Serverless-offline: Cookie with JSON string value considered invalid by Hapi/Statehood

[FreeWillaert]

I have a request with a cookie that has a JSON string as value.

In the statehood module, the cookies are validated (given that strictHeader appears to be true) against the 'internals.validateRx.valueRx.strict' regex:

/^[^\x00-\x20\"\,\;\\\x7F]*$

Obviously no JSON string will ever validate against this regex.

I fail to see what is going wrong or why... any help would be greatly appreciated.
If you consider this to be an issue with Hapi/statehood instead, please tell me then I will open an issue there.
Thanks!

[FreeWillaert]

Anyone...? Should I go ask Hapi guys instead?

[wheresrhys]

I just raised a duplicate *closed now). For the record, here's my description of the problem, with a solution:

By default hapi parses cookies, but the parser can error on strange cookie values (see hapijs/hapi#2513 for the issue, example bad cookie value:

{"eid":12345%2C"email":""%2C"hash":"abcde"%2C"level":"premium"%2C"name":"a%20Premium%20user"%2C"passportid":abcd1234%2C"username":"A%20user"%2C"uuid":"00000000-0000-0000-0000-00000000"%2C"signature":"1234\%2Fabcd\%2abcd="%2C"key":"v1"%2C"refreshed":1522855575})

The above cookie causes a {"statusCode":400,"error":"Bad Request","message":"Invalid cookie value"} response locally using serverless offline, but no such problem in production.

Would setting parse: false in the HAPI options used by serverless-offline provide better emulation of production lambda?

[wheresrhys]

@daniel-cottone I suggested that serverless-offline should set an option parse: false to
a) avoid the hapi issue
b) emulate apigateway more closely

How is this 'not a plugin issue'?

[petermorlion]

@wheresrhys @FreeWillaert There is no answer in this issue, but you can disable cookie validation by passing along --disableCookieValidation when you run serverless offline.

[sebastiangug]

@petermorlion this doesn't seem to work anymore.

Switching to 127.0.0.1:3000 when testing works but then you can't really use secure cookies as you can't sign a certificate for an IP address.

[petermorlion]

@michaelbats What version of serverless-offline and hapi are you using? We haven't encountered that yet, but we might still be on an older version.

[sebastiangug]

@petermorlion i'm on the latest currently :( will make a demo later on, for now I have disabled secure cookies in dev and SSL