fix: [v20.1] session cookie parsing optimizations

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [unreleased]
 
+## [20.1.7] - 2025-06-17
+
+-   Refactors internal logic of parsing cookies to check accessToken and optimizes it to avoid parsing unrelated cookies.
+
 ## [20.1.6] - 2024-11-26
 
 -   Fixes an issue where `removeDevice` API allowed removing verifiedTOTP devices without the user completing MFA.

lib/build/recipe/session/cookieAndHeaders.js

@@ -253,15 +253,17 @@ function parseCookieStringFromRequestHeaderAllowingDuplicates(cookieString) {
     const cookies = {};
     const cookiePairs = cookieString.split(";");
     for (const cookiePair of cookiePairs) {
-        const [name, value] = cookiePair
-            .trim()
-            .split("=")
-            .map((part) => decodeURIComponent(part));
-        if (cookies.hasOwnProperty(name)) {
-            cookies[name].push(value);
-        } else {
-            cookies[name] = [value];
+        const [name, value] = cookiePair.trim().split("=");
+        // Try to decode the name or fallback to the original name
+        let decodedName = name;
+        try {
+            decodedName = decodeURIComponent(name);
+        } catch (e) {
+            logger_1.logDebugMessage(
+                `parseCookieStringFromRequestHeaderAllowingDuplicates: Error decoding cookie name: ${name}`
+            );
         }
+        cookies.hasOwnProperty(decodedName) ? cookies[decodedName].push(value) : (cookies[decodedName] = [value]);
     }
     return cookies;
 }

lib/ts/recipe/session/cookieAndHeaders.ts

@@ -303,16 +303,19 @@ function parseCookieStringFromRequestHeaderAllowingDuplicates(cookieString: stri
     const cookiePairs = cookieString.split(";");
 
     for (const cookiePair of cookiePairs) {
-        const [name, value] = cookiePair
-            .trim()
-            .split("=")
-            .map((part) => decodeURIComponent(part));
-
-        if (cookies.hasOwnProperty(name)) {
-            cookies[name].push(value);
-        } else {
-            cookies[name] = [value];
+        const [name, value] = cookiePair.trim().split("=");
+
+        // Try to decode the name or fallback to the original name
+        let decodedName = name;
+        try {
+            decodedName = decodeURIComponent(name);
+        } catch (e) {
+            logDebugMessage(
+                `parseCookieStringFromRequestHeaderAllowingDuplicates: Error decoding cookie name: ${name}`
+            );
         }
+
+        cookies.hasOwnProperty(decodedName) ? cookies[decodedName].push(value) : (cookies[decodedName] = [value]);
     }
 
     return cookies;

lib/ts/version.ts

@@ -12,7 +12,7 @@
  * License for the specific language governing permissions and limitations
  * under the License.
  */
-export const version = "20.1.6";
+export const version = "20.1.7";
 
 export const cdiSupported = ["5.1"];
 

package.json

@@ -1,6 +1,6 @@
 {
     "name": "supertokens-node",
-    "version": "20.1.6",
+    "version": "20.1.7",
     "description": "NodeJS driver for SuperTokens core",
     "main": "index.js",
     "scripts": {