# yar

> Cookie jar plugin for Hapi

Latest version **9.1.0** (published 2018-11-03) · BSD-3-Clause license · 0 weekly downloads

> **Deprecated.** This package is deprecated.

## Install

```sh
npm install yar
pnpm add yar
yarn add yar
bun add yar
```

## Health

**Score 10/100 (F)** — status: deprecated.

Negative: deprecated.

## Facts

| | |
|---|---|
| Version | 9.1.0 |
| Published | 2018-11-03 |
| First published | 2013-02-15 |
| Weekly downloads | 0 |
| License | BSD-3-Clause |
| TypeScript types | separate (@types/yar) |
| Module format | CommonJS |
| Dependencies | 3 |
| Unpacked size | 15.1 KB |
| Known vulnerabilities | 0 (+2 in 2 direct dependencies) |
| Install scripts | no |
| GitHub stars | 132 |
| Maintainers | hueniverse, marsup, nlf, wyatt |
| Keywords | hapi, plugin, cookies, jar, session |

## Links

- npm: https://www.npmjs.com/package/yar
- Repository: https://github.com/hapijs/yar
- Homepage: https://github.com/hapijs/yar#readme
- Issues: https://github.com/hapijs/yar/issues
- npm.io page: https://npm.io/package/yar

## Dependencies (3)

- [hoek](https://npm.io/package/hoek.md) 6.x.x
- [uuid](https://npm.io/package/uuid.md) 3.x.x
- [statehood](https://npm.io/package/statehood.md) 6.x.x

## Alternatives

- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads

## Recent versions

- 9.1.0 (latest) — 2018-11-03
- 3.0.2 (3.0.2) — 2014-12-10
- 2.3.1 (v2.3.1) — 2014-06-30
- 9.0.2 — 2018-09-24
- 9.0.1 — 2017-12-05
- 9.0.0 — 2017-12-05
- 8.1.2 — 2016-12-19
- 8.1.1 — 2016-11-23
- 8.1.0 — 2016-10-22
- 8.0.0 — 2016-09-07
- 7.0.2 — 2016-05-06
- 7.0.1 — 2016-05-06
- 7.0.0 — 2016-02-03
- 6.0.0 — 2016-01-05
- 5.0.1 — 2015-12-22
- … 30 more at https://npm.io/package/yar/versions

## README

# Yar

A [**hapi**](https://github.com/hapijs/hapi) session manager

[![npm version](https://badge.fury.io/js/yar.svg)](http://badge.fury.io/js/yar)
[![Build Status](https://secure.travis-ci.org/hapijs/yar.png)](http://travis-ci.org/hapijs/yar)

Lead Maintainer: [Eran Hammer](https://github.com/hueniverse)

The ***yar*** [Hapi](https://github.com/hapijs/hapi) plugin adds friendly session support to Hapi - a persistent state across multiple browser requests using an [iron](https://github.com/hueniverse/iron) encrypted cookie and server-side storage. **yar** tries to fit session data into a session cookie based  on a configured maximum size. If the content is too big to fit, it uses server storage via the [hapi plugin cache](http://hapijs.com/api#servercacheoptions) interface.

## Hapi-Auth-Cookie

There's another project called [Hapi-Auth-Cookie](https://github.com/hapijs/hapi-auth-cookie) that achieves similar ends to *yar*.  The approach of the two projects does differ in some regards, though.  
1. Yar is laser focused on session support, and does not require that a user be logged in to have a session. Hapi-Auth-Cookie only provides session storage for logged in users.  If you need session handling for non-authenticated users, use Yar.
1. Yar is capable of handling larger data sizes without any additional setup.  If your session data gets larger than cookies can handle Yar will push the data out to the server cache for you.  By default this is memory storage, but can be any [catbox](https://github.com/hapijs/catbox) supported cache storage, including mongo, redis, local disk, and more.  Hapi-Auth-Cookie can support larger session size as well, but requires you to handle connecting the cookie based session with your external data storage.

## Install

    $ npm install yar --save

## Usage

For example, the first handler sets a session key and the second gets it:
```javascript
let handler1 = (request, reply) => {

    request.yar.set('example', { key: 'value' });

    return null;
};

let handler2 = (request, reply) => {

    const example = request.yar.get('example');
    return example.key;     // Will send back 'value'
};
```

The plugin requires a password for encryption that must be at least 32 characters long:
```javascript
let options = {
    storeBlank: false,
    cookieOptions: {
        password: 'the-password-must-be-at-least-32-characters-long',
        isSecure: true
    }
};
/*
Please note that there are other default cookie options that can impact your security.
Please look at the description of the cookie options below to make sure this is doing
what you expect.
*/

const server = new Hapi.Server();

try {
  await server.register({
      plugin: require('yar'),
      options: options
  });
} catch(err) {
    console.error(err);
}

await server.start();
```

## Password considerations

Keep in mind some things in regard to your password:

1. It should never be committed to the repository or hard coded in your code.  Instead pass the password via environment variables or some other server configuration management option.
1. In some situations it is possible that your password could be attacked remotely.  So choose a password that is randomly generated.  Use a random password generator to create something rather than creating your own.  Make sure it is long and includes special characters.
1. Consider rotating your cookie session password on a regular basis.

## Cookie Options

You can read about more cookie options in the [Api](API.md).

### isSecure

Set `isSecure` (default `true`) to `false` if you are using standard http. Take care to do this in development mode only though. You don't want to use cookies sent over insecure channels for session management.  One way to take care of this is to use the `NODE_ENV` environment variable like this:

```javascript
let options = {
    cookieOptions: {
        isSecure: process.env.NODE_ENV !== 'development',
        ...
    }
};
```

### ignoreErrors

`ignoreErrors` (default `true`) tells Hapi that it should not respond with a HTTP 400 error if the session cookie cannot decrypt.  This could happen if the cookie is changed on the client, or more likely, if you change the cookie password in your settings.  If you want to make this condition send an error like it did in prior versions, change this to `false`, but be aware that if you change your cookie password you will cause 400 errors to be returned to end users.  In that case you should probably change this back to true for a short time to allow session cookies to get reset for the best user experience.

You may turn this off, `false`, and try to use the Hapi route state config option of `failAction` to instead get an event whenever a bad session cookie is encountered.  This can allow more sophisticated handling strategies or even allow for mitigation of brute force attacks on your cookie password.  See [server.state](http://hapijs.com/api#serverstatename-options) documentation for more details.

### clearInvalid

`clearInvalid` (default `true`) tells Hapi that if a session cookie is invalid for any reason, to clear it from the browser.  This prevents Hapi from having to reprocess the bad cookie on future requests.  In general you'll probably want this on, but if you'd prefer that session cookies be dealt with in some other way you may set this to `false`.

## API Reference

[Api Reference](API.md)

---
_Source: https://npm.io/package/yar · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._