Why does express-session create an array for Set-Cookie?

user_169992 0
Viewed 148

What is this doing in express-session source code:

function setcookie(res, name, val, secret, options) {
  var signed = 's:' + signature.sign(val, secret);
  var data = cookie.serialize(name, signed, options);

  var prev = res.getHeader('Set-Cookie') || []
  var header = Array.isArray(prev) ? prev.concat(data) : [prev, data];

  res.setHeader('Set-Cookie', header)
}

Specifically:

  var prev = res.getHeader('Set-Cookie') || []
  var header = Array.isArray(prev) ? prev.concat(data) : [prev, data];

When would the situation arise where you already wrote the cookie to the response header, and then need to make it an array of some sort? What is happening here, and why?

express session cookies
1 Answers

There can be multiple Set-Cookie headers present on the same response. And, res.setHeader(name, data) accepts an array for the data in order to specify multiple repeated values for the same header.

So, in order to "add" another header, this code gets the current header value (if any). If that value is already an array, then it just adds the new value to that array. If it's not already an array (e.g. only has a single value), then it puts the existing value and the new value into an array and calls res.setHeader(name, data) where data is now an array of values.

This is required because res.setHeader() when called for a specific name does not "add" a new value for that name - instead it replaces any existing values with that name. So, to add a new value, it has to get the existing value(s), make sure they are in an array, add the new value to the array and then set the new value as the array.

So, this line:

var prev = res.getHeader('Set-Cookie') || []

makes the default value be an empty array in case there was no existing 'Set-Cookie' header.

Then, this line:

var header = Array.isArray(prev) ? prev.concat(data) : [prev, data];

checks if the value we just got was already an array. If so, it concats the new value(s) to that array. If not (it must have just been a single value), it then combines the previous single value with the new value into an array. So, all code paths then have an array with the new value at the end of the array and any previous values at the start of the array. It can then call res.setHeader() with that array and replace all previous values with the combination of the previous values and any new values.

This code would come into use with just something like this:

res.setHeader('Set-Cookie', 'color=blue');
res.setHeader('Set-Cookie', 'shape=square');

The result of this code would be that Set-Cookie would have two values 'color=blue' and 'shape=square'. And, when the response is actually sent, it would construct two separate Set-Cookie headers each with one of these values.

user_8166200
Related