.domain));
}

export async function serializeJar(jar: CookieJar): Promise<string> {
  return JSON.stringify(await jar.serialize());
}

export async function deserializeJar(json: string): Promise<CookieJar> {
  const parsed = JSON.parse(json);
  return CookieJar.deserialize(parsed);
}

export async function expireCookie(jar: CookieJar, rawUrl: string, name: string): Promise<void> {
  const expired = `${name}=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=/`;
  await jar.setCookie(expired, rawUrl, { http: false });
}

import { test } from "node:test";
import assert from "node:assert/strict";
import {
  createJar,
  deserializeJar,
  domainMatches,
  expireCookie,
  getCookiesForUrl,
  serializeJar,
  setCookie,
} from "../src/jar.ts";

test("sets and reads a cookie for a URL", async () => {
  const jar = createJar();
  await setCookie(jar, "https://example.com/", "session=abc123; Path=/");
  const cookies = await getCookiesForUrl(jar, "https://example.com/dashboard");
  assert.equal(cookies.length, 1);
  assert.equal(cookies[0]?.value, "abc123");
});

test("does not leak cookies across domains", async () => {
  const jar = createJar();
  await setCookie(jar, "https://example.com/", "session=abc123; Path=/");
  const cookies = await getCookiesForUrl(jar, "https://other.com/");
  assert.deepEqual(cookies, []);
});

test("rejects a cookie whose domain does not match the URL", async () => {
  const jar = createJar();
  await assert.rejects(
    setCookie(jar, "https://other.com/", "session=abc123; Domain=example.com; Path=/"),
  );
});

test("domainMatches is case insensitive and covers subdomains", () => {
  assert.equal(domainMatches("app.example.com", "example.com"), true);
  assert.equal(domainMatches("example.com", "example.com"), true);
  assert.equal(domainMatches("example.com", ".example.com"), true);
  assert.equal(domainMatches("notexample.com", "example.com"), false);
  assert.equal(domainMatches("badexample.com", "ample.com"), false);
  assert.equal(domainMatches("example.com", "other.com"), false);
  assert.equal(domainMatches("example.com", null), false);
});

test("round trips a jar through JSON", async () => {
  const jar = createJar();
  await setCookie(jar, "https://example.com/", "session=abc123; Path=/");
  const json = await serializeJar(jar);

  const restored = await deserializeJar(json);
  const cookies = await getCookiesForUrl(restored, "https://example.com/");
  assert.equal(cookies.length, 1);
  assert.equal(cookies[0]?.value, "abc123");
});

test("expiring a cookie removes it from the jar", async () => {
  const jar = createJar();
  await setCookie(jar, "https://example.com/", "session=abc123; Path=/");
  await expireCookie(jar, "https://example.com/", "session");
  const cookies = await getCookiesForUrl(jar, "https://example.com/");
  assert.deepEqual(cookies, []);
});