Skip to content

Add cookie assertions framework - #868

Merged
titanism merged 1 commit into
forwardemail:masterfrom
dmurvihill:cookie-assertions
Dec 29, 2025
Merged

Add cookie assertions framework#868
titanism merged 1 commit into
forwardemail:masterfrom
dmurvihill:cookie-assertions

Conversation

@dmurvihill

@dmurvihill dmurvihill commented Aug 26, 2025

Copy link
Copy Markdown
Contributor

Add a convenient workflow for running assertions on cookie headers returned by the server. This code is largely copied from Gregory Langlais' package expect-cookies (MIT License).

Implements #855.

Example usage:

const request = require('supertest');
const cookies = request.cookies;

request(app)
  .get('/users')
  .expect('Content-Type', /json/)
  .expect('Content-Length', '15')
  .expect(200)
  // assert 'alpha' cookie is set with domain, path, and httpOnly options
  .expect(cookies.set({ name: 'alpha', options: ['domain', 'path', 'httponly'] }))
  // assert 'bravo' cookie is NOT set
  .expect(cookies.not('set', { name: 'bravo' }))
  .end(function(err, res) {
    if (err) {
      throw err;
    }
  });

Supports:

  • .set - Assert that cookie and options are set.
  • .reset - Assert that cookie is set and was already set (in request headers).
  • .new - Assert that cookie is set and was NOT already set (NOT in request headers).
  • .renew - Assert that cookie is set with a strictly greater expires or max-age than the given value.
  • .contain - Assert that cookie is set with value and contains options.
  • .not - Call any cookies assertion method with "assert true" modifier set to false.

Checklist

  • I have ensured my pull request is not behind the main or master branch of the original repository.
  • I have rebased all commits where necessary so that reviewing this pull request can be done without having to merge it first.
  • I have written a commit message that passes commitlint linting.
  • I have ensured that my code changes pass linting tests.
  • I have ensured that my code changes pass unit tests.
  • I have described my pull request and the reasons for code changes along with context if necessary.

@titanism

Copy link
Copy Markdown
Collaborator

Can you fix the merge conflict?

Add a convenient workflow for running assertions on cookie headers
returned by the server. This code is largely copied from Gregory
Langais' package `expect-cookie` (MIT License).

Example usage:
```js
const request = require('supertest');
const cookies = request.cookies;

request(app)
  .get('/users')
  .expect('Content-Type', /json/)
  .expect('Content-Length', '15')
  .expect(200)
  // assert 'alpha' cookie is set with domain, path, and httpOnly options
  .expect(cookies.set({ name: 'alpha', options: ['domain', 'path', 'httponly'] }))
  // assert 'bravo' cookie is NOT set
  .expect(cookies.not('set', { name: 'bravo' }))
  .end(function(err, res) {
    if (err) {
      throw err;
    }
  });
```

Supports:
- `.set` - Assert that cookie and options are set.
- `.reset` - Assert that cookie is set and was already set (in request
  headers).
- `.new` - Assert that cookie is set and was NOT
  already set (NOT in request headers).
- `.renew` - Assert that cookie is set with a strictly greater `expires`
  or `max-age` than the given value.
- `.contain` - Assert that cookie is set with value and contains
  options.
- `.not` - Call any cookies assertion method with "assert true" modifier
  set to `false`.

feat(cookies): add cookie assertions

Add a convenient workflow for running assertions on cookie headers
returned by the server. This code is largely copied from Gregory
Langais' package `expect-cookies` (MIT License).

Example usage:
```js
const request = require('supertest');
const cookies = request.cookies;

request(app)
  .get('/users')
  .expect('Content-Type', /json/)
  .expect('Content-Length', '15')
  .expect(200)
  // assert 'alpha' cookie is set with domain, path, and httpOnly options
  .expect(cookies.set({ name: 'alpha', options: ['domain', 'path', 'httponly'] }))
  // assert 'bravo' cookie is NOT set
  .expect(cookies.not('set', { name: 'bravo' }))
  .end(function(err, res) {
    if (err) {
      throw err;
    }
  });
```

Supports:
- `.set` - Assert that cookie and options are set.
- `.reset` - Assert that cookie is set and was already set (in request
  headers).
- `.new` - Assert that cookie is set and was NOT
  already set (NOT in request headers).
- `.renew` - Assert that cookie is set with a strictly greater `expires`
  or `max-age` than the given value.
- `.contain` - Assert that cookie is set with value and contains
  options.
- `.not` - Call any cookies assertion method with "assert true" modifier
  set to `false`.
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedcookie-signature@​1.2.21001006881100
Addedsinon@​20.0.0991009887100

View full report

@dmurvihill

Copy link
Copy Markdown
Contributor Author

Fixed. Sorry, not sure how that happened.

@dmurvihill

Copy link
Copy Markdown
Contributor Author

Everything look ok now?

@A1exKH A1exKH left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@titanism
titanism merged commit 953eca7 into forwardemail:master Dec 29, 2025
2 checks passed
@dmurvihill
dmurvihill deleted the cookie-assertions branch December 29, 2025 21:20
@dmurvihill

Copy link
Copy Markdown
Contributor Author

Cheers!

@titanism

titanism commented Jan 6, 2026

Copy link
Copy Markdown
Collaborator

v7.2.0 published to npm

https://github.com/forwardemail/supertest/releases/tag/v7.2.0

please consider supporting our maintenance efforts by becoming a @forwardemail user! **sign up at https://forwardemail.net and use coupon code GITHUB for 100% off 🙏 **

@valerii-kuzivanov

Copy link
Copy Markdown

import request from 'supertest';

const cookies = request.cookies;
// Property 'cookies' does not exist on type 'SuperTestStatic'.

looks like typing is missing here

@dmurvihill

Copy link
Copy Markdown
Contributor Author

This package doesn't come with types. Try @types/supertest.

@dmurvihill

dmurvihill commented Feb 26, 2026

Copy link
Copy Markdown
Contributor Author

Types have been merged into DefinitelyTyped.

npm i -D @types/supertest@^7.2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants