fix: do not use mounted app's ctx.cookies

using ctx.cookies means cookie keys from the parent app need to be the
same, this fix removes that requirement

closes #517

lib/actions/authorization/interactions.js

@@ -119,13 +119,13 @@ module.exports = async function interactions(resumeRouteName, ctx, next) {
 
   const destination = await interactionUrl(ctx, interactionSession);
 
-  ctx.cookies.set(
+  ctx.oidc.cookies.set(
     oidc.provider.cookieName('interaction'),
     oidc.uid,
     { path: url.parse(destination).pathname, ...cookieOptions },
   );
 
-  ctx.cookies.set(
+  ctx.oidc.cookies.set(
     oidc.provider.cookieName('resume'),
     oidc.uid,
     { ...cookieOptions, path: url.parse(returnTo).pathname },

lib/actions/authorization/resume.js

@@ -18,7 +18,7 @@ module.exports = async function resumeAction(whitelist, resumeRouteName, ctx, ne
     'expires',
   );
 
-  const cookieId = ctx.cookies.get(ctx.oidc.provider.cookieName('resume'), cookieOptions);
+  const cookieId = ctx.oidc.cookies.get(ctx.oidc.provider.cookieName('resume'), cookieOptions);
   if (!cookieId || cookieId !== ctx.oidc.uid) {
     throw new errors.SessionNotFound('authorization request has expired');
   }
@@ -68,7 +68,7 @@ module.exports = async function resumeAction(whitelist, resumeRouteName, ctx, ne
       ...(ctx.params.user_code ? { user_code: ctx.params.user_code } : undefined),
     })).pathname,
   };
-  ctx.cookies.set(ctx.oidc.provider.cookieName('resume'), null, clearOpts);
+  ctx.oidc.cookies.set(ctx.oidc.provider.cookieName('resume'), null, clearOpts);
 
   if (result && result.error) {
     const className = upperFirst(camelCase(result.error));

lib/actions/end_session.js

@@ -186,12 +186,12 @@ module.exports = {
           if (cookies) {
             cookies.forEach((val) => {
               const name = val.slice(0, -1);
-              if (!name.endsWith('.sig')) ctx.cookies.set(name, null, opts);
+              if (!name.endsWith('.sig')) ctx.oidc.cookies.set(name, null, opts);
             });
           }
         }
 
-        ctx.cookies.set(ctx.oidc.provider.cookieName('session'), null, opts);
+        ctx.oidc.cookies.set(ctx.oidc.provider.cookieName('session'), null, opts);
       } else if (state.clientId) {
         const grantId = session.grantIdFor(state.clientId);
         if (grantId) {
@@ -204,7 +204,7 @@ module.exports = {
           delete session.authorizations[state.clientId];
         }
         if (sessionManagement.enabled) {
-          ctx.cookies.set(`${ctx.oidc.provider.cookieName('state')}.${state.clientId}`, null, opts);
+          ctx.oidc.cookies.set(`${ctx.oidc.provider.cookieName('state')}.${state.clientId}`, null, opts);
         }
         session.resetIdentifier();
       }

lib/helpers/oidc_context.js

@@ -19,6 +19,7 @@ const resolveResponseMode = require('./resolve_response_mode');
 
 module.exports = function getContext(provider) {
   const { clockTolerance, features: { dPoP: dPoPConfig } } = instance(provider).configuration();
+  const { app } = provider;
 
   class OIDCContext extends events.EventEmitter {
     constructor(ctx) {
@@ -31,6 +32,7 @@ module.exports = function getContext(provider) {
       this.uid = (ctx.params && ctx.params.uid) || nanoid();
       this.entities = {};
       this.claims = {};
+      this.cookies = app.createContext(ctx.req, ctx.res).cookies;
     }
 
     get issuer() { // eslint-disable-line class-methods-use-this

lib/helpers/process_session_state.js

@@ -5,7 +5,7 @@ const base64url = require('./base64url');
 const instance = require('./weak_cache');
 
 function processSessionState(ctx, redirectUri, salt) {
-  const { oidc: { session, client }, cookies } = ctx;
+  const { oidc: { session, client, cookies } } = ctx;
   const parsed = new URL(redirectUri);
   const { origin } = parsed;
 

lib/provider.js

@@ -24,10 +24,6 @@ const { SessionNotFound } = require('./helpers/errors');
 const models = require('./models');
 const nanoid = require('./helpers/nanoid');
 
-function getCookie(name, opts, cookies) {
-  return cookies.get(name, opts);
-}
-
 function assertReqRes(req, res) {
   assert(
     req instanceof IncomingMessage || req instanceof Http2ServerRequest,
@@ -43,10 +39,10 @@ function assertReqRes(req, res) {
 
 async function getInteraction(req, res) {
   assertReqRes.apply(undefined, arguments); // eslint-disable-line prefer-spread, prefer-rest-params
-  const { cookies } = this.app.createContext(req, res);
-  const id = getCookie.call(this, this.cookieName('interaction'), {
+  const ctx = this.app.createContext(req, res);
+  const id = ctx.cookies.get(this.cookieName('interaction'), {
     signed: instance(this).configuration('cookies.short.signed'),
-  }, cookies);
+  });
   if (!id) {
     throw new SessionNotFound('interaction session id cookie not found');
   }

lib/shared/session.js

@@ -27,7 +27,7 @@ module.exports = async function sessionHandler(ctx, next) {
 
     // refresh the session duration
     if ((!ctx.oidc.session.new || ctx.oidc.session.touched) && !ctx.oidc.session.destroyed) {
-      ctx.cookies.set(sessionCookieName, ctx.oidc.session.id, instance(ctx.oidc.provider).configuration('cookies.long'));
+      ctx.oidc.cookies.set(sessionCookieName, ctx.oidc.session.id, instance(ctx.oidc.provider).configuration('cookies.long'));
       await ctx.oidc.session.save();
     }
 

test/test_helper.js

@@ -104,7 +104,7 @@ module.exports = function testHelper(dir, { config: base = path.basename(dir), m
 
     session.authorizations = {};
     clients.forEach((cl) => {
-      const ctx = new provider.OIDCContext({});
+      const ctx = new provider.OIDCContext({ req: { socket: {} }, res: {} });
       ctx.params = { scope, claims };
 
       if (ctx.params.claims && typeof ctx.params.claims !== 'string') {